VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Kontrola logu + detekované viry

https://forum.viry.cz:443/viewtopic.php?t=120825

Stránka 2 z 3

Re: Kontrola logu + detekované viry

Napsal: 02 dub 2012 19:48
od sh4ke
Který free antivir by jste doporučil? Mám ho instalovat teď nebo po všech procesech?

Re: Kontrola logu + detekované viry

Napsal: 02 dub 2012 19:57
od vyosek
:arrow: Zatim to nechte tak, pak tam dame nejake free zabezpeceni

:arrow: Stahnete Avenger http://forum.viry.cz/viewtopic.php?f=11&t=19832
  • Pokud pouzivate Win Vista ci W7, kliknete na Avenger pravym a dejte Run As Administrator ci Spustit jako spravce
  • Po spusteni Vas program upozorni, ze vse co delate, delate na vlastni riziko - Dejte OK
  • Po potvrzeni uz na Vas koukne hlavni okno, kam vlozite skript, ktery mate nize

  • Kód: Vybrat vše

    Folders to delete:
c:\windows\$NtUninstallKB14358$
  • Do ctverecku u Scan for rootkits a Automatically disable any rootkits found dejte fajecku
  • Nyni uz kliknete na Execute a potvrdte Yes v nasledujicim okne - timto potvrdite spusteni skriptu
  • Na otazku Reboot now odpovezte opet OK - timto se PC restartuje
  • Po restartu by se mel otevrit poznamkovy blok s logem a jeho obsah vlozte sem. Pokud se tak nestane, naleznete pozadovany dokument v C:\avenger.txt

Re: Kontrola logu + detekované viry

Napsal: 02 dub 2012 20:04
od sh4ke
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Folder "c:\windows\$NtUninstallKB14358$" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 08:14
od vyosek
Skript pro ComboFix - postup stejny jako minule

Kód: Vybrat vše

KillAll::

Driver::
.norton2009Reset

Collect::
C:\Program Files\Norton2009Reset.exe

Folder::
c:\program files\Eset\MiNODLogin

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"\\??\\c:\\WINDOWS\\system32\\winlogon.exe"=-

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

Firefox::
FF - ProfilePath - c:\documents and settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}

Reboot::

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 11:00
od sh4ke
ComboFix 12-04-01.03 - Asus 03.04.2012 11:43:55.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.895.475 [GMT 2:00]
Spuštěný z: c:\documents and settings\Asus\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Asus\Plocha\CFScript.txt
AV: ESET Smart Security 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-03 do 2012-04-03 )))))))))))))))))))))))))))))))
.
.
2012-04-02 15:32 . 2012-04-02 15:33 -------- d-----w- c:\program files\trend micro
2012-04-02 15:32 . 2012-04-02 15:33 -------- d-----w- C:\rsit
2012-04-02 14:41 . 2012-04-02 14:41 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\GHISLER
2012-04-01 17:25 . 2012-04-01 17:25 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\ESET
2012-04-01 17:25 . 2012-04-01 17:25 -------- d-----w- c:\documents and settings\Asus\Data aplikací\ESET
2012-04-01 17:24 . 2012-04-01 17:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2012-04-01 17:23 . 2012-04-01 17:23 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2012-04-01 10:36 . 2012-04-02 15:55 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\LogMeIn Hamachi
2012-04-01 10:35 . 2012-04-03 09:53 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
2012-04-01 10:35 . 2012-04-01 10:35 -------- d-----w- c:\program files\LogMeIn Hamachi
2012-04-01 09:49 . 2012-04-01 09:49 -------- d-----w- C:\ATI
2012-04-01 09:36 . 2012-04-01 09:38 -------- d-----w- C:\totalcmd
2012-04-01 09:27 . 2012-04-01 09:27 -------- d-----w- c:\program files\Valve
2012-03-31 08:28 . 2012-04-01 12:11 165232 ---ha-w- c:\documents and settings\Asus\Data aplikací\Microsoft\Virtual PC\VPCKeyboard.dll
2012-03-31 08:28 . 2012-03-31 08:28 -------- d-----w- c:\program files\Microsoft Virtual PC
2012-03-31 08:18 . 2012-03-31 08:18 -------- d-----w- c:\program files\Microsoft Works
2012-03-31 08:13 . 2012-03-31 08:13 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\Microsoft Help
2012-03-31 08:13 . 2012-03-31 08:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microsoft Help
2012-03-31 08:10 . 2003-06-18 23:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2012-03-31 08:10 . 2003-06-18 23:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2012-03-31 08:08 . 2012-03-31 08:08 -------- d-----w- c:\program files\Microsoft.NET
2012-03-31 08:06 . 2012-03-31 08:06 -------- d-----r- C:\MSOCache
2012-03-31 08:01 . 2012-03-31 08:01 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-03-31 07:59 . 2012-03-31 07:59 -------- d-----w- c:\documents and settings\Asus\Data aplikací\pdfforge
2012-03-31 07:59 . 2012-03-14 16:23 54784 ----a-w- c:\windows\system32\pdfcmon.dll
2012-03-31 07:59 . 2004-03-08 23:00 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-03-31 07:59 . 1998-06-23 23:00 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-03-31 07:59 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-03-31 07:59 . 2012-03-31 07:59 -------- d-----w- c:\program files\PDFCreator
2012-03-31 07:57 . 2012-03-31 07:57 637848 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-03-31 07:57 . 2012-03-31 07:57 567696 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-31 07:56 . 2012-03-31 07:56 -------- d-----w- c:\program files\CCleaner
2012-03-31 07:31 . 2012-04-03 09:54 -------- d-----w- c:\documents and settings\Asus\.rainlendar2
2012-03-31 07:30 . 2012-03-31 07:30 -------- d-----w- c:\program files\Rainlendar2
2012-03-31 07:22 . 2012-03-31 07:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Skype Extras
2012-03-30 19:13 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2012-03-30 19:11 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2012-03-30 19:09 . 2012-01-09 16:20 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-31 08:01 . 2008-10-21 07:16 473656 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-03-31 07:57 . 2007-09-26 05:27 141312 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-03 09:57 . 2004-08-18 12:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-09 16:20 . 2007-02-01 06:52 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-02_17.30.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-03 09:53 . 2012-04-03 09:53 16384 c:\windows\temp\Perflib_Perfdata_570.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@="{E4000AC4-5E5F-4956-807A-C5854405D64F}"
[HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}]
2007-09-18 09:56 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2011-08-12 2433024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-04-27 344064]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-08 3076144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Aktualizovat ESET licenci.lnk - c:\program files\Eset\MiNODLogin\MiNODLogin.exe [N/A]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43 69632 ----a-w- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
2004-06-09 07:37 40960 ----a-r- c:\windows\VM_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Control Center]
2006-03-21 13:50 1678336 ----a-w- c:\program files\ASUS\WLAN Card Utilities\Center.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-02-13 08:06 3481408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl]
2006-04-17 09:24 110592 ----a-r- c:\windows\ATK0100\HControl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-28 15:38 1987976 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-14 15:21 16270848 ----a-w- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-06-01 05:57 573440 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
2008-08-15 16:33 1473536 ----a-w- c:\program files\TO2SSM\McciTrayApp.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Valve\\Half-Life\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [4.8.2011 9:20 118104]
R2 ekrn;ESET Service;c:\program files\Eset\ESET Smart Security\ekrn.exe [8.9.2011 7:34 974944]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.2.2012 17:38 1373576]
R3 ZD1211BU(ASUS);ASUS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ASUS);c:\windows\system32\drivers\ZD1211BU.sys [1.2.2007 9:37 425472]
S3 AVerBDA3x;AVerMedia SAA713x BDA Service;c:\windows\system32\drivers\AVerBDA3x.sys [28.3.2007 16:41 1175936]
S3 ZSMC302;VIMICRO USB PC Camera;c:\windows\system32\drivers\usbVM31b.sys [16.10.2007 15:32 91263]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 19:31]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 19:31]
.
2012-04-03 c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} -
FF - ProfilePath - c:\documents and settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-03 11:54
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1952)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2864)
c:\windows\system32\VirtualExpander\VEShellExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Celkový čas: 2012-04-03 11:58:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-03 09:58
ComboFix2.txt 2012-04-02 18:42
ComboFix3.txt 2012-04-02 17:35
.
Před spuštěním: Volných bajtů: 58 166 812 672
Po spuštění: Volných bajtů: 58 145 079 296
.
- - End Of File - - 8189EFFBDC03771F99F0E1525ACB74C7

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 11:44
od vyosek
:arrow: Odistalujte ESET

:arrow: Nainstalujte free reseni, napr. Avast nebo Avira nebo MSE

:arrow: Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
  • Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
  • Zaskrtnete okenko Pro vsechny uzivatele
  • Zaskrtnete okenko Kontrola na havet "LOP"
  • Zaskrtnete okenko Kontrola na havet "Purity"
  • Stari souboru zmente z 30 dnu na 7 dnu
  • Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

  • Kód: Vybrat vše

    CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s
  • Kliknete na tlacitko Prohledat
  • Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 13:11
od sh4ke
OTL logfile created on: 3.4.2012 13:31:50 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Asus\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

895,36 Mb Total Physical Memory | 491,07 Mb Available Physical Memory | 54,85% Memory free
1,37 Gb Paging File | 0,96 Gb Available in Paging File | 69,92% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,53 Gb Total Space | 53,97 Gb Free Space | 72,41% Space Free | Partition Type: NTFS

Computer Name: ASUS | User Name: Asus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2012.04.03 13:29:52 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
PRC - [2012.03.27 04:28:45 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
PRC - [2012.02.28 17:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
PRC - [2011.12.09 12:40:53 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.09 12:40:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.09 12:40:29 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.12.09 12:40:29 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.12 07:45:18 | 002,433,024 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.03 15:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


========== Modules (No Company Name) ==========

MOD - [2012.03.27 04:28:43 | 000,444,400 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\ppgooglenaclpluginchrome.dll
MOD - [2012.03.27 04:28:42 | 003,915,248 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\pdf.dll
MOD - [2012.03.27 04:27:17 | 000,122,880 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avutil-51.dll
MOD - [2012.03.27 04:27:16 | 000,220,672 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avformat-53.dll
MOD - [2012.03.27 04:27:14 | 001,747,456 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avcodec-53.dll
MOD - [2012.03.27 03:37:41 | 008,747,168 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
MOD - [2011.12.09 12:40:40 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2011.08.12 07:45:26 | 000,198,144 | ---- | M] () -- C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
MOD - [2011.08.12 07:45:18 | 002,433,024 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
MOD - [2010.12.12 12:58:14 | 000,502,784 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_xrc_vc_rny.dll
MOD - [2010.12.12 12:58:00 | 000,131,584 | ---- | M] () -- C:\Program Files\Rainlendar2\wxbase28u_xml_vc_rny.dll
MOD - [2010.12.12 12:57:56 | 000,485,376 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_html_vc_rny.dll
MOD - [2010.12.12 12:57:44 | 000,707,584 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_adv_vc_rny.dll
MOD - [2010.12.12 12:57:36 | 002,633,216 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_core_vc_rny.dll
MOD - [2010.12.12 12:56:46 | 001,205,760 | ---- | M] () -- C:\Program Files\Rainlendar2\wxbase28u_vc_rny.dll
MOD - [2010.05.23 20:20:08 | 000,012,288 | ---- | M] () -- C:\Program Files\Rainlendar2\lfs.dll
MOD - [2010.05.23 20:20:04 | 000,126,976 | ---- | M] () -- C:\Program Files\Rainlendar2\lua51.dll
MOD - [2010.04.11 18:48:06 | 000,327,680 | ---- | M] () -- C:\Program Files\WinRAR\rarlng.dll
MOD - [2010.03.15 11:28:24 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.02.28 17:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.12.09 12:40:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.09 12:40:29 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2007.03.26 13:06:24 | 000,292,864 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.03.03 15:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pfc027.sys -- (SoC PC-Camera Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\NSNDIS5.SYS -- (NSNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awwh9xv1)
DRV - [2012.03.31 10:01:37 | 000,473,656 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2011.12.09 12:40:53 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.12.09 12:40:52 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.09 12:40:52 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.08.22 15:43:35 | 000,138,184 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK)
DRV - [2009.03.18 16:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.04.13 20:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.04.13 20:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008.04.13 20:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008.03.29 11:20:55 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2008.03.29 11:20:55 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008.03.13 13:51:52 | 000,057,536 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2008.03.13 13:50:02 | 000,072,000 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2007.03.01 08:11:40 | 001,175,936 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVerBDA3x.sys -- (AVerBDA3x)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.11.15 14:34:40 | 004,225,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.07.24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2006.06.14 18:16:00 | 000,425,472 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ZD1211BU.sys -- (ZD1211BU(ASUS)) ASUS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ASUS)
DRV - [2006.06.01 08:03:00 | 000,894,336 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2006.04.27 03:46:50 | 001,540,096 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.01.18 12:41:58 | 000,080,512 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2005.07.14 13:14:34 | 000,027,904 | ---- | M] (REDC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2005.07.12 20:00:30 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005.02.17 17:07:48 | 000,005,632 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2004.08.18 14:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.18 14:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004.08.17 05:44:22 | 000,091,263 | R--- | M] (VM) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbVM31b.sys -- (ZSMC302)
DRV - [2004.08.04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004.05.28 04:13:04 | 000,016,269 | R--- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\ATK0100\ASNDIS5.sys -- (ASNDIS5)
DRV - [2003.07.16 14:27:40 | 000,043,264 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [1999.09.10 13:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={ ... rer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchT ... urceid=ie7
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?sr ... earchTerms}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 0winampie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = http://google.icq.com/search/search_frame.php
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes,DefaultScope = {91D2E934-3C7C-404D-8CC1-16A2B0E4B762}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{03dda22f-9a77-45d1-8aea-81cd292335e6}: "URL" = http://www.mapy.cz/?query={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{04de38ac-5e22-4cf0-a66d-3abf1b59bc25}: "URL" = http://www.zbozi.cz/?q={searchTerms}&r= ... rceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?clien ... C436A12ADF
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q ... &ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchT ... EA_csCZ319
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{82f4bbed-5a19-4d9f-ab53-4a233ffe7d9c}: "URL" = http://www.firmy.cz/phr/{searchTerms}?sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{91D2E934-3C7C-404D-8CC1-16A2B0E4B762}: "URL" = http://search.seznam.cz/?q={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.as ... =CT2086743
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q ... &ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?sr ... earchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 0winampie7
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10
FF - prefs.js..network.proxy.http: "proxy.local"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://slirsredirect.search.aol.com/sli ... pab&query="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found
FF - HKCU\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.06.13 16:58:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.31 10:18:45 | 000,000,000 | ---D | M]

[2008.10.14 14:13:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Extensions
[2012.04.02 16:13:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions
[2008.10.14 14:13:25 | 000,000,000 | ---D | M] (WebTran) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}
[2010.06.13 13:04:30 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.06.12 19:47:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.13 13:04:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 16:44:22 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2012.03.29 23:23:37 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\askcom.xml
[2008.10.21 09:20:59 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\daemon-search.xml
[2012.03.29 23:33:41 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-1.xml
[2008.10.14 14:27:35 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-2.xml
[2008.11.21 12:58:28 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-3.xml
[2009.01.15 13:31:47 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-4.xml
[2010.09.24 12:00:22 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-5.xml
[2008.02.27 15:14:50 | 000,000,962 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin.xml
[2010.09.12 16:43:47 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\sweetim.xml
[2010.06.13 13:04:42 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\winamp-search.xml
[2010.06.12 18:00:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{0B38152B-1B20-484D-A11F-5E04A9B0661F}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}
[2009.02.25 17:11:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.04.01 18:51:34 | 000,000,638 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\jyxo-cz.xml
[2010.04.01 18:51:34 | 000,001,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\mall-cz.xml
[2010.04.01 18:51:34 | 000,001,367 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\seznam-cz.xml
[2010.04.01 18:51:34 | 000,000,654 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\slunecnice-cz.xml
[2010.04.01 18:51:34 | 000,001,179 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-cz.xml

========== Chrome ==========

CHR - default_search_provider: PHPNukeEN Customized Web Search (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/ResultsExt.as ... =CT2086743
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Vyhled\u00E1v\u00E1n\u00ED Google = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.04.03 11:53:46 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Podpora odkazu pro Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - Reg Error: Key error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - Reg Error: Key error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftup ... 0375997750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.152.40.4 10.152.40.5
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A959A310-2B37-4770-858E-B1DAC530491B}: DhcpNameServer = 10.152.40.4 10.152.40.5
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.02.01 08:56:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.g723 - g723.acm File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.I263 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2012.04.03 13:29:50 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
[2012.04.03 13:26:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\Avira
[2012.04.03 13:21:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Avira
[2012.04.03 13:20:56 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.04.03 13:20:54 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.04.03 13:20:54 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.04.03 13:20:54 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.04.03 13:20:53 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.04.03 13:20:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Avira
[2012.04.03 13:11:18 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012.04.03 11:51:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012.04.02 21:01:24 | 000,000,000 | ---D | C] -- C:\Avenger
[2012.04.02 19:07:57 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012.04.02 18:59:31 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012.04.02 18:59:31 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012.04.02 18:59:31 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012.04.02 18:59:31 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012.04.02 18:59:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012.04.02 18:59:20 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.04.02 18:57:37 | 004,453,973 | R--- | C] (Swearware) -- C:\Documents and Settings\Asus\Plocha\ComboFix.exe
[2012.04.02 18:10:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\RK_Quarantine
[2012.04.02 17:55:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Asus\Recent
[2012.04.02 17:32:59 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2012.04.02 17:32:58 | 000,000,000 | ---D | C] -- C:\rsit
[2012.04.02 16:41:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\GHISLER
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 19:24:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\ESET
[2012.04.01 12:36:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\LogMeIn Hamachi
[2012.04.01 12:35:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
[2012.04.01 12:35:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\LogMeIn Hamachi
[2012.04.01 12:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn Hamachi
[2012.04.01 11:49:18 | 000,000,000 | ---D | C] -- C:\ATI
[2012.04.01 11:36:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Total Commander
[2012.04.01 11:36:29 | 000,000,000 | ---D | C] -- C:\totalcmd
[2012.04.01 11:30:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Valve
[2012.04.01 11:27:37 | 000,000,000 | ---D | C] -- C:\Program Files\Valve
[2012.03.31 10:41:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Dokumenty\My Virtual Machines
[2012.03.31 10:39:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Radek
[2012.03.31 10:39:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\OPF-SU-materialy
[2012.03.31 10:39:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Michal K
[2012.03.31 10:38:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\CISCO
[2012.03.31 10:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Virtual PC
[2012.03.31 10:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2012.03.31 10:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2012.03.31 10:16:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\WinRAR
[2012.03.31 10:15:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\WinRAR
[2012.03.31 10:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\WinRAR
[2012.03.31 10:13:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft Help
[2012.03.31 10:13:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
[2012.03.31 10:10:27 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mdimon.dll
[2012.03.31 10:09:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Microsoft Office
[2012.03.31 10:09:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012.03.31 10:08:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.03.31 10:08:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.03.31 10:06:42 | 000,000,000 | R--D | C] -- C:\MSOCache
[2012.03.31 10:01:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\DAEMON Tools Lite
[2012.03.31 10:01:22 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.03.31 09:59:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\PDFCreator
[2012.03.31 09:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2012.03.31 09:59:08 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCOMCT2.OCX
[2012.03.31 09:59:08 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSMAPI32.OCX
[2012.03.31 09:59:08 | 000,054,784 | ---- | C] (pdfforge GbR) -- C:\WINDOWS\System32\pdfcmon.dll
[2012.03.31 09:59:06 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSMPIDE.DLL
[2012.03.31 09:59:05 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator
[2012.03.31 09:58:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Sun
[2012.03.31 09:57:45 | 000,637,848 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.03.31 09:57:45 | 000,567,696 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012.03.31 09:57:44 | 000,224,136 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012.03.31 09:57:44 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012.03.31 09:57:44 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012.03.31 09:56:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\CCleaner
[2012.03.31 09:56:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.03.31 09:45:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Systémové služby
[2012.03.31 09:31:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\.rainlendar2
[2012.03.31 09:30:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Rainlendar2
[2012.03.31 09:30:41 | 000,000,000 | ---D | C] -- C:\Program Files\Rainlendar2
[2012.03.31 09:22:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Skype Extras
[2012.03.30 21:13:06 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2012.03.30 21:11:12 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2012.03.30 21:09:23 | 000,139,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2012.03.30 20:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Google Chrome
[2012.03.30 14:09:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Dokumenty\Stažené soubory
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2012.04.03 13:33:59 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.04.03 13:29:52 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
[2012.04.03 13:24:39 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:21:14 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Avira Control Center.lnk
[2012.04.03 13:14:51 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:13:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.04.03 13:13:50 | 938,921,984 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.03 11:53:46 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012.04.02 22:53:06 | 000,619,236 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\1012638-1024x768-Beautiful_Orchid.jpg
[2012.04.02 19:08:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012.04.02 18:57:59 | 004,453,973 | R--- | M] (Swearware) -- C:\Documents and Settings\Asus\Plocha\ComboFix.exe
[2012.04.02 17:54:29 | 000,677,398 | ---- | M] () -- C:\Documents and Settings\Asus\Dokumenty\cc_20120402_175415.reg
[2012.04.02 16:41:10 | 000,000,124 | ---- | M] () -- C:\WINDOWS\amapro.dat
[2012.04.02 16:40:52 | 000,000,070 | ---- | M] () -- C:\WINDOWS\systems.dat
[2012.04.02 00:10:38 | 000,000,112 | ---- | M] () -- C:\Documents and Settings\All Users\Data aplikací\Aw1n2dA.dat
[2012.04.01 19:46:41 | 000,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Skype.lnk
[2012.04.01 19:25:38 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2012.04.01 14:12:26 | 4113,652,736 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vhd
[2012.04.01 14:12:26 | 098,562,908 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vsv
[2012.04.01 14:12:26 | 000,012,674 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vmc
[2012.04.01 13:11:17 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2012.04.01 12:35:13 | 000,000,685 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\LogMeIn Hamachi.lnk
[2012.04.01 12:24:32 | 000,442,606 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.04.01 12:24:32 | 000,440,548 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2012.04.01 12:24:32 | 000,084,052 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2012.04.01 12:24:32 | 000,072,542 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.04.01 12:00:43 | 000,198,552 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.04.01 11:49:10 | 000,000,329 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Zástupce - Dokumenty.lnk
[2012.04.01 11:36:31 | 000,000,548 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Total Commander.lnk
[2012.04.01 11:30:34 | 000,001,725 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Team Fortress Classic.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Ricochet.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Deathmatch Classic.lnk
[2012.04.01 11:30:34 | 000,001,669 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Half-Life.lnk
[2012.03.31 10:10:36 | 000,000,390 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012.03.31 10:01:37 | 000,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\DAEMON Tools Lite.lnk
[2012.03.31 09:59:18 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\PDFArchitect.lnk
[2012.03.31 09:59:18 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\PDFCreator.lnk
[2012.03.31 09:57:24 | 000,224,136 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012.03.31 09:57:24 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012.03.31 09:57:24 | 000,141,312 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012.03.31 09:57:23 | 000,637,848 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.03.31 09:57:23 | 000,567,696 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012.03.31 09:57:23 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012.03.31 09:56:43 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2012.03.31 09:30:56 | 000,001,596 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Rainlendar2.lnk
[2012.03.30 20:01:12 | 000,002,250 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Google Chrome.lnk
[2012.03.30 14:06:12 | 000,400,339 | ---- | M] () -- C:\ASWL2K.ini
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.04.03 13:33:59 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.04.03 13:21:14 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Avira Control Center.lnk
[2012.04.02 22:53:12 | 000,619,236 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\1012638-1024x768-Beautiful_Orchid.jpg
[2012.04.02 19:08:02 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012.04.02 19:07:59 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2012.04.02 18:59:31 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.04.02 18:59:31 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.04.02 18:59:31 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.04.02 18:59:31 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.04.02 18:59:31 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.04.02 17:54:18 | 000,677,398 | ---- | C] () -- C:\Documents and Settings\Asus\Dokumenty\cc_20120402_175415.reg
[2012.04.01 19:47:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\Aw1n2dA.dat
[2012.04.01 19:25:38 | 000,000,819 | ---- | C] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2012.04.01 14:12:15 | 098,562,908 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vsv
[2012.04.01 12:35:13 | 000,000,685 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\LogMeIn Hamachi.lnk
[2012.04.01 11:48:59 | 000,000,329 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Zástupce - Dokumenty.lnk
[2012.04.01 11:36:31 | 000,000,548 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Total Commander.lnk
[2012.04.01 11:30:34 | 000,001,725 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Team Fortress Classic.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Ricochet.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Deathmatch Classic.lnk
[2012.04.01 11:30:34 | 000,001,669 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Half-Life.lnk
[2012.03.31 10:40:49 | 051,362,849 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\ccna-vykovy-pruvodce-pripravou-na-zkousku-640-802.pdf
[2012.03.31 10:40:46 | 016,079,753 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\1587201828.pdf
[2012.03.31 10:30:16 | 000,012,674 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vmc
[2012.03.31 10:29:59 | 4113,652,736 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vhd
[2012.03.31 10:28:16 | 000,001,630 | ---- | C] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Microsoft Virtual PC.lnk
[2012.03.31 10:01:37 | 000,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\DAEMON Tools Lite.lnk
[2012.03.31 09:59:18 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\PDFArchitect.lnk
[2012.03.31 09:59:18 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\PDFCreator.lnk
[2012.03.31 09:56:43 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2012.03.31 09:30:56 | 000,001,596 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Rainlendar2.lnk
[2012.03.30 20:01:12 | 000,002,250 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Google Chrome.lnk
[2011.04.23 13:52:12 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2011.04.21 06:48:24 | 000,000,147 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2011.04.21 06:05:11 | 000,000,122 | ---- | C] () -- C:\WINDOWS\Winchat.ini
[2010.12.15 23:13:44 | 000,000,124 | ---- | C] () -- C:\WINDOWS\amapro.dat
[2010.12.15 23:13:41 | 000,000,070 | ---- | C] () -- C:\WINDOWS\systems.dat
[2010.04.04 20:46:01 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

========== LOP Check ==========

[2006.11.11 20:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\47821628
[2012.03.30 13:50:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alternative Software Ltd
[2006.12.05 12:09:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Autodesk
[2012.03.31 10:01:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2011.04.20 09:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ERS G-Studio
[2009.03.25 00:25:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ICQ
[2007.09.11 13:48:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Installations
[2009.12.07 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\IsolatedStorage
[2007.10.09 09:33:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Suite
[2009.01.13 20:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PCSettings
[2009.02.25 17:21:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ScanSoft
[2011.05.28 21:07:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\SugarGames
[2007.10.29 14:39:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2007.08.07 15:54:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\WinZip
[2008.12.19 07:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011.03.29 13:15:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2011.05.23 20:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Alternative Software Ltd
[2007.04.18 09:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Autodesk
[2010.05.21 13:40:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Broad Intelligence
[2008.11.14 15:00:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Canon
[2009.08.20 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite
[2007.05.30 12:29:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktop Sidebar
[2012.04.02 17:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktopicon
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 11:38:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\GHISLER
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[2007.02.14 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQLite
[2007.10.24 15:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Image Zone Express
[2007.03.17 08:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InterVideo
[2010.05.21 13:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Jpeg Resampler
[2009.08.22 07:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Leadertech
[2007.02.09 15:42:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\NewSoft
[2007.10.09 09:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nokia
[2010.05.21 13:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy
[2007.09.11 13:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC Suite
[2008.07.16 15:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC-FAX TX
[2012.03.31 09:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2011.05.22 22:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\RenPy
[2009.02.25 18:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Samsung
[2008.02.13 14:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Složka odesílání Share-to-Web
[2009.12.07 20:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca
[2009.06.13 19:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Uniblue
[2012.04.03 13:24:39 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

========== Purity Check ==========



========== Custom Scans ==========

< >

< >

< MD5 for: ATAPI.SYS >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.18 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\cmdcons\autochk.exe
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\system32\autochk.exe
[2004.08.18 14:00:00 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=CEA8636EC12F062C1ED8A7CB4E75324F -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe

< MD5 for: CDROM.SYS >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2004.08.18 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004.08.18 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:11:59 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=9B32416BD5988C97B6397CE0B02CAF97 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:23:39 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=ED7B460B142A32097B8A8F6ECC941815 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:28 | 000,131,840 | ---- | M] (Microsoft Corporation) MD5=6F61D3287A6A15A08A9433222C09D17F -- C:\WINDOWS\system32\HAL.DLL
[2004.08.18 14:00:00 | 000,131,968 | ---- | M] (Microsoft Corporation) MD5=F9A0F579FC18036FFDD9E26E0D268CCD -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll

< MD5 for: SCECLI.DLL >
[2004.08.18 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2004.08.18 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2006.04.20 13:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
[2008.06.20 12:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2007.10.30 18:53:32 | 000,360,832 | ---- | M] (Microsoft Corporation) MD5=64798ECFA43D78C7178375FCDD16D8C8 -- C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[2008.06.20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2007.10.30 19:20:55 | 000,360,064 | ---- | M] (Microsoft Corporation) MD5=90CAFF4B094573449A0872A0F919B178 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\ERDNT\cache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2004.08.18 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\SoftwareDistribution\Download\fe608cd8d2b8f77abaee7a69a696bcf7\sp3qfe\tcpip.sys
[2006.04.20 14:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2004.08.18 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004.08.18 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< >

< %systemroot%*.* /U /s >
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[10 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[3 C:\WINDOWS\system32\spool\PRINTERS\*.tmp files -> C:\WINDOWS\system32\spool\PRINTERS\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 13:11
od sh4ke
< %APPDATA%\*. >
[2009.02.25 16:34:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Adobe
[2007.02.15 15:50:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\AdobeUM
[2011.04.21 15:30:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Ahead
[2011.05.23 20:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Alternative Software Ltd
[2008.04.30 10:52:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Apple Computer
[2007.04.18 09:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Autodesk
[2012.04.03 13:26:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Avira
[2010.05.21 13:40:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Broad Intelligence
[2008.05.05 09:55:55 | 000,000,000 | R--D | M] -- C:\Documents and Settings\Asus\Data aplikací\Brother
[2008.11.14 15:00:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Canon
[2007.02.13 11:29:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Corel
[2007.04.05 09:20:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\CyberLink
[2009.08.20 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite
[2007.05.30 12:29:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktop Sidebar
[2012.04.02 17:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktopicon
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2010.05.21 13:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESTsoft
[2012.04.01 11:38:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\GHISLER
[2010.05.08 17:31:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Google
[2007.02.09 14:54:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Help
[2007.10.24 15:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\HP
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[2007.02.14 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQLite
[2007.02.01 09:06:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Identities
[2007.10.24 15:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Image Zone Express
[2011.03.29 13:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InstallShield
[2007.03.17 08:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InterVideo
[2010.05.21 13:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Jpeg Resampler
[2009.08.22 07:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Leadertech
[2007.02.14 12:51:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Macromedia
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Media Player Classic
[2012.03.31 10:28:58 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Asus\Data aplikací\Microsoft
[2011.05.25 19:46:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Motive
[2008.10.14 14:13:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Mozilla
[2011.04.21 00:50:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nero
[2007.02.09 15:42:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\NewSoft
[2007.10.09 09:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nokia
[2010.05.21 13:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy
[2007.09.11 13:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC Suite
[2008.07.16 15:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC-FAX TX
[2012.03.31 09:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2009.04.30 19:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Real
[2011.05.22 22:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\RenPy
[2009.02.25 18:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Samsung
[2009.08.22 15:22:30 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\Asus\Data aplikací\SecuROM
[2012.04.02 17:55:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Skype
[2012.04.01 19:07:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\skypePM
[2008.02.13 14:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Složka odesílání Share-to-Web
[2009.12.07 20:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca
[2007.09.25 15:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Sun
[2008.12.19 06:05:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Symantec
[2009.01.18 12:32:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\U3
[2009.06.13 19:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Uniblue
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Winamp
[2012.03.31 10:16:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2009.10.03 13:29:57 | 001,961,720 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Asus\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2010.05.21 13:19:10 | 000,078,324 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy\OpenCandy_BA2A2780458240A8AB9D885919E2D5EE\WeFiSetup_5_142_513Wrapped.exe
[2009.12.07 20:17:42 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca\SMSposilac.exe
[2005.06.06 11:29:14 | 000,110,592 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\U3\temp\cleanup.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job >
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:54:31 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007.02.01 09:42:57 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2007.02.01 09:42:57 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2007.02.01 09:42:57 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2012.04.01 12:00:43 | 000,198,552 | ---- | M] () -- C:\WINDOWS\system32\FNTCACHE.DAT
[2012.04.01 12:24:32 | 000,084,052 | ---- | M] () -- C:\WINDOWS\system32\perfc005.dat
[2012.04.01 12:24:32 | 000,072,542 | ---- | M] () -- C:\WINDOWS\system32\perfc009.dat
[2012.04.01 12:24:32 | 000,440,548 | ---- | M] () -- C:\WINDOWS\system32\perfh005.dat
[2012.04.01 12:24:32 | 000,442,606 | ---- | M] () -- C:\WINDOWS\system32\perfh009.dat
[2012.04.01 12:24:31 | 001,048,882 | ---- | M] () -- C:\WINDOWS\system32\PerfStringBackup.INI
[2012.04.03 13:14:51 | 000,012,598 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"Rainlendar2" = C:\Program Files\Rainlendar2\Rainlendar2.exe -- [2011.08.12 07:45:18 | 002,433,024 | ---- | M] ()

< >

< %PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5 >
[2010.04.01 19:59:58 | 000,910,296 | ---- | M] (Mozilla Corporation) MD5=49958506B773E40D31832E3EEDA522E7 -- C:\Program Files\Mozilla Firefox\firefox.exe

< %PROGRAMFILES%\Internet Explorer\iexplore.exe /md5 >
[2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\Program Files\Internet Explorer\iexplore.exe

< %PROGRAMFILES%\Opera\opera.exe /md5 >

< %PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5 >

< >

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2012.04.03 13:33:59 | 000,000,512 | ---- | M] () MD5=1FDBD6FB4781692E810D70FFF60A10E6 -- C:\PhysicalMBR.bin

< >

< *crack* /s >
[2011.04.20 13:32:27 | 000,000,363 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Microsoft\Office\Naposledy otevřené\dead_space_english_ISO+crack.LNK

< *keygen* /s >
[2011.04.20 13:32:27 | 000,000,508 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Microsoft\Office\Naposledy otevřené\dad space keygen.doc.LNK

< *loader* /s >
[2012.03.16 20:35:32 | 000,009,051 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\loader.gif
[2012.03.16 20:35:32 | 000,016,119 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\logo_loader_page.jpg
[2012.03.16 20:35:32 | 000,018,434 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\logo_loader_page.png
[2012.03.16 20:35:32 | 000,006,553 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\js\app\MediaInfo\ImageInfoLoader.js
[2009.04.12 10:53:38 | 000,000,232 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Nero\OnlineServices\NOSWebConfig\MySpace\uploadError-CSY.xml
[2011.12.09 12:40:31 | 000,047,568 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloader.dll
[2011.12.09 12:40:31 | 000,234,448 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloader.exe
[2011.12.09 12:40:32 | 001,715,152 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloadergui.dll
[2007.06.27 19:03:00 | 000,177,448 | ---- | M] () -- \Program Files\Common Files\Ahead\Lib\NeGuideStoreLoader.dll
[2006.10.26 13:40:34 | 000,057,344 | ---- | M] () -- \Program Files\Common Files\Microsoft Shared\VS7DEBUG\coloader.dll
[2006.10.26 13:40:34 | 000,005,120 | ---- | M] () -- \Program Files\Common Files\Microsoft Shared\VS7DEBUG\coloader.tlb
[2006.02.03 20:09:02 | 000,352,548 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\models\loader.mdl
[2006.02.03 20:09:12 | 000,012,764 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\sound\ambience\loader_hydra1.wav
[2006.02.03 20:09:12 | 000,012,164 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\sound\ambience\loader_step1.wav
[2010.03.15 11:28:24 | 000,045,056 | ---- | M] () -- \Program Files\WinRAR\RarExtLoader.exe
[2004.08.18 14:00:00 | 000,035,840 | ---- | M] () -- \WINDOWS\$NtServicePackUninstall$\dmloader.dll
[2002.12.12 00:14:32 | 000,033,280 | ---- | M] () -- \WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmloader.dll
[2008.04.14 05:21:39 | 000,035,840 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\dmloader.dll
[2008.04.13 20:31:47 | 000,230,912 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\osloader.exe
[2008.04.13 20:31:48 | 000,278,528 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\osloader.ntd
[2008.04.14 05:21:39 | 000,035,840 | ---- | M] () -- \WINDOWS\system32\dmloader.dll
[2 \WINDOWS\system32\*.tmp files -> \WINDOWS\system32\*.tmp -> ]
[2002.12.12 00:14:32 | 000,033,280 | ---- | M] () -- \WINDOWS\system32\dllcache\dmloader.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:CB0AACC9

< End of report >

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 13:12
od sh4ke
OTL Extras logfile created on: 3.4.2012 13:31:50 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Asus\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

895,36 Mb Total Physical Memory | 491,07 Mb Available Physical Memory | 54,85% Memory free
1,37 Gb Paging File | 0,96 Gb Available in Paging File | 69,92% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,53 Gb Total Space | 53,97 Gb Free Space | 72,41% Space Free | Partition Type: NTFS

Computer Name: ASUS | User Name: Asus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" = C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe:*:Enabled:Media Player Classic - Homecinema -- (mpc-hc@Sourceforge)
"C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" = C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup -- (Nero AG)
"C:\Program Files\Valve\Half-Life\hl.exe" = C:\Program Files\Valve\Half-Life\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{066D65EA-ED53-44E4-A96A-F81B6E409D2E}" = PC Connectivity Solution
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = Ovládací panel ATI
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{654b2e8b-91db-4d50-9af7-9c12b4c83f96}.sdb" = AH64-LB2
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{847CAE64-4CD2-4B2D-AF00-978FF5431029}" = Nero 7 Ultra Edition
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}" = ATI Parental Control & Encoder
"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0405-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-00A1-0405-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Czech) 2007
"{90120000-00BA-0405-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Czech) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1029-7B44-A81200000003}" = Adobe Reader 8 - Czech
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet NIC Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E2494AD8-314D-44F8-B39C-4358A60DC184}" = LogMeIn Hamachi
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"All ATI Software" = Softarová utilita ATI - Odinstalovat
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"CodInstl" = Intel A/V Codecs V2.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"DTE" = DTE
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Half-Life_is1" = Half-Life
"HControl" = ATK0100 ACPI UTILITY
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.7.5
"LogMeIn Hamachi" = LogMeIn Hamachi
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MV2Player" = MV2Player (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"O2 Internet Konfigurator" = O2 Internet Konfigurator
"Rainlendar2" = Rainlendar2 (remove only)
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"Totalcmd" = Total Commander (Remove or Repair)
"Uniblue RegistryBooster 2009" = Uniblue RegistryBooster 2009
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24.5.2011 4:53:21 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace explorer.exe, verze 6.0.2900.5512, chybující modul
unknown, verze 0.0.0.0, adresa chyby 0x0fc085ff.

Error - 25.5.2011 15:33:37 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 25.5.2011 15:33:37 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 26.5.2011 7:26:54 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace wmplayer.exe, verze 11.0.5721.5145, chybující modul
kernel32.dll, verze 5.1.2600.5781, adresa chyby 0x00009e8a.

Error - 28.5.2011 15:19:01 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace billclub.dat, verze 1.0.0.3, chybující modul msvcrt.dll,
verze 7.0.2600.5512, adresa chyby 0x00036371.

Error - 30.3.2012 7:41:32 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace svchost.exe, verze 5.1.2600.5512, chybující modul
ntdll.dll, verze 5.1.2600.6055, adresa chyby 0x00019af2.

Error - 31.3.2012 3:24:25 | Computer Name = ASUS | Source = crypt32 | ID = 131077
Description = Načtení automatické aktualizace kořenového certifikátu jiného výrobce
z: <http://www.download.windowsupdate.com/m ... C7DC25.crt>
se nezdařilo. Chyba: Daná operace se vrátila, protože vypršel časový limit.

Error - 31.3.2012 4:27:39 | Computer Name = ASUS | Source = MsiInstaller | ID = 11931
Description = Product: MSXML 6.0 Parser (KB927977) -- Error 1931. The Windows Installer
service cannot update the system file C:\WINDOWS\system32\msxml6r.dll because the
file is protected by Windows. You may need to update your operating system for
this program to work correctly. Package version: 6.0.3883.0, OS Protected version:
6.0.3883.0

Error - 1.4.2012 6:35:17 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 1.4.2012 8:11:00 | Computer Name = ASUS | Source = Microsoft Virtual PC 2007 | ID = 1000
Description =

[ System Events ]
Error - 2.4.2012 14:26:26 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba LogMeIn Hamachi Tunneling Engine byla neočekávaně ukončena.
Tento stav nastal již 1krát.

Error - 2.4.2012 15:02:24 | Computer Name = ASUS | Source = sr | ID = 1
Description = Filtr nástroje Obnovení systému zjistil neočekávanou chybu 0xC0000001
při zpracování souboru na svazku HarddiskVolume1. Sledování svazku bylo ukončeno.


Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba McciCMService byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Adaptér výkonu služby WMI byla neočekávaně ukončena. Tento
stav nastal již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Pml Driver HPZ12 byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Ati HotKey Poller byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Zařazování tisku byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Služba brány aplikačního rozhraní byla neočekávaně ukončena.
Tento stav nastal již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Java Quick Starter byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba LogMeIn Hamachi Tunneling Engine byla neočekávaně ukončena.
Tento stav nastal již 1krát.


< End of report >

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 13:23
od vyosek
:arrow: Spustte znovu OTL
  • Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

  • Kód: Vybrat vše

    :otl
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pfc027.sys -- (SoC PC-Camera Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\NSNDIS5.SYS -- (NSNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awwh9xv1)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 685&query={searchTerms}&invocationType=tb50winampie7
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = http://google.icq.com/search/search_frame.php
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes,DefaultScope = {91D2E934-3C7C-404D-8CC1-16A2B0E4B762}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{03dda22f-9a77-45d1-8aea-81cd292335e6}: "URL" = http://www.mapy.cz/?query={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{04de38ac-5e22-4cf0-a66d-3abf1b59bc25}: "URL" = http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=43531B51-63FE-4D54-8BDB-21D9F414407D&apn_sauid=B6FD8225-BBF6-4083-8C1B-FEC436A12ADF
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GPEA_csCZ319
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{82f4bbed-5a19-4d9f-ab53-4a233ffe7d9c}: "URL" = http://www.firmy.cz/phr/{searchTerms}?sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{91D2E934-3C7C-404D-8CC1-16A2B0E4B762}: "URL" = http://search.seznam.cz/?q={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2086743
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 685&query={searchTerms}&invocationType=tb50winampie7
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..network.proxy.http: "proxy.local"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
[2010.06.13 13:04:30 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.06.13 13:04:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 16:44:22 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2012.03.29 23:23:37 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\askcom.xml
[2008.10.21 09:20:59 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\daemon-search.xml
[2012.03.29 23:33:41 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-1.xml
[2008.10.14 14:27:35 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-2.xml
[2008.11.21 12:58:28 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-3.xml
[2009.01.15 13:31:47 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-4.xml
[2010.09.24 12:00:22 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-5.xml
[2008.02.27 15:14:50 | 000,000,962 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin.xml
[2010.09.12 16:43:47 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\sweetim.xml
[2010.06.13 13:04:42 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\winamp-search.xml
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{0B38152B-1B20-484D-A11F-5E04A9B0661F}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}
CHR - default_search_provider: search_url = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2086743
O2 - BHO: (no name) - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - No CLSID value found.
3 - HKLM\..\Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - Reg Error: Key error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - Reg Error: Key error. File not found
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 19:24:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:38 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2008.12.19 07:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011.03.29 13:15:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[10 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[3 C:\WINDOWS\system32\spool\PRINTERS\*.tmp files -> C:\WINDOWS\system32\spool\PRINTERS\*.tmp -> ]
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:54:31 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:CB0AACC9

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
  • Nasledne kliknete na Opravit
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 14:04
od sh4ke
Tak nastal následující problém. Při resetování souboru HOSTS došlo k chybě a systém se zasekl. Nemohu se připojit k internetu, DHCP server nepřidělil žádnou IP adresu ani masku. Zkoušel jsem vymazat cache, ale to nepomohlo. Možná je soubor HOSTS poškozený nebo nevím. Každopádně jsem se do něho díval a vypadá netknutý, tak nevím...píši z jiného PC.

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 14:07
od vyosek
hosts soubor v tom bude nevinne, byl cisty i predtim...

zkuste restartovat router a mrknete na nastaveni pripojeni ci je dle smlouvy

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 14:30
od sh4ke
Restart nepomohl, zkoušel jsem i IP adresu uvolnit a znova přidělit, v ipconfig /all ale mám IP adresu a masku 0.0.0.0...zkoušel jsem i zakázat a povolit ovladač na síťové kartě...píše mi to chybu při obnovování IP adresy. Od providera mám nastavené automatické přidělování v rámci DHCP. Jinak to ani nejde u něho. Druhý PC na routeru jede zcela bez problémů.

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 14:32
od vyosek
Restart, mackat F8, zvolit posledni znama funkcni konfigurace

Re: Kontrola logu + detekované viry

Napsal: 03 dub 2012 14:38
od sh4ke
Poslední známá konfigurace nepomohla, zkusím ještě bod obnovení po odebrání Esetu.
Všechny časy jsou v UTC+01:00
Stránka 2 z 3

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz