zvýšený přístup na HDD (několik dní), prosím o kontrolu

Zpráva

mraz233 · #16 Příspěvek od **mraz233** » 20 črc 2012 15:10

Dobrý den, mám za to, že se podezření potvrdilo

Zkusím na to jít od lesa jinak: program, jehož se to týká, nepoužívám, nelíbí se mi, vykopnu ho. Má potom cenu dělat další scany ?
Děkuji, Ivo Mráz

Tohle je výsledek C:\Users\Admin\AppData\Local\Thinstall\Cache\Stubs\c0946239351e639c656ab903cda420939dba\dvdcloner.exe

Antivirus Result Update
AntiVir - 20120720
Antiy-AVL - 20120717
Avast Win32:MDE-B [Susp] 20120720
AVG - 20120720
BitDefender - 20120720
CAT-QuickHeal (Suspicious) - DNAScan 20120720
ClamAV - 20120720
Commtouch - 20120720
Comodo TrojWare.Win32.Trojan.Agent.~IDA 20120720
DrWeb - 20120720
Emsisoft - 20120720
eSafe - 20120719
ESET-NOD32 - 20120720
F-Prot - 20120720
F-Secure - 20120720
Fortinet - 20120720
GData Win32:MDE-B 20120720
Ikarus - 20120720
Jiangmin TrojanDropper.VB.ekl 20120720
K7AntiVirus - 20120719
Kaspersky - 20120720
McAfee - 20120720
McAfee-GW-Edition - 20120720
Microsoft - 20120720
Norman - 20120720
nProtect - 20120720
Panda - 20120720
PCTools - 20120720
Rising Suspicious 20120720
Sophos - 20120720
SUPERAntiSpyware - 20120720
Symantec - 20120720
TheHacker Trojan/Packed.gen 20120719
TotalDefense - 20120718
TrendMicro - 20120720
TrendMicro-HouseCall - 20120720
VBA32 - 20120720
VIPRE - 20120720
ViRobot - 20120720
VirusBuster TrojanSpy.Agent!vgI3i1TRKfY 20120720

Tohle vyšlo u C:\Program Files\Any Video Converter Professional v3.1.5 CZ Portable\Stubs\9aac5e273dd68ea31fd8621b479b8ceb421e\mp4creator.exe

AhnLab-V3 - 20120720
AntiVir - 20120720
Antiy-AVL - 20120717
Avast - 20120720
AVG - 20120720
BitDefender - 20120720
ByteHero - 20120719
CAT-QuickHeal (Suspicious) - DNAScan 20120720
ClamAV - 20120720
Commtouch - 20120720
Comodo TrojWare.Win32.TrojanDropper.Binder.v 20120720
DrWeb - 20120720
Emsisoft - 20120720
eSafe - 20120719
ESET-NOD32 - 20120720
F-Prot - 20120720
F-Secure - 20120720
Fortinet - 20120720
GData - 20120720
Ikarus - 20120720
Jiangmin Backdoor/Bifrose.bth 20120720
K7AntiVirus - 20120719
Kaspersky - 20120720
McAfee - 20120720
McAfee-GW-Edition - 20120720
Microsoft - 20120720
Norman - 20120720
nProtect Trojan/W32.Agent.28672.BDY 20120720
Panda - 20120720
PCTools - 20120720
Rising Dropper.Win32.Undef.cfi 20120720
Sophos - 20120720
SUPERAntiSpyware Trojan.Agent/Gen-Backdoor 20120720
Symantec - 20120720
TheHacker - 20120719
TotalDefense - 20120718
TrendMicro - 20120720
TrendMicro-HouseCall - 20120720
VBA32 - 20120720
VIPRE - 20120720
ViRobot - 20120720
VirusBuster - 20120720

tohle je další podezřelý C:\Program Files\Any Video Converter Professional v3.1.5 CZ Portable\Stubs\b1a15b1c70b8ad4fe7fe8af8d3e17dcc91977ec\mplayer.exe

AhnLab-V3 - 20120720
AntiVir - 20120720
Antiy-AVL - 20120717
Avast - 20120720
AVG - 20120720
BitDefender - 20120720
ByteHero - 20120719
CAT-QuickHeal (Suspicious) - DNAScan 20120720
ClamAV - 20120720
Commtouch - 20120720
Comodo TrojWare.Win32.TrojanDropper.Binder.v 20120720
DrWeb - 20120720
Emsisoft - 20120720
eSafe Win32.Trojan 20120719
ESET-NOD32 - 20120720
F-Prot - 20120720
F-Secure - 20120720
Fortinet - 20120720
GData - 20120720
Ikarus - 20120720
Jiangmin Backdoor/Bifrose.bth 20120720
K7AntiVirus - 20120719
Kaspersky - 20120720
McAfee - 20120720
McAfee-GW-Edition - 20120720
Microsoft - 20120720
Norman - 20120720
nProtect - 20120720
Panda - 20120720
PCTools Trojan.Gen 20120720
Rising Dropper.Win32.Undef.cfi 20120720
Sophos - 20120720
SUPERAntiSpyware Trojan.Agent/Gen-Backdoor 20120720
Symantec Trojan.Gen.2 20120720
TheHacker - 20120719
TotalDefense - 20120718
TrendMicro - 20120720
TrendMicro-HouseCall TROJ_GEN.R4FH1IK 20120720
VBA32 - 20120720
VIPRE - 20120720
ViRobot - 20120720
VirusBuster - 20120720

a poslední v řadě C:\Program Files\Any Video Converter Professional v3.1.5 CZ Portable\Stubs\ce6c3d76f9da90165585a3c6f946063afe5e352\mencoder.exe

AhnLab-V3 - 20120720
AntiVir - 20120720
Antiy-AVL - 20120717
Avast - 20120720
AVG - 20120720
BitDefender - 20120720
ByteHero - 20120719
CAT-QuickHeal (Suspicious) - DNAScan 20120720
ClamAV - 20120720
Commtouch - 20120720
Comodo TrojWare.Win32.TrojanDropper.Binder.v 20120720
DrWeb - 20120720
Emsisoft - 20120720
eSafe - 20120719
ESET-NOD32 - 20120720
F-Prot - 20120720
F-Secure - 20120720
Fortinet - 20120720
GData - 20120720
Ikarus - 20120720
Jiangmin Backdoor/Bifrose.bth 20120720
K7AntiVirus - 20120719
Kaspersky - 20120720
McAfee - 20120720
McAfee-GW-Edition - 20120720
Microsoft - 20120720
Norman - 20120720
nProtect - 20120720
Panda - 20120720
PCTools - 20120720
Rising Dropper.Win32.Undef.cfi 20120720
Sophos - 20120720
SUPERAntiSpyware Trojan.Agent/Gen-Backdoor 20120720
Symantec WS.Reputation.1 20120720
TheHacker - 20120719
TotalDefense - 20120718
TrendMicro - 20120720
TrendMicro-HouseCall - 20120720
VBA32 - 20120720
VIPRE - 20120720
ViRobot - 20120720
VirusBuster - 20120720

#17 Příspěvek od **Márty84** » 20 črc 2012 15:38

Pokud je nepouzivate, nechte soubory odstranit.

Pak MBAM zase odinstalujte a dejte mi sem jeste log z OTL

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce
Oznacte polozky (dejte tam zatrzitka) Pro všechny uživatele, Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Do spodniho okna vlozte nasledujici text

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c

type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5

*crack* /s
*keygen* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

Kliknete na Prohledat
Po skenu se vytvori dva logy (OTL.Txt a Extras.txt), oba sem vlozte (kdyz budou dlouhe, rozdelte je do vice prispevku).

mraz233 · #18 Příspěvek od **mraz233** » 20 črc 2012 16:48

Kontrola stále probíhá. Co mám udělat s oknem s informací "Cannot create file C:\Users\Admin\Desktop\cmd.bat" ?

mraz233 · #19 Příspěvek od **mraz233** » 20 črc 2012 16:55

Zvolil jsem jedinou variantu - potvrdit "OK" a jeví se mi, že program přestal pracovat (alespoň soudě dle neměnného stavu dolního informačního řádku). Mezitím jsem vyhledal i dalšího nešťastníka s tímtéž problémem - a mohu potvrdit, že jsem program OTL skutečně spustil jako správce.
Zkusím restart a program znovu spustím...

Tak tohle zadání nesplním. Stejná hláška a konec

#20 Příspěvek od **Márty84** » 20 črc 2012 17:28

Pokud to nepujde, zkuste to v nouzovem rezimu s timto pozmenenym skriptem.

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

*crack* /s
*keygen* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

mraz233 · #21 Příspěvek od **mraz233** » 20 črc 2012 17:47

Děkuji, jedu v nouzovém režimu. Protože vím, že za chvilku odcházíte, moc děkuji za dnešní pomoc a přeji dle možností klidnou noční. V pondělí se mění HDD, asi budu moci pokračovat až v úterý

#22 Příspěvek od **Márty84** » 20 črc 2012 17:58

No nemate zac, moc jsme toho dnes nestihli

Mozna, ze ta vymena disku by nebyla treba a stacilo by pc naformatovat. To bohuzel nemam jak zjistit.
Takze bud o vikendu, nebo az ten pristi tyden, se ozvete a budeme pokracovat, nebo pokud problemy odezni, se jen rozloucime

Zatim se mejte

mraz233 · #23 Příspěvek od **mraz233** » 20 črc 2012 18:13

"Takze bud o vikendu" ??? Vy pracujete i o víkendu ? Zkusím se přihlásit ...
V nouzovém režimu jsem skončil s hláškou "List index out of bounds (23)" a úplně dole oznámením "Application Event Log record 16243"

#24 Příspěvek od **Márty84** » 20 črc 2012 18:18

No nekdy pracuji i o vikendu, tentokrat mam vikend volny. Tady na forum pisu z domu, to neni prace, to je konicek

Za 10 minut mi jede autobus a jdu do prace (ktera nema s pc nic spolecneho)

O vikendu tu budu nakukovat v prubehu celeho dne (obou), takze pokud se tu objevi log, nebo zprava, urcite odepisu

Zkuste spustit OTL bez vlozeni skriptu.

mraz233 · #25 Příspěvek od **mraz233** » 20 črc 2012 18:45

Průběh mnohem rychlejší, hláška "list index of ..." zcela shodná, protokol událostí nese číslo 16270....V protokolu událostí nic z času skončení programu, ale - na ploše je tento soubor, sláva !:

OTL logfile created on: 20.7.2012 19:36:36 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Admin\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

3,25 Gb Total Physical Memory | 2,13 Gb Available Physical Memory | 65,61% Memory free
6,50 Gb Paging File | 5,21 Gb Available in Paging File | 80,26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 645,60 Gb Free Space | 69,31% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.20 17:24:43 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
PRC - [2012.04.30 16:18:00 | 005,235,608 | R--- | M] (Western Digital Technologies, Inc.) -- C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe
PRC - [2012.04.24 09:31:34 | 001,150,368 | R--- | M] (Western Digital ) -- C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
PRC - [2012.04.11 12:09:14 | 001,177,496 | R--- | M] (Western Digital ) -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
PRC - [2012.04.11 12:01:46 | 000,247,704 | R--- | M] (Western Digital) -- C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
PRC - [2012.01.24 18:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011.11.28 02:19:04 | 001,229,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011.11.23 03:36:24 | 002,391,832 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011.10.12 07:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011.10.10 07:23:34 | 000,973,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2011.09.08 20:53:26 | 000,743,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011.09.02 02:15:40 | 000,227,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
PRC - [2011.08.15 06:21:40 | 000,337,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.05.21 07:01:00 | 000,839,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2011.05.21 07:01:00 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

========== Modules (No Company Name) ==========

MOD - [2012.07.10 06:09:00 | 000,438,296 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppgooglenaclpluginchrome.dll
MOD - [2012.07.10 06:08:59 | 003,972,120 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
MOD - [2012.07.10 06:07:39 | 000,554,520 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\libglesv2.dll
MOD - [2012.07.10 06:07:37 | 000,117,784 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\libegl.dll
MOD - [2012.07.10 06:07:22 | 000,140,328 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\avutil-51.dll
MOD - [2012.07.10 06:07:21 | 000,262,184 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\avformat-54.dll
MOD - [2012.07.10 06:07:19 | 002,386,984 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\avcodec-54.dll
MOD - [2012.07.10 04:17:27 | 009,255,112 | ---- | M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
MOD - [2010.03.15 12:28:24 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

========== Win32 Services (SafeList) ==========

SRV - [2012.04.24 09:31:34 | 001,150,368 | R--- | M] (Western Digital ) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe -- (WDBackup)
SRV - [2012.04.11 12:09:14 | 001,177,496 | R--- | M] (Western Digital ) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe -- (WDRulesService)
SRV - [2012.04.11 12:01:46 | 000,247,704 | R--- | M] (Western Digital) [Auto | Running] -- C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe -- (WDDriveService)
SRV - [2011.11.23 03:36:24 | 002,391,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgfws.exe -- (avgfws)
SRV - [2011.10.12 07:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010.11.17 00:51:10 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\appliand.sys -- (appliandMP)
DRV - [2011.10.07 07:23:48 | 000,230,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2011.10.04 07:21:28 | 000,016,720 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011.09.13 06:30:10 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.08.08 06:08:58 | 000,040,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.07.11 01:14:38 | 000,295,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.07.11 01:14:14 | 000,024,272 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011.07.11 01:14:12 | 000,134,736 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011.07.11 01:14:12 | 000,023,120 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV - [2011.05.23 01:03:28 | 000,047,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgfwd6x.sys -- (Avgfwfd)
DRV - [2011.05.21 07:01:00 | 010,589,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.03.10 17:16:12 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ivusb.sys -- (ivusb)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.02.13 13:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 F1 A5 21 C9 71 CA 01 [binary data]
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes,DefaultScope = {80B005AD-673F-40D8-9611-CADFE4D9B452}
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes\{0D2B5428-BE2B-4A8F-9BF1-E638CF0D9F97}: "URL" = http://cs.wikipedia.org/w/index.php?tit ... earchTerms}
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes\{80B005AD-673F-40D8-9611-CADFE4D9B452}: "URL" = http://www.google.cz/search?q={searchTe ... {startPage}
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={A1CC ... earchTerms}
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012.02.01 10:23:18 | 000,000,000 | ---D | M]

========== Chrome ==========

CHR - homepage: http://www.google.cz/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.cz/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Nero Kwik Media Helper (Enabled) = C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Vyhled\u00E1v\u00E1n\u00ED Google = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AVG Safe Search = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\
CHR - Extension: Gmail = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.07.19 15:49:22 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (IE7Pro BHO) - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\IEPro.dll (IE7Pro.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (CHelper Class) - {99A7C4DD-B2E6-4CA0-BB6E-737A61364155} - C:\Program Files\Eurotran 2003\e2003i.dll ()
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\IEPro\IEProRecorder.dll ()
O3 - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\IEPro\IEProRecorder.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Nástroj WD Quick View] C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe (Western Digital Technologies, Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3551886561-2034735683-3825333376-1010..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Od&eslat do aplikace OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra Button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - C:\Program Files\Eurotran 2003\e2003i.dll ()
O9 - Extra 'Tools' menuitem : Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - C:\Program Files\Eurotran 2003\e2003i.dll ()
O9 - Extra Button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AAB8EADF-2FEB-44F4-BB3B-F04B63C36168}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{7bc1ac43-f183-11df-9313-00241dda2ed1}\Shell - "" = AutoRun
O33 - MountPoints2\{7bc1ac43-f183-11df-9313-00241dda2ed1}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{ccfbd811-1b08-11e0-bc88-00241dda2ed1}\Shell - "" = AutoRun
O33 - MountPoints2\{ccfbd811-1b08-11e0-bc88-00241dda2ed1}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.20 17:24:40 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.07.20 15:20:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{08196FF9-2F44-42E6-B7F8-B71026E5B1E4}
[2012.07.20 15:19:47 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{A08F7B12-8254-4D89-B74B-FDFDDEBF2145}
[2012.07.19 17:33:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.07.19 17:32:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.19 17:21:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
[2012.07.19 17:21:21 | 000,000,000 | ---D | C] -- C:\Program Files\CrystalDiskInfo
[2012.07.19 15:48:24 | 000,000,000 | ---D | C] -- C:\_OTM
[2012.07.19 15:46:16 | 000,522,240 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTM.exe
[2012.07.19 15:35:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{D3E62EC7-6883-4BCF-A535-D91D422CDEC4}
[2012.07.19 15:35:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{AC99A2B9-E852-4F64-A8DE-78AB46949643}
[2012.07.18 18:30:04 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{25AA15A7-8300-4790-B841-21D4831FD9AB}
[2012.07.18 18:29:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{18642D4D-6F8F-4E1E-8854-943CB031EB8C}
[2012.07.18 18:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2012.07.18 18:14:31 | 000,000,000 | ---D | C] -- C:\rsit
[2012.07.17 13:43:50 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{F9240DEB-6828-4759-A913-BE0031F0C044}
[2012.07.17 13:43:36 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{B70EC86F-7B45-40CE-91F3-3D55449F49FE}
[2012.07.16 14:10:40 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{9FF6DDC7-7F57-4600-AD5D-ECC84B5FCACE}
[2012.07.16 14:10:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{8D62C9D1-6885-4FED-B2DD-9ED5553769D1}
[2012.07.14 20:30:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{4C477E6D-05C2-4E59-8459-37F04041F7E6}
[2012.07.14 20:29:57 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{4A8EBC02-42C3-4192-B510-B64EF7756D22}
[2012.07.14 14:21:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Western Digital
[2012.07.14 11:54:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{1A0A2D91-3BDD-479B-B835-971824488FF1}
[2012.07.13 22:31:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{7518B4A5-D29A-445A-BB49-1A272F4EF267}
[2012.07.13 22:31:39 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{0E1C88FB-98CF-4691-BE07-58389BE11C87}
[2012.07.12 16:17:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{E60303B3-6141-4243-8CFB-DDC324585927}
[2012.07.12 16:17:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{63812556-F6E8-4A4D-95A2-D6E4EFB22AF0}
[2012.07.11 15:30:34 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.11 15:29:01 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012.07.11 15:28:59 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.11 15:28:57 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012.07.05 08:56:57 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{9F53C2D2-A1F5-4782-B871-785CCA1DCA26}
[2012.07.05 08:56:46 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{20B28DDA-D385-4BBF-801F-DE26FF5D44AE}
[2012.07.04 16:16:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{D7740FE3-F132-4C5E-99D9-6D11D0067BC9}
[2012.07.04 16:16:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{AD92C6FD-C2C1-4E26-BAAC-1655AD79CE61}
[2012.07.03 12:07:27 | 000,000,000 | ---D | C] -- C:\Western Digital
[2012.07.03 08:54:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{EF6147E9-0A51-417B-B4B7-EE6E86865CDA}
[2012.07.03 08:53:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{2C3B8A66-2EE1-44F0-B181-0622948D6ED6}
[2012.07.02 15:08:28 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{74DBE49B-307D-4862-A9B9-6C5A845A220E}
[2012.07.02 15:08:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{A3732F77-2DD0-48D9-8C15-F7C829AF00A1}
[2012.06.30 09:26:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{E010D008-DB96-46D6-99F3-94672529A455}
[2012.06.30 09:26:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{666F051B-0618-462A-8C48-6445E37C9559}
[2012.06.29 15:02:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{0F9D99E3-4FE2-4E1D-BC4F-76C780D5B400}
[2012.06.29 15:02:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{88E1EA00-B222-407B-A483-D64C649E70BF}
[2012.06.28 15:15:03 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{E2C0D596-D007-485B-9B56-34E61B3EAC00}
[2012.06.28 15:14:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{9090DAE2-019F-40D9-B7AA-9E058CD3C771}
[2012.06.27 15:53:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{5F9F5F25-B37E-419C-B9E9-4F991142B124}
[2012.06.27 15:53:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{BF6E5748-74FC-4945-A52A-02610559273D}
[2012.06.26 14:55:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{04F74326-4E32-4A81-B806-B43213CC97F0}
[2012.06.26 14:54:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{A4BCFBFC-8D19-46EB-86EA-034D23B4E92C}
[2012.06.25 14:40:33 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{1BE5AC8E-2710-4C09-B6B5-093C1B18E361}
[2012.06.25 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{FB21594F-9373-4466-AFF4-64CD97DB278A}
[2012.06.25 13:11:11 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{9AF73018-9254-47C4-BC3D-7FE0E17D7E83}
[2012.06.25 13:11:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{7AE0BC47-027B-40B7-BF57-9BB7C2D94BC3}
[2012.06.23 07:52:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{AD913B99-B1B6-4134-9EB5-14A79AA24D89}
[2012.06.23 07:51:50 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{ACFA3AE3-A3CE-4B6F-8D3E-E2EA0AD0843B}
[2012.06.22 14:40:26 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{6596DA1E-92A1-4A73-80B1-1F0455114D5B}
[2012.06.22 14:40:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{9C5D72DF-236E-4037-8888-086DD755CE8E}
[2012.06.22 14:40:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{08188413-DE20-4785-B1AA-C2C7C24057BF}
[2012.06.21 13:20:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{BFB6D850-C952-4EF1-ACD9-5495BC809529}
[2012.06.21 13:20:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{D4F5FE16-A691-4C46-93D4-E653CC09ACF1}
[2009.11.25 11:37:26 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Admin\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012.07.20 19:22:24 | 000,015,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 19:22:24 | 000,015,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 19:14:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.20 19:14:39 | 2616,057,856 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.20 18:44:43 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.07.20 17:24:43 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.07.20 15:07:57 | 101,781,069 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.07.19 23:52:07 | 000,003,536 | ---- | M] () -- C:\bootsqm.dat
[2012.07.19 17:21:22 | 000,001,930 | ---- | M] () -- C:\Users\Admin\Desktop\CrystalDiskInfo.lnk
[2012.07.19 16:30:17 | 000,007,608 | ---- | M] () -- C:\Users\Admin\AppData\Local\resmon.resmoncfg
[2012.07.19 15:49:22 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2012.07.18 19:10:01 | 000,001,256 | ---- | M] () -- C:\Users\Admin\Desktop\V L C.lnk
[2012.07.18 17:56:15 | 000,634,308 | ---- | M] () -- C:\Windows\System32\perfh005.dat
[2012.07.18 17:56:15 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.18 17:56:15 | 000,122,898 | ---- | M] () -- C:\Windows\System32\perfc005.dat
[2012.07.18 17:56:15 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.16 17:46:32 | 000,025,574 | ---- | M] () -- C:\Windows\IM18.CFG
[2012.07.16 17:46:32 | 000,003,208 | ---- | M] () -- C:\Windows\im32st.dat
[2012.07.13 22:39:42 | 010,171,904 | ---- | M] () -- C:\Users\Admin\Documents\Show-Radio-Luxembourg.pps
[2012.07.13 22:38:24 | 009,946,624 | ---- | M] () -- C:\Users\Admin\Documents\Specialni autobusy.pps
[2012.07.13 08:48:43 | 000,002,401 | ---- | M] () -- C:\Users\Admin\Desktop\Google Chrome.lnk
[2012.07.12 17:56:19 | 000,293,020 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012.07.12 09:01:20 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.07.12 09:01:20 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.07.11 15:34:53 | 000,410,712 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.05 17:49:32 | 000,002,055 | ---- | M] () -- C:\Users\Public\Desktop\Nero Kwik Media.lnk
[2012.06.29 16:22:17 | 000,001,575 | ---- | M] () -- C:\Users\Admin\Desktop\Messenger.lnk
[2012.06.25 14:19:28 | 000,000,354 | ---- | M] () -- C:\Users\Admin\Documents\cc_20120625_141909.reg
[2012.06.25 14:11:42 | 000,024,532 | ---- | M] () -- C:\Users\Admin\Documents\cc_20120625_141110.reg
[2012.06.22 23:55:17 | 000,522,240 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTM.exe
[2012.06.22 16:32:54 | 000,001,057 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml

========== Files Created - No Company Name ==========

[2012.07.20 17:30:40 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.07.19 23:52:07 | 000,003,536 | ---- | C] () -- C:\bootsqm.dat
[2012.07.19 17:21:22 | 000,001,930 | ---- | C] () -- C:\Users\Admin\Desktop\CrystalDiskInfo.lnk
[2012.07.13 22:39:42 | 010,171,904 | ---- | C] () -- C:\Users\Admin\Documents\Show-Radio-Luxembourg.pps
[2012.07.13 22:38:24 | 009,946,624 | ---- | C] () -- C:\Users\Admin\Documents\Specialni autobusy.pps
[2012.06.29 16:22:03 | 000,001,575 | ---- | C] () -- C:\Users\Admin\Desktop\Messenger.lnk
[2012.06.25 14:37:14 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012.06.25 14:19:24 | 000,000,354 | ---- | C] () -- C:\Users\Admin\Documents\cc_20120625_141909.reg
[2012.06.25 14:11:15 | 000,024,532 | ---- | C] () -- C:\Users\Admin\Documents\cc_20120625_141110.reg
[2011.11.10 15:41:56 | 000,000,219 | ---- | C] () -- C:\Users\Admin\.swfinfo
[2011.01.27 23:19:09 | 000,001,057 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml
[2010.11.23 15:44:41 | 000,005,120 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.22 15:20:04 | 000,007,608 | ---- | C] () -- C:\Users\Admin\AppData\Local\resmon.resmoncfg
[2010.11.17 17:29:18 | 000,000,384 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.11.17 13:06:42 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.11.16 23:37:52 | 000,000,022 | -HS- | C] () -- C:\Users\Admin\AppData\Roaming\Sys6925.Config Collection.sys
[2010.11.16 23:37:52 | 000,000,022 | -HS- | C] () -- C:\Windows\Sys3390 SettingsCollection.bin
[2010.11.16 21:56:51 | 000,003,208 | ---- | C] () -- C:\Windows\im32st.dat
[2009.11.25 11:37:26 | 000,087,608 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\inst.exe
[2009.11.25 11:37:26 | 000,007,887 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\pcouffin.cat
[2009.11.25 11:37:26 | 000,001,144 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\pcouffin.inf

========== LOP Check ==========

[2012.07.14 13:18:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity
[2010.12.06 17:53:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG
[2011.10.03 14:28:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG2012
[2010.11.17 01:25:42 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GrabPro
[2011.12.12 14:21:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\IDOS
[2012.06.18 16:42:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\MiniDm
[2011.08.30 18:14:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RMCBackup
[2011.01.31 22:39:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TeamViewer
[2011.11.10 19:37:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Thinstall
[2011.02.08 19:21:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Transcend
[2010.11.16 23:31:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\VitySoft
[2012.06.25 14:10:00 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Vso
[2010.11.16 22:50:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Windows Live Writer
[2011.10.19 17:49:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Zoner
[2012.06.29 07:58:37 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

#26 Příspěvek od **Márty84** » 21 črc 2012 09:46

Znovu spustte OTL jako spravce
Do spodniho okna vlozte nasledujici text (vcetne te dvojtecky pred slovem commands)

Kód: Vybrat vše

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[Purity]

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:otl
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3551886561-2034735683-3825333376-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
[2012.07.18 17:56:15 | 000,634,308 | ---- | M] () -- C:\Windows\System32\perfh005.dat
[2012.07.18 17:56:15 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.18 17:56:15 | 000,122,898 | ---- | M] () -- C:\Windows\System32\perfc005.dat
[2012.07.18 17:56:15 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4

Kliknete na Opravit a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu se objevi novy log, ten sem dejte.

Kdyby to neslo, tak opet v nouzovem rezimu

mraz233 · #27 Příspěvek od **mraz233** » 22 črc 2012 00:40

Normální režuim:
BA ne, identická hláška a konec

mraz233 · #28 Příspěvek od **mraz233** » 22 črc 2012 01:24

Jakkoli se snažím, tenhle program mi do konce nedojede ....

#29 Příspěvek od **Márty84** » 22 črc 2012 09:28

Pokud nemate, zalohujte si dulezita data

Nepouzivejte ComboFix bez predchozi domluvy! Je to poruseni pravidel fora a ztratite tim narok na pomoc!

Stahnete ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe a ulozte ho na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Kliknete na ComboFix pravym mysidlem a levym na Spustit jako spravce
Odsouhlaste licencni podminky a nechte program pracovat. Jestli vam nabidne instalaci Konzoly pro zotaveni, souhlaste.
Po dobu skenu nic nespoustejte, nikam neklikejte.
Po dokonceni skenovani (muze dojit i k restartu pc) by se mel vytvorit log, ktery bude umisteny zde C:\ComboFix.txt
Jeho obsah sem zkopirujte

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace

mraz233 · #30 Příspěvek od **mraz233** » 23 črc 2012 08:35

Dobrý den.
PC s novým HDD budu mít k disposici zítra, ihned budu opravovat dál. Děkuji a pomoc.
Lze Konzoli pro zotavení eventuelně opět odinstalovat ?

VIRY.CZ

zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu

Re: zvýšený přístup na HDD (několik dní), prosím o kontrolu