Win32/Packed.Autoit.Gen

Zpráva

papushka · #1 Příspěvek od **papushka** » 16 dub 2010 20:27

NOD mi našel výše zmíněný virus a nejde s ním nic udělat. Prosím tedy o kontrolu logu. Děkuji.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Janinka at 2010-04-16 21:22:27
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 19 GB (59%) free of 32 GB
Total RAM: 510 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:22:47, on 16.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\khooker.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Janinka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tn.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tn.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.nova.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Poskytovatel aplikace Windows Internet Explorer: TV Nova
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 9120 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-01-26 1230288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-27 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-27 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-01-26 1230288]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2009-06-01 962808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-07-20 2834432]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SiSRaid"=C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe [2005-03-01 897024]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]
"SiS Tray"=C:\WINDOWS\system32\sistray.EXE [2002-06-28 397312]
"SiS KHooker"=C:\WINDOWS\system32\khooker.exe [2002-06-28 282624]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-27 149280]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-02-26 2140880]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"csrcs"=C:\WINDOWS\system32\csrcs.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fec432b-4563-11df-aa6d-00155853733b}]
shell\AutoRun\command - E:\rbxija.exe
shell\oPEN\command - E:\RbxIja.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5466e0e2-38fe-11df-aa58-00155853733b}]
shell\AutoRun\command - F:\rbxija.exe
shell\oPEN\command - F:\RbxIja.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8293ba84-39c2-11df-aa59-00155853733b}]
shell\AutoRun\command - E:\rbxija.exe
shell\oPEN\command - E:\RbxIja.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ad613ca-a931-11de-a996-00155853733b}]
shell\AutoRun\command - E:\Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d860d6d4-7511-11de-a97c-0023cdbde9c8}]
shell\AutoRun\command - setup.exe

======List of files/folders created in the last 1 months======

2010-04-16 20:33:38 ----D---- C:\Program Files\trend micro
2010-04-16 20:33:18 ----D---- C:\rsit
2010-04-16 19:39:15 ----D---- C:\Documents and Settings\Janinka\Data aplikací\ESET
2010-04-16 19:36:49 ----D---- C:\Program Files\ESET
2010-04-16 19:36:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-04-16 15:55:52 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2010-04-16 15:51:07 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2010-04-16 15:47:54 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-04-16 15:44:39 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-16 15:41:16 ----D---- C:\WINDOWS\system32\appmgmt
2010-04-16 15:30:13 ----D---- C:\Program Files\WinClamAVShield
2010-04-15 00:07:02 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-15 00:06:54 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-15 00:06:44 ----HDC---- C:\WINDOWS\$NtUninstallKB979402_WM9$
2010-04-15 00:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-15 00:04:21 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-15 00:04:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-15 00:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-11 14:10:59 ----D---- C:\Documents and Settings\Janinka\Data aplikací\Apple Computer
2010-04-11 14:08:45 ----D---- C:\Program Files\QuickTime
2010-04-11 14:08:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-04-11 14:07:49 ----D---- C:\Program Files\Common Files\Apple
2010-04-11 14:07:18 ----D---- C:\Program Files\Apple Software Update
2010-04-11 14:07:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2010-03-28 20:38:33 ----HD---- C:\WINDOWS\msdownld.tmp

======List of files/folders modified in the last 1 months======

2010-04-16 21:22:46 ----D---- C:\WINDOWS\Temp
2010-04-16 21:22:07 ----D---- C:\WINDOWS\Prefetch
2010-04-16 21:19:58 ----D---- C:\WINDOWS\system32\config
2010-04-16 21:18:48 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-16 20:33:38 ----RD---- C:\Program Files
2010-04-16 19:48:13 ----D---- C:\WINDOWS
2010-04-16 19:47:36 ----D---- C:\WINDOWS\system32
2010-04-16 19:38:50 ----SHD---- C:\WINDOWS\Installer
2010-04-16 19:38:19 ----HD---- C:\WINDOWS\inf
2010-04-16 19:38:19 ----D---- C:\WINDOWS\system32\drivers
2010-04-16 19:37:46 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-16 15:53:41 ----SD---- C:\WINDOWS\Tasks
2010-04-16 15:47:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2010-04-16 15:41:15 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-04-15 00:07:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-04-15 00:07:05 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-15 00:06:59 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-15 00:06:57 ----A---- C:\WINDOWS\imsins.BAK
2010-04-11 14:07:56 ----D---- C:\WINDOWS\WinSxS
2010-04-11 14:07:49 ----D---- C:\Program Files\Common Files
2010-04-09 21:18:36 ----SD---- C:\Documents and Settings\Janinka\Data aplikací\Microsoft
2010-04-07 21:06:10 ----D---- C:\Program Files\Mozilla Firefox
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-02 14:53:54 ----A---- C:\WINDOWS\Kyor.ini
2010-03-31 22:59:13 ----D---- C:\Program Files\Internet Explorer
2010-03-28 20:38:16 ----D---- C:\WINDOWS\ie8updates
2010-03-28 20:38:02 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-28 20:36:14 ----D---- C:\WINDOWS\system32\cs-CZ
2010-03-28 10:33:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-19 21:46:00 ----D---- C:\WINDOWS\Minidump
2010-03-19 18:05:50 ----N---- C:\WINDOWS\system32\wmp.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-02-26 114984]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-02-26 55232]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2002-07-01 8192]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-02-26 139192]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-02-26 134488]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-02-26 32584]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-03-01 392704]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2002-07-01 203776]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 32768]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-28 220992]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2007-11-14 100992]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FXDRV;FXDRV; \??\D:\Fxdrv.sys []
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-14 88960]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-02 17536]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-05-02 20864]
S3 PID_08A0;Labtec WebCam Pro(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2004-01-21 271360]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-03 32768]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK); C:\WINDOWS\System32\DRIVERS\zd1211Bu.sys [2007-06-25 500736]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-02-26 810120]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2009-06-01 222968]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-27 153376]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-07-20 984576]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-02-25 1047880]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-02-26 33560]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-04-16 435016]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 16 dub 2010 20:37

Zdravím

Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.

Obrázek

Doporučuji odinstalovat Ad-Aware.

Obrázek

Vložte do PC všechny flash disky, které používáte.

Obrázek

Stáhněte na plochu UsbFix http://pagesperso-orange.fr/NosTools/Ch ... UsbFix.exe

Spusťte, poté zvolte jazyk E - Enter
Zvolte 2 - Enter (je možný restart PC)
Po dokončení na Vás vyskočí log, vložte mi ho sem, případně ho najdete v C:\UsbFix.txt

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe

Spusťte program, poté klikněte na Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

papushka · #3 Příspěvek od **papushka** » 16 dub 2010 21:04

Díky.

Log UsbFix je tady:

############################## | UsbFix V6.104 |

User : Janinka (Administrators) # DRAHOUSEK
Update on 14/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 21:54:39 | 16.4.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Sempron(tm) Processor 2800+
Systém Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : ESET Smart Security 4.2 4.2 [ Enabled | Updated ]
FW : ESET personal firewall[ Enabled ]4.2.35.3

C:\ -> Místní pevný disk # 31,48 Go (18,48 Go free) # NTFS
D:\ -> Disk CD-ROM # 3,81 Go (0 Mo free) [DATA 8.5.2008] # CDFS
E:\ -> Vyměnitelný disk # 491,55 Mo (298,74 Mo free) # FAT

################## | Files # Infected Folders |

Deleted ! C:\WINDOWS\System32\autorun.inf
Deleted ! C:\DOCUME~1\Janinka\LOCALS~1\Temp\718631~1.exe
Deleted ! C:\khw
Deleted ! C:\Recycler\S-1-5-21-436374069-789336058-725345543-1003
Deleted ! E:\winamp_cache_0001.xml

################## | Registry |

Deleted ! [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]

################## | Mountpoints2 |

Deleted ! HKCU\...\Explorer\MountPoints2\{0fec432b-4563-11df-aa6d-00155853733b}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{5466e0e2-38fe-11df-aa58-00155853733b}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{8293ba84-39c2-11df-aa59-00155853733b}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{9ad613ca-a931-11de-a996-00155853733b}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{d860d6d4-7511-11de-a97c-0023cdbde9c8}\Shell\AutoRun\Command

################## | Listing of the present files |

[20.07.2009 11:02|--a------|0] C:\AUTOEXEC.BAT
[20.07.2009 11:30|-rahs----|211] C:\boot.ini
[05.12.2002 14:00|-rahs----|4952] C:\Bootfont.bin
[20.07.2009 11:02|--a------|0] C:\CONFIG.SYS
[21.09.2009 22:17|--a------|0] C:\Debug.QC6
[21.09.2009 22:17|--a------|12091] C:\Installer.log
[20.07.2009 11:02|-rahs----|0] C:\IO.SYS
[21.09.2009 22:17|--a------|90] C:\LogiSetup.log
[20.07.2009 11:02|-rahs----|0] C:\MSDOS.SYS
[21.09.2009 22:18|--a------|43762] C:\MSIInstall.log
[20.07.2009 11:25|-rahs----|47564] C:\NTDETECT.COM
[10.02.2010 11:24|-rahs----|250576] C:\ntldr
[?|?|?] C:\pagefile.sys
[11.07.2002 12:18|-ra------|83713] C:\setup.ini
[16.04.2010 21:57|--a------|2469] C:\UsbFix.txt
[12.09.2007 15:20|-r-------|67072] D:\1-Predbezny informacni dotaznik-formular.doc
[26.11.2007 22:48|-r-------|83] D:\25!!!.txt
[25.11.2007 22:10|-r-------|32256] D:\2LP - chemie.doc
[21.03.2007 20:02|-r-------|31744] D:\AJ-diskaçn.doc
[13.09.2007 22:19|-r-------|313] D:\ASCENDENT.txt
[17.02.2007 22:02|-r-------|3773952] D:\Adobe Encore DVD 1.doc
[27.08.2007 19:26|-r-------|1642] D:\Avril Lavigne - Innocence.txt
[28.08.2007 23:58|-r-------|1488] D:\Avril Lavigne - When you're gone.txt
[15.02.2007 17:16|-r-------|28160] D:\BABICKA.doc
[08.01.2008 00:56|-r-------|2866] D:\BERAN.txt
[29.11.2007 20:44|-r-------|15304704] D:\BI - tahacek-kostra.doc
[29.11.2007 20:59|-r-------|15172761] D:\BI - tahacek-kostra.rar
[08.01.2008 00:56|-r-------|2627] D:\BLÖ¦ENCI.txt
[12.03.2007 23:10|-r-------|1013] D:\Ben Jelen - Come on.txt
[23.02.2007 16:04|-r-------|3763643] D:\Bez n zvu 1.psd
[26.01.2008 20:08|-r-------|237258] D:\Bez n zvu 2.psd
[15.10.2007 21:36|-r-------|27526] D:\Bez n zvu.sta
[28.10.2007 19:06|-r-------|2054] D:\Billy Talent - Surrender.txt
[08.01.2008 00:56|-r-------|3251] D:\BíK.txt
[06.05.2008 22:44|-r-------|1557504] D:\C Dychaci soustava cloveka.ppt
[06.05.2008 23:13|-r-------|2093568] D:\C vylucovaci soustava pro zakladni skoly.ppt
[17.11.2007 00:23|-r-------|13943] D:\CATHOLI0.eot
[17.11.2007 00:23|-r-------|13943] D:\CATHOLI1.eot
[17.11.2007 17:21|-r-------|36] D:\CD KEY - RCT3.txt
[10.02.2008 17:46|-r-------|39424] D:\CHARTA 77.doc
[17.11.2007 17:52|-r-------|1447] D:\CHEATY - Roller coaster tycoon 3.txt
[12.01.2007 03:04|-r-------|1132] D:\CHEATY_sims2.txt
[02.11.2007 22:10|-r-------|4924] D:\Cradle_of_Rome.zip
[29.09.2007 22:02|-r-------|20992] D:\DOPIS MARKOVI =D.doc
[14.02.2008 00:41|-r-------|20992] D:\Dear Sir or Madam.doc
[14.02.2008 00:41|-r-------|20992] D:\Dear Sir or Madam1.doc
[25.10.2007 23:56|-r-------|31232] D:\Demokracie v üecku.doc
[25.10.2007 23:56|-r-------|32256] D:\Demokracie v üˇmŘ.doc
[25.10.2007 23:57|-r-------|25600] D:\Demokracie ve stýedovŘku a novovŘku.doc
[13.04.2008 15:51|-r-------|48128] D:\DŘjiny ekonomickěch teoriˇ.doc
[15.01.2008 23:19|-r-------|724167] D:\ERB.psd
[31.10.2007 21:36|-r-------|65536] D:\EU.doc
[30.04.2008 20:32|-r-------|1245184] D:\Endokrinnˇ syst‚m - Petra üˇhov .ppt
[14.10.2007 15:16|-r-------|32256] D:\Etickě kodex novin ýe.doc
[05.12.2007 21:57|-r-------|102400] D:\FY - elektrina, rozvod.doc
[05.02.2007 16:56|-r-------|55296] D:\FY-3.doc
[25.09.2007 13:06|-r-------|69120] D:\FY3 - 1.doc
[29.11.2007 20:10|-r-------|71680] D:\FY3-3.doc
[24.03.2008 20:52|-r-------|32256] D:\FY3-7 graf.xls
[18.04.2008 17:54|-r-------|79872] D:\FY3-7.doc
[12.03.2008 21:18|-r-------|175616] D:\Galv. źl. + Aku.doc
[21.03.2007 11:59|-r-------|3721569] D:\Gift_for_my_best_friend.rar
[10.02.2008 02:46|-r-------|2935] D:\Gym Class Heroes - Cupid's Chokehold.txt
[07.10.2007 19:33|-r-------|2208] D:\HSM - We're all in this together.txt
[07.10.2007 19:34|-r-------|1212] D:\HSM - Bop to the Top.txt
[05.09.2007 21:31|-r-------|1945] D:\HSM - Breaking Free.txt
[07.10.2007 19:35|-r-------|1278] D:\HSM - Get'cha head in the game.txt
[07.10.2007 19:40|-r-------|1363] D:\HSM - I Can't Take My Eyes Off Of You.txt
[06.10.2007 19:53|-r-------|3551] D:\HSM - Stick to the status quo.txt
[07.10.2007 19:39|-r-------|756] D:\HSM - What I've been looking for (Ryana and Sharpy version).txt
[07.10.2007 19:42|-r-------|645] D:\HSM - What I've been looking for.txt
[20.09.2007 22:12|-r-------|1118] D:\HSM - When there was me and you.txt
[21.09.2007 11:47|-r-------|2973] D:\HSM1-2.m3u
[21.09.2007 21:02|-r-------|2957] D:\HSM2 - All for one.txt
[21.09.2007 21:00|-r-------|2266] D:\HSM2 - Bet on it.txt
[21.09.2007 20:59|-r-------|2332] D:\HSM2 - Everyday.txt
[21.09.2007 20:56|-r-------|1909] D:\HSM2 - Fabulous.txt
[21.09.2007 21:14|-r-------|1840] D:\HSM2 - Gotta go my own way.txt
[06.10.2007 20:00|-r-------|3109] D:\HSM2 - I don't dance.txt
[21.09.2007 20:52|-r-------|2638] D:\HSM2 - What time is it.txt
[21.09.2007 20:57|-r-------|2285] D:\HSM2 - Work this out.txt
[21.09.2007 20:59|-r-------|1889] D:\HSM2 - You are the music in me.txt
[07.09.2007 16:56|-r-------|39424] D:\Horany 2007.doc
[29.04.2008 18:17|-r-------|11559] D:\Hypothalamus.jpg
[04.03.2007 23:48|-r-------|37376] D:\ITALY.doc
[21.02.2008 15:14|-r-------|1327] D:\Jeanette - Right ow.txt
[25.02.2007 16:59|-r-------|14848] D:\KATAR-tab.xls
[28.02.2007 19:40|-r-------|983040] D:\KATAR.pps
[27.02.2007 23:48|-r-------|99840] D:\KATAR.ppt
[04.09.2007 13:25|-r-------|6434962] D:\KOLAZ - KALLY.psd
[17.09.2007 23:03|-r-------|5836381] D:\KOLAZ-JANCA.psd
[04.12.2007 12:50|-r-------|5950749] D:\KOLAZ-Veru.psd
[08.12.2007 17:47|-r-------|6622772] D:\KOLAZ.psd
[08.12.2007 17:38|-r-------|4082974] D:\KOMPLET1.psd
[08.01.2008 00:58|-r-------|3191] D:\KOZOROH.txt
[26.09.2007 21:01|-r-------|22528] D:\KRYCHLE.doc
[07.02.2008 20:28|-r-------|15655936] D:\KUZE, TS, METAB.doc
[08.01.2008 00:57|-r-------|2659] D:\LEV.txt
[15.11.2007 22:07|-r-------|823] D:\LINKIN PARK - Shadow of the day.txt
[22.01.2008 23:33|-r-------|184] D:\LST - Beran.txt
[10.10.2007 20:29|-r-------|21504] D:\Lebenslauf.doc
[11.09.2007 18:22|-r-------|269312] D:\Legislativnˇ proces.doc
[31.12.2006 03:42|-r-------|1328] D:\Lindsay Lohan - Ultimate.txt
[16.01.2007 21:02|-r-------|30208] D:\MAJ.doc
[20.01.2008 17:27|-r-------|36352] D:\MATURITA - ZSV.doc
[22.01.2008 20:55|-r-------|1758] D:\MCR - Disenchanted.txt
[31.08.2007 19:20|-r-------|922] D:\MChR - Teenagers.txt
[16.09.2007 17:39|-r-------|109] D:\MHT - cit t.txt
[15.12.2007 18:50|-r-------|24456153] D:\ML.psd
[28.02.2007 20:49|-r-------|27136] D:\MONOLOG-AJ.doc
[16.09.2007 20:30|-r-------|1123328] D:\MT.pps
[16.09.2007 20:30|-r-------|1123328] D:\MT.ppt
[31.10.2007 00:05|-r-------|1768] D:\MURPHYHO ZµKONY.txt
[16.03.2008 21:39|-r-------|227328] D:\MYDLO.doc
[26.01.2007 23:59|-r-------|1547] D:\Marilyn.txt
[19.10.2007 23:01|-r-------|1808] D:\Maroon 5 - Wake up call.txt
[19.10.2007 15:49|-r-------|1724] D:\Maryźka Magdonova.txt
[29.10.2007 00:02|-r-------|1183] D:\NB - Soulmate.txt
[12.03.2008 21:29|-r-------|82944] D:\NJ - maturita.doc
[20.03.2007 20:47|-r-------|25088] D:\NJ.doc
[07.09.2007 23:11|-r-------|1655] D:\Natalie Imbruglia - Torn.txt
[08.03.2007 23:37|-r-------|1850] D:\Nelly Furtado - All good things.txt
[06.03.2002 13:13|-r-------|27136] D:\N vod Polda4.doc
[08.01.2008 00:57|-r-------|3127] D:\PANNA.txt
[04.05.2008 19:29|-r-------|640] D:\PEETER STATUSY.txt
[05.11.2007 23:35|-r-------|23040] D:\POJMY2.doc
[19.11.2007 03:49|-r-------|56832] D:\POKUS=).doc
[13.04.2008 16:22|-r-------|55808] D:\PRAVO - Papush.doc
[13.04.2008 15:51|-r-------|56320] D:\PRAVO - otazky.doc
[14.02.2008 20:20|-r-------|25088] D:\PROM·NA.doc
[31.08.2007 19:22|-r-------|2137] D:\Paramore - Misery business.txt
[27.01.2008 20:39|-r-------|1943] D:\Patrick Nuo - 5 days.txt
[28.10.2007 18:07|-r-------|28160] D:\Politicky system Ceske republiky.doc
[28.10.2007 18:08|-r-------|32768] D:\Politicky system Velke Britanie.doc
[28.10.2007 18:18|-r-------|24064] D:\Politickě syst‚m Izraele.doc
[13.04.2008 15:51|-r-------|50688] D:\Pracovnˇ pr vo.doc
[10.02.2008 22:23|-r-------|20992] D:\Preklady NJ.doc
[15.11.2007 18:32|-r-------|7591424] D:\Prevratilova - Savci.ppt
[05.04.2008 00:28|-r-------|48] D:\QUICK TIME serial.txt
[08.01.2008 00:57|-r-------|3064] D:\RAK.txt
[18.11.2007 01:06|-r-------|3625241] D:\RCT3_u31.rar
[28.02.2008 00:24|-r-------|2476032] D:\RECKO.ppt
[08.01.2008 00:59|-r-------|3461] D:\RYBY.txt
[16.11.2007 12:40|-r-------|22016] D:\Rihova.doc
[16.11.2007 12:42|-r-------|26624] D:\Rihova2.doc
[15.11.2007 23:53|-r-------|100431872] D:\Rollercoaster_Tycoon_3.part1.rar
[16.11.2007 17:49|-r-------|100431872] D:\Rollercoaster_Tycoon_3.part2.rar
[17.11.2007 00:19|-r-------|100431872] D:\Rollercoaster_Tycoon_3.part3.rar
[17.11.2007 04:01|-r-------|100431872] D:\Rollercoaster_Tycoon_3.part4.rar
[17.11.2007 16:48|-r-------|100431872] D:\Rollercoaster_Tycoon_3.part5.rar
[17.11.2007 20:29|-r-------|71562936] D:\Rollercoaster_Tycoon_3.part6.rar
[03.01.2008 17:46|-r-------|2748061] D:\SCAN0017.JPG
[03.01.2008 17:47|-r-------|2666053] D:\SCAN0018.JPG
[01.05.2008 17:09|-r-------|1218799] D:\SCAN0045.JPG
[01.05.2008 17:10|-r-------|1434015] D:\SCAN0046.JPG
[01.05.2008 17:11|-r-------|1349895] D:\SCAN0047.JPG
[01.05.2008 17:12|-r-------|1379541] D:\SCAN0048.JPG
[01.05.2008 17:12|-r-------|1647334] D:\SCAN0049.JPG
[01.05.2008 17:17|-r-------|1398955] D:\SCAN0050.JPG
[26.09.2007 20:32|-r-------|227328] D:\SEINA.doc
[26.09.2007 20:02|-r-------|43704] D:\SEINA.jpg
[26.09.2007 20:02|-r-------|59622] D:\SEINA1.jpg
[26.09.2007 20:07|-r-------|94576] D:\SEINA2.jpg
[07.01.2007 03:29|-r-------|4466361] D:\SILVESTR.psd
[01.05.2008 18:31|-r-------|1778176] D:\SMYSLOVA.doc
[15.10.2007 15:19|-r-------|31744] D:\SP.doc
[01.05.2008 18:25|-r-------|101089] D:\SS1.jpg
[01.05.2008 18:26|-r-------|332231] D:\SS2.jpg
[01.05.2008 18:26|-r-------|307065] D:\SS3.jpg
[01.05.2008 18:27|-r-------|335063] D:\SS4.jpg
[01.05.2008 18:25|-r-------|267439] D:\SS5.jpg
[01.05.2008 18:28|-r-------|401418] D:\SS6.jpg
[19.11.2007 17:45|-r-------|26624] D:\STRIBRNY VITR.doc
[08.01.2008 00:58|-r-------|2562] D:\STüELEC.txt
[03.01.2008 18:36|-r-------|10509312] D:\SVALY.doc
[06.05.2008 19:16|-r-------|28160] D:\SVEJK.doc
[02.12.2007 23:51|-r-------|39424] D:\SVS - terorismus.doc
[28.10.2007 18:58|-r-------|59904] D:\SVS.doc
[02.01.2008 14:42|-r-------|251903] D:\SeeThem2.zip
[28.08.2007 21:36|-r-------|1552] D:\Simple Plan - Perfect.txt
[20.01.2008 21:05|-r-------|442] D:\Soundtrack Sisterhood of the traveling pant.txt
[30.09.2007 20:45|-r-------|960] D:\Sum 41 - So long good bye.txt
[06.05.2008 19:34|-r-------|39936] D:\TAHAK - VS.doc
[06.01.2007 18:50|-r-------|1229] D:\THE SIMS - cheaty.txt
[07.02.2008 20:32|-r-------|15490921] D:\TS.rar
[12.12.2007 20:52|-r-------|1070] D:\TS2 - OBRAZ.txt
[12.01.2007 14:23|-r-------|2965] D:\TS2 - SKLEP.txt
[10.10.2007 19:57|-r-------|26624] D:\Tabelarischer Lebenslauf.doc
[09.04.2008 20:09|-r-------|60289] D:\The Sims 2 Seasons RELOADED MULTI 15.torrent
[12.03.2007 22:57|-r-------|1971] D:\The Veronicas - 4ever.txt
[15.11.2007 22:06|-r-------|977] D:\Timbaland - APOLOGIZE.txt
[23.09.2007 19:32|-r-------|339613] D:\UFR1.jpg
[23.09.2007 19:33|-r-------|244882] D:\UFR2.jpg
[13.12.2007 20:31|-r-------|43062] D:\UserImages.bmp
[08.01.2008 00:58|-r-------|2458] D:\VODNµü.txt
[02.03.2008 21:53|-r-------|1886] D:\Vanessa Hudgens - Say ok.txt
[04.12.2007 12:50|-r-------|4860935] D:\Veru-komplet-1.psd
[08.01.2008 00:57|-r-------|2869] D:\VµHY.txt
[29.09.2007 23:32|-r-------|254976] D:\WORLD PRESS PHOTO 2007.doc
[29.09.2007 23:20|-r-------|230577] D:\WPP.jpg
[11.11.2007 15:29|-r-------|13510591] D:\Windows_Vista_Themes.rar
[21.10.2007 12:44|-r-------|113152] D:\Zverokruh.doc
[12.03.2008 21:13|-r-------|15137] D:\aku.jpg
[13.09.2007 16:23|-r-------|454918] D:\animated.rar
[25.10.2007 18:24|-r-------|1210] D:\aswclnr.log
[13.09.2007 16:21|-r-------|184679] D:\blackv1.rar
[31.08.2007 15:05|-r-------|204800] D:\charta.doc
[31.08.2007 15:05|-r-------|125952] D:\cro.ppt
[04.03.2008 20:17|-r-------|28160] D:\des.doc
[16.11.2007 13:06|-r-------|344576] D:\dradidlo_2007-plakat.doc
[13.09.2007 16:24|-r-------|1034707] D:\dwarf.rar
[15.10.2007 21:40|-r-------|21826] D:\emo=D.sta
[08.09.2007 23:36|-r-------|355438] D:\emo_plavky_sims.psd
[30.04.2008 15:56|-r-------|44825] D:\epifyza.jpg
[25.10.2007 23:56|-r-------|16840] D:\evropa.ppt
[07.02.2007 22:25|-r-------|148090] D:\favicon.psd
[20.10.2007 17:15|-r-------|2270720] D:\hp7.doc
[30.04.2008 15:47|-r-------|15184] D:\hypofyza.gif
[30.04.2008 15:21|-r-------|19093] D:\hypotalamus.gif
[21.11.2007 23:24|-r-------|570384] D:\kalbiczky-new.psd
[21.11.2007 23:19|-r-------|121062] D:\kalbiczky-new1.jpg
[08.02.2007 22:57|-r-------|2674522] D:\kalbiczky.psd
[06.02.2007 22:37|-r-------|3159508] D:\kalbiczky1.psd
[05.12.2007 23:13|-r-------|715061] D:\kolarka-kaj.jpg
[03.12.2007 23:43|-r-------|560] D:\krvinkově.txt
[26.09.2007 20:49|-r-------|1542] D:\krychle.gif
[25.09.2007 13:06|-r-------|69120] D:\kyvadlo.doc
[30.04.2008 19:43|-r-------|18434] D:\langer-ostruvky.jpg
[16.11.2007 20:24|-r-------|13610] D:\libimseti-blog-sablona-papushka-2007-11-16_19-24.txt
[16.11.2007 20:31|-r-------|13959] D:\libimseti-blog-sablona-papushka-2007-11-16_19-31.txt
[25.10.2007 18:06|-r-------|1711] D:\log1.txt
[23.09.2007 19:20|-r-------|20992] D:\myslenky.xls
[29.04.2008 19:04|-r-------|359518] D:\nadledviny.png
[17.02.2007 21:35|-r-------|139776] D:\navod na Encore.doc
[20.03.2007 20:59|-r-------|203264] D:\opticky_klam2.pps
[10.11.2007 15:56|-r-------|21504] D:\ostrov.doc
[03.01.2007 23:50|-r-------|6450534] D:\php_manual.chm
[19.09.2007 19:33|-r-------|24064] D:\predstavitele.doc
[30.04.2008 19:39|-r-------|7935] D:\pristitna.jpg
[27.11.2007 20:00|-r-------|37638] D:\reostat.bmp
[24.01.2007 22:37|-r-------|26624] D:\rozhovor_Jµ.doc
[30.04.2008 20:06|-r-------|442996] D:\samice =D.png
[13.09.2007 16:25|-r-------|744234] D:\simpsons.rar
[21.09.2007 17:06|-r-------|50] D:\sims 2 -pets.txt
[29.04.2008 18:28|-r-------|23402] D:\sisinka.jpg
[18.09.2007 17:49|-r-------|72] D:\status_18.9..txt
[30.04.2008 16:01|-r-------|7088] D:\stitna.jpg
[03.01.2008 17:48|-r-------|2341100] D:\svaly1.JPG
[03.01.2008 18:02|-r-------|370256] D:\svaly2.jpg
[03.01.2008 17:49|-r-------|2281451] D:\svaly3.JPG
[31.08.2007 15:03|-r-------|24064] D:\svs3_public.doc
[19.03.2007 22:28|-r-------|1972224] D:\tahacek_BI.doc
[17.01.2008 18:14|-r-------|335499] D:\test1.jpg
[17.01.2008 18:14|-r-------|256396] D:\test2.jpg
[17.01.2008 18:15|-r-------|242598] D:\test3.jpg
[17.01.2008 18:15|-r-------|279357] D:\test4.jpg
[17.01.2008 18:16|-r-------|345532] D:\test5.jpg
[17.01.2008 18:16|-r-------|263429] D:\test6.jpg
[17.01.2008 18:16|-r-------|217590] D:\test7.jpg
[17.01.2008 00:31|-r-------|10655] D:\trainer_3602_The_Sims_2_SpeedLoadPatch.zip
[28.11.2007 21:15|-r-------|120204] D:\tricko_rd_reddwarf2barvy.cdr
[11.09.2007 18:28|-r-------|53760] D:\ustava_public.doc
[05.09.2007 19:11|-r-------|36864] D:\uvod_do_politologie.doc
[05.12.2007 19:45|-r-------|48121] D:\vyr.el - vitr.gif
[05.12.2007 19:36|-r-------|10324] D:\vyr.el.gif
[15.12.2007 16:57|-r-------|10080] D:\řřXmaSřř.m3u
[03.02.2008 23:43|-r-------|6635] D:\řřamerican pieřř.m3u
[30.10.2007 22:44|-r-------|15418] D:\řřoLdiEsřř.m3u
[11.09.2007 18:26|-r-------|121344] D:\éstava ¬esk‚ republiky.doc
[18.04.2008 17:54|-r-------|79872] D:\üˇhov 7.doc
[08.01.2008 00:58|-r-------|3098] D:\ćTÖR.txt
[19.10.2009 18:06|--a------|3309072] E:\ccsetup224.exe
[22.11.2009 12:43|--a------|17481] E:\Aufsatz.docx
[22.11.2009 13:04|--a------|26624] E:\Wirtschaft.doc
[22.11.2009 09:40|--a------|2396856] E:\Fachsprache-Wirtschaft-7.-Lektion.pdf
[10.12.2009 22:15|--a------|81146] E:\434682090207_7_1131_20091113.pdf
[18.12.2009 11:24|--a------|13252] E:\UPC ¬esk republika reklamace.docx
[03.11.2009 23:07|--a------|11211] E:\Věstava - seznam fotografiˇ.docx
[12.01.2010 14:31|--a------|14022] E:\Smlouva o ŁvŘru.docx
[14.04.2008 18:26|-rahs----|916794] E:\rbxija.exe
[12.01.2010 14:32|--a------|14003] E:\Smlouva o ŁvŘru bez kuchynŘ.docx
[18.01.2010 11:38|--a------|19076] E:\vě§ivn‚ üˇha pýehled.docx
[31.01.2010 07:49|--a------|22528] E:\inzer t pron jem.doc
[31.01.2010 07:50|--a------|10624] E:\inzer t pron jem W.docx
[31.01.2010 23:19|--a------|5117] E:\DSLDP1-6312190192-20100131-231512-758083-potvrzeni.pdf
[31.01.2010 23:19|--a------|154281] E:\DSLDP1-6312190192-20100131-231354.pdf
[24.03.2010 21:37|--a------|10897] E:\Reklamace Fagor.docx
[16.04.2010 15:39|--a------|22345075] E:\TuneUp_Utilities_2010_9.0.3000.136_CZ.rar

################## | Vaccination |

# C:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# E:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).

################## | Upload |

Please send the file : C:\UsbFix_Upload_Me_DRAHOUSEK.zip : http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution .

################## | ! End of report # UsbFix V6.104 ! |

Log OTL je tady:

OTL logfile created on: 16.4.2010 21:58:50 - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

510,00 Mb Total Physical Memory | 139,00 Mb Available Physical Memory | 27,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 31,48 Gb Total Space | 18,51 Gb Free Space | 58,79% Space Free | Partition Type: NTFS
Drive D: | 3,81 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 491,55 Mb Total Space | 298,77 Mb Free Space | 60,78% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DRAHOUSEK
Current User Name: Janinka
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.16 21:58:39 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory\OTL.exe
PRC - [2010.04.07 21:05:54 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010.02.26 06:41:12 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2010.02.25 12:02:02 | 000,716,616 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2010.02.25 11:59:54 | 001,047,880 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2009.07.20 11:49:58 | 000,984,576 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2009.03.10 22:18:18 | 000,969,608 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WgaTray.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.04.14 05:22:15 | 000,390,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe
PRC - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

========== Modules (SafeList) ==========

MOD - [2010.04.16 21:58:39 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2010.04.16 15:55:50 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.02.26 06:42:34 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.02.26 06:41:12 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2010.02.25 11:59:54 | 001,047,880 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.02.25 11:56:02 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.07.20 11:49:58 | 000,984,576 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))

========== Driver Services (SafeList) ==========

DRV - [2010.02.26 06:41:36 | 000,055,232 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2010.02.26 06:41:34 | 000,032,584 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2010.02.26 06:41:32 | 000,134,488 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)
DRV - [2010.02.26 06:41:06 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.02.26 06:39:24 | 000,139,192 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2009.10.14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.07.20 11:50:16 | 000,138,752 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2008.05.02 10:58:14 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2008.05.02 10:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008.04.13 20:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) Ovladač zvukové karty USB (WDM)
DRV - [2008.03.29 11:20:55 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2008.03.29 11:20:55 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2007.11.14 04:08:38 | 000,100,992 | ---- | M] (AnyDATA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\adusbser.sys -- (adusbser)
DRV - [2007.06.25 14:29:50 | 000,500,736 | R--- | M] (Atheros Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZD1211BU.sys -- (ZD1211BU(TP-LINK)) TP-LINK Wireless USB Adapter Driver(TP-LINK)
DRV - [2005.03.01 06:01:40 | 000,392,704 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2004.11.05 10:43:58 | 000,032,768 | R--- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnicxp.sys -- (SISNICXP)
DRV - [2004.09.14 06:55:44 | 000,088,960 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn)
DRV - [2004.09.03 07:43:00 | 000,046,464 | R--- | M] (Silicon Integrated Systems) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SiSRaid.sys -- (SiSRaid)
DRV - [2004.08.03 22:31:36 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2004.01.21 03:14:42 | 000,271,360 | R--- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) Labtec WebCam Pro(PID_08A0)
DRV - [2003.03.25 11:50:46 | 000,004,096 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\siside.sys -- (SiSide)
DRV - [2002.10.17 09:14:46 | 000,049,024 | R--- | M] (Windows (R) 2000 DDK provider) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\sisidex.sys -- (sisidex)
DRV - [2002.08.20 11:19:08 | 000,009,472 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sisperf.sys -- (sisperf)
DRV - [2002.07.01 11:14:06 | 000,008,192 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2002.07.01 10:30:14 | 000,203,776 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tn.cz
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://tv.nova.cz [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.nova.cz
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://tv.nova.cz [binary data]
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://google.com"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..keyword.URL: "http://www.crawler.com/search/dispatche ... 60327&qkw="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.16 15:34:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.07 21:06:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2010.04.16 19:37:01 | 000,000,000 | ---D | M]

[2009.09.20 13:45:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Extensions
[2010.04.16 20:32:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\extensions
[2010.04.16 15:31:08 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.10 11:09:45 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-1.xml
[2010.01.28 12:41:14 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-2.xml
[2010.01.28 14:07:01 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-3.xml
[2010.01.28 14:08:12 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-4.xml
[2010.03.04 22:28:05 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-5.xml
[2010.04.01 13:13:21 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-6.xml
[2010.04.07 21:06:23 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin-7.xml
[2008.03.31 09:52:00 | 000,000,168 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin.gif
[2008.03.31 09:52:00 | 000,000,618 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin.src
[2009.09.29 19:51:06 | 000,000,944 | ---- | M] () -- C:\Documents and Settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\searchplugins\icqplugin.xml
[2010.04.16 20:32:29 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.09.20 15:43:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.03.16 20:17:17 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.03.16 20:17:17 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.03.16 20:17:17 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.03.16 20:17:17 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.03.16 20:17:17 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2002.12.05 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [SiS KHooker] C:\WINDOWS\system32\Khooker.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\Sraid.exe (SiS)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SpywareTerminator] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\RunServices: [csrcs] C:\WINDOWS\System32\csrcs.exe File not found
O4 - Startup: C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: csrcs = C:\WINDOWS\system32\csrcs.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O15 - HKLM\..Trusted Domains: mojebanka.cz ([*] https in Trusted sites)
O15 - HKCU\..Trusted Domains: mojebanka.cz ([*] https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/ ... ontrol.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/sh ... wflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.07.20 11:02:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010.04.16 21:57:27 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.04.16 21:57:32 | 000,000,000 | RHSD | M] - E:\autorun.inf -- [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.04.16 21:57:27 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010.04.16 21:50:58 | 000,000,000 | ---D | C] -- C:\UsbFix
[2010.04.16 20:33:38 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.04.16 20:33:18 | 000,000,000 | ---D | C] -- C:\rsit
[2010.04.16 19:39:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\ESET
[2010.04.16 19:39:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Data aplikací\ESET
[2010.04.16 19:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\ESET
[2010.04.16 19:36:49 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010.04.16 19:36:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.04.16 15:55:52 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2010.04.16 15:51:07 | 000,030,536 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\TURegOpt.exe
[2010.04.16 15:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010
[2010.04.16 15:44:39 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.04.16 15:41:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2010.04.16 15:30:13 | 000,000,000 | ---D | C] -- C:\Program Files\WinClamAVShield
[2010.04.11 14:10:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Data aplikací\Apple Computer
[2010.04.11 14:08:45 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.04.11 14:08:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
[2010.04.11 14:07:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010.04.11 14:07:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\Apple
[2010.04.11 14:07:18 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.04.11 14:07:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Apple
[2010.04.11 14:07:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\Apple Computer
[2010.04.09 21:18:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Dokumenty\Poznámkové bloky aplikace OneNote
[2010.04.01 22:28:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory
[2010.03.28 20:38:33 | 000,000,000 | -H-D | C] -- C:\WINDOWS\msdownld.tmp
[2010.03.28 20:26:43 | 017,191,936 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Janinka\Dokumenty\IE8-Setup-Full(3).exe
[2010.03.27 19:07:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Janinka\Dokumenty\foto
[2009.07.20 11:39:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft
[2009.07.20 11:10:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft
[2009.07.20 11:01:46 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
[2009.07.20 11:01:46 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Data aplikací\Microsoft
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.04.16 21:57:42 | 016,107,712 | ---- | M] () -- C:\UsbFix_Upload_Me_DRAHOUSEK.zip
[2010.04.16 21:54:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.04.16 21:54:23 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.04.16 21:54:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.04.16 21:53:10 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\Janinka\NTUSER.DAT
[2010.04.16 21:53:10 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Janinka\ntuser.ini
[2010.04.16 21:53:02 | 004,277,900 | -H-- | M] () -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\IconCache.db
[2010.04.16 21:44:16 | 001,777,625 | ---- | M] () -- C:\Documents and Settings\Janinka\Plocha\UsbFix.exe
[2010.04.16 17:15:00 | 000,000,394 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[2010.04.15 00:06:57 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.04.11 14:11:11 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.04.11 14:07:35 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.04.10 23:48:16 | 000,010,240 | ---- | M] () -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.04.09 21:18:32 | 000,000,955 | ---- | M] () -- C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
[2010.04.02 18:40:47 | 000,008,030 | -HS- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\Folder.jpg
[2010.04.02 18:40:47 | 000,008,030 | -HS- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArt_{2B04DC28-0982-49E5-896F-C5C342570D71}_Large.jpg
[2010.04.02 18:40:45 | 000,002,190 | -HS- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArtSmall.jpg
[2010.04.02 18:40:45 | 000,002,190 | -HS- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArt_{2B04DC28-0982-49E5-896F-C5C342570D71}_Small.jpg
[2010.04.02 18:24:10 | 000,000,332 | ---- | M] () -- C:\Documents and Settings\Janinka\Plocha\Dokumenty.lnk
[2010.04.02 14:53:54 | 000,000,073 | ---- | M] () -- C:\WINDOWS\Kyor.ini
[2010.04.01 13:12:58 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Mozilla Firefox.lnk
[2010.03.28 20:27:15 | 017,191,936 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Janinka\Dokumenty\IE8-Setup-Full(3).exe
[2010.03.28 10:33:40 | 000,314,508 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.03.28 10:33:40 | 000,312,970 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.03.28 10:33:40 | 000,047,206 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.03.28 10:33:40 | 000,040,836 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.03.28 10:33:39 | 000,723,342 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.03.26 19:39:28 | 000,000,959 | RHS- | M] () -- C:\WINDOWS\System32\autorun.i
[2010.03.26 19:39:28 | 000,000,390 | RHS- | M] () -- C:\WINDOWS\System32\autorun.in
[2010.03.24 22:37:32 | 000,010,897 | ---- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\Reklamace Fagor.docx
[2010.03.24 17:53:00 | 000,337,231 | ---- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\Daňové přiznání 2009.pdf
[2010.03.19 23:23:13 | 000,208,947 | ---- | M] () -- C:\Documents and Settings\Janinka\Dokumenty\upoutavka.jpg
[2010.03.19 18:05:50 | 004,874,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmp.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.16 21:57:38 | 016,107,712 | ---- | C] () -- C:\UsbFix_Upload_Me_DRAHOUSEK.zip
[2010.04.16 21:43:32 | 001,777,625 | ---- | C] () -- C:\Documents and Settings\Janinka\Plocha\UsbFix.exe
[2010.04.11 14:07:34 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.04.09 21:18:32 | 000,000,955 | ---- | C] () -- C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
[2010.04.02 18:40:49 | 000,008,030 | -HS- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\Folder.jpg
[2010.04.02 18:40:49 | 000,008,030 | -HS- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArt_{2B04DC28-0982-49E5-896F-C5C342570D71}_Large.jpg
[2010.04.02 18:40:49 | 000,002,190 | -HS- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArtSmall.jpg
[2010.04.02 18:40:49 | 000,002,190 | -HS- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\AlbumArt_{2B04DC28-0982-49E5-896F-C5C342570D71}_Small.jpg
[2010.04.02 18:24:10 | 000,000,332 | ---- | C] () -- C:\Documents and Settings\Janinka\Plocha\Dokumenty.lnk
[2010.03.26 19:39:28 | 000,000,959 | RHS- | C] () -- C:\WINDOWS\System32\autorun.i
[2010.03.26 19:39:28 | 000,000,390 | RHS- | C] () -- C:\WINDOWS\System32\autorun.in
[2010.03.24 22:37:32 | 000,010,897 | ---- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\Reklamace Fagor.docx
[2010.03.24 17:53:00 | 000,337,231 | ---- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\Daňové přiznání 2009.pdf
[2010.03.19 23:23:11 | 000,208,947 | ---- | C] () -- C:\Documents and Settings\Janinka\Dokumenty\upoutavka.jpg
[2009.09.22 22:43:40 | 000,017,191 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009.09.21 22:16:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\khooker.INI
[2009.09.21 21:29:55 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\drivers\srvkp.sys
[2009.09.21 21:28:18 | 000,141,377 | ---- | C] () -- C:\WINDOWS\System32\2_ssetup.ini
[2009.09.21 21:28:18 | 000,091,118 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini
[2009.09.21 21:28:18 | 000,050,221 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini
[2009.09.20 13:20:32 | 000,000,033 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2009.09.20 13:19:51 | 000,135,168 | R--- | C] () -- C:\WINDOWS\System32\property.dll
[2009.09.20 13:19:21 | 000,139,264 | R--- | C] () -- C:\WINDOWS\System32\IDEproperty.dll
[2009.07.21 21:38:39 | 000,000,073 | ---- | C] () -- C:\WINDOWS\Kyor.ini
[2009.07.20 15:19:05 | 000,010,240 | ---- | C] () -- C:\Documents and Settings\Janinka\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.20 11:50:16 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2009.07.20 11:11:54 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\Janinka\ntuser.dat.LOG
[2009.07.20 11:11:54 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\Janinka\ntuser.ini
[2009.07.20 11:11:53 | 003,145,728 | -H-- | C] () -- C:\Documents and Settings\Janinka\NTUSER.DAT
< End of report >

papushka · #4 Příspěvek od **papushka** » 16 dub 2010 21:05

a ještě Extras.txt:

OTL Extras logfile created on: 16.4.2010 21:58:50 - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

510,00 Mb Total Physical Memory | 139,00 Mb Available Physical Memory | 27,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 31,48 Gb Total Space | 18,51 Gb Free Space | 58,79% Space Free | Partition Type: NTFS
Drive D: | 3,81 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 491,55 Mb Total Space | 298,77 Mb Free Space | 60,78% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DRAHOUSEK
Current User Name: Janinka
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Program Files\ICQ6\ICQ.exe" = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08498FF9-6C9B-4FC2-8DE1-BD98C89CC220}" = SiSRaidPackage
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B2ABF54-299A-46E4-B4C5-A8879DF6EE72}" = ESET Smart Security
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0015-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}_ENTERPRISE_{294B4278-CF7B-40B9-86A1-2D3FF0C2C524}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-001F-041B-0000-0000000FF1CE}_ENTERPRISE_{10EC59E5-9BCE-4884-BB1A-E28627220232}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0405-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Czech) 2007
"{90120000-0044-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}_ENTERPRISE_{E12F9D31-4025-4BC6-B1B2-AB262C5580B0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0405-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Czech) 2007
"{90120000-00A1-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0405-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Czech) 2007
"{90120000-00BA-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{AC76BA86-7AD7-1029-7B44-A91000000001}" = Adobe Reader 9.1 - Czech
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{FE3997D3-6B56-4AC4-A99C-9DDFC45359BF}" = TuneUp Utilities Language Pack (en-US)
"26A0171663078E7566FCAF6AEFD4E22BB2EE9E88" = Balíček ovladače systému Windows - AnyDATA Corporation (adusbser) Modem (11/01/2007 2.0.4.0)
"AC3Filter" = AC3Filter (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AG200T8-D64" = AG200T8-D64
"BCFFF7ECD8AFC28CBDDCBDDD59F52A7A3C0094DF" = Balíček ovladače systému Windows - AnyDATA Corporation (adusbser) Ports (11/01/2007 2.0.4.0)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GOM Player" = GOM Player
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"Kyodai 15.25 (Full package)_is1" = Kyodai
"MiNODLogin" = ESET Antivirus License Finder (MiNODLogin)
"Money S3" = Ekonomický systém Money S3
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MPEG2 Codec(libmpeg2/mad)" = MPEG2 Codec(libmpeg2/mad)
"O2 Internet Konfigurator" = O2 Internet Konfigurator
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver
"Spyware Terminator_is1" = Spyware Terminator
"TuneUp Utilities" = TuneUp Utilities
"Ufonuv Internet" = Ufonuv Internet
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"Xabre 3D Wizard" = Xabre 3D Wizard

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9.2.2010 16:19:13 | Computer Name = DRAHOUSEK | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Zvolený server nemůže provést požadovanou operaci.

Error - 9.2.2010 16:19:37 | Computer Name = DRAHOUSEK | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Daná operace se vrátila, protože vypršel časový limit.

Error - 9.2.2010 16:19:37 | Computer Name = DRAHOUSEK | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Zvolený server nemůže provést požadovanou operaci.

Error - 9.2.2010 16:19:37 | Computer Name = DRAHOUSEK | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 9.2.2010 16:19:37 | Computer Name = DRAHOUSEK | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 9.2.2010 16:20:06 | Computer Name = DRAHOUSEK | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace firefox.exe, verze 1.9.0.3642, zablokovaný modul
hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 9.2.2010 16:26:09 | Computer Name = DRAHOUSEK | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace firefox.exe, verze 1.9.0.3642, zablokovaný modul
hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 10.2.2010 12:54:57 | Computer Name = DRAHOUSEK | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace firefox.exe, verze 1.9.0.3642, zablokovaný modul
hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 19.2.2010 17:33:16 | Computer Name = DRAHOUSEK | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace firefox.exe, verze 1.9.0.3642, zablokovaný modul
hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 6.3.2010 15:54:05 | Computer Name = DRAHOUSEK | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace firefox.exe, verze 1.9.0.3685, zablokovaný modul
hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

< End of report >

#5 Příspěvek od **Caroprd111** » 16 dub 2010 21:12

Podle pravidel fóra se zde nelegálním softwarem nezabýváme (nelegální programy představují bezpečnostní hrozbu).
Obstarejte si legální zabezpečení PC (antivir, firewall), poté sem vložte nový log z RSIT a log z CKScanner.

Vyberte si třeba free Aviru nebo Avast + nějaký firewall (doporučuji ZoneAlarm) http://www.viry.cz/forum/viewtopic.php?f=29&t=6152 + http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

Obrázek

Stáhněte na plochu CKScanner http://downloads.malwareremoval.com/CKScanner.exe

Spusťte a klikněte na "Search For Files", po dokončení skenu klikněte na "Save List to File" -> "OK"
Log s názvem ckfiles.txt bude uložený na ploše, obsah tohoto souboru sem vložte.

papushka · #6 Příspěvek od **papushka** » 16 dub 2010 21:48

OK, tedy log z RSIT je tady:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Janinka at 2010-04-16 22:44:27
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (61%) free of 32 GB
Total RAM: 510 MB (6% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:45:09, on 16.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\khooker.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Janinka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tn.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.nova.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 7892 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-27 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-27 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-07-20 2834432]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SiSRaid"=C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe [2005-03-01 897024]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]
"SiS Tray"=C:\WINDOWS\system32\sistray.EXE [2002-06-28 397312]
"SiS KHooker"=C:\WINDOWS\system32\khooker.exe [2002-06-28 282624]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-27 149280]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-04-14 2790472]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"csrcs"=C:\WINDOWS\system32\csrcs.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDriveAutoRun"=255
"HonorAutoRunSetting"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-04-16 22:25:14 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-04-16 22:24:27 ----D---- C:\Program Files\Alwil Software
2010-04-16 22:24:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-04-16 21:57:27 ----RASHD---- C:\autorun.inf
2010-04-16 21:54:36 ----A---- C:\UsbFix.txt
2010-04-16 21:50:58 ----D---- C:\UsbFix
2010-04-16 20:33:38 ----D---- C:\Program Files\trend micro
2010-04-16 20:33:18 ----D---- C:\rsit
2010-04-16 19:39:15 ----D---- C:\Documents and Settings\Janinka\Data aplikací\ESET
2010-04-16 19:36:49 ----D---- C:\Program Files\ESET
2010-04-16 15:55:52 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2010-04-16 15:51:07 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2010-04-16 15:47:54 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-04-16 15:44:39 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-16 15:41:16 ----D---- C:\WINDOWS\system32\appmgmt
2010-04-16 15:30:13 ----D---- C:\Program Files\WinClamAVShield
2010-04-15 00:07:02 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-15 00:06:54 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-15 00:06:44 ----HDC---- C:\WINDOWS\$NtUninstallKB979402_WM9$
2010-04-15 00:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-15 00:04:21 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-15 00:04:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-15 00:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-11 14:10:59 ----D---- C:\Documents and Settings\Janinka\Data aplikací\Apple Computer
2010-04-11 14:08:45 ----D---- C:\Program Files\QuickTime
2010-04-11 14:08:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-04-11 14:07:49 ----D---- C:\Program Files\Common Files\Apple
2010-04-11 14:07:18 ----D---- C:\Program Files\Apple Software Update
2010-04-11 14:07:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2010-03-28 20:38:33 ----HD---- C:\WINDOWS\msdownld.tmp

======List of files/folders modified in the last 1 months======

2010-04-16 22:45:06 ----D---- C:\WINDOWS\Temp
2010-04-16 22:43:56 ----D---- C:\WINDOWS\Prefetch
2010-04-16 22:36:22 ----D---- C:\WINDOWS\system32\config
2010-04-16 22:33:22 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-16 22:33:12 ----D---- C:\WINDOWS
2010-04-16 22:31:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-16 22:31:03 ----D---- C:\WINDOWS\system32
2010-04-16 22:28:26 ----SHD---- C:\WINDOWS\Installer
2010-04-16 22:27:57 ----HD---- C:\WINDOWS\inf
2010-04-16 22:27:56 ----D---- C:\WINDOWS\system32\drivers
2010-04-16 22:25:56 ----D---- C:\WINDOWS\WinSxS
2010-04-16 22:24:27 ----RD---- C:\Program Files
2010-04-16 21:57:18 ----SHD---- C:\RECYCLER
2010-04-16 21:46:30 ----D---- C:\Program Files\Common Files
2010-04-16 21:46:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2010-04-16 15:53:41 ----SD---- C:\WINDOWS\Tasks
2010-04-16 15:47:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2010-04-15 00:07:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-04-15 00:07:05 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-15 00:06:59 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-15 00:06:57 ----A---- C:\WINDOWS\imsins.BAK
2010-04-09 21:18:36 ----SD---- C:\Documents and Settings\Janinka\Data aplikací\Microsoft
2010-04-07 21:06:10 ----D---- C:\Program Files\Mozilla Firefox
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-02 14:53:54 ----A---- C:\WINDOWS\Kyor.ini
2010-03-31 22:59:13 ----D---- C:\Program Files\Internet Explorer
2010-03-28 20:38:16 ----D---- C:\WINDOWS\ie8updates
2010-03-28 20:38:02 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-28 20:36:14 ----D---- C:\WINDOWS\system32\cs-CZ
2010-03-28 10:33:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-19 21:46:00 ----D---- C:\WINDOWS\Minidump
2010-03-19 18:05:50 ----N---- C:\WINDOWS\system32\wmp.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-04-14 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-04-14 162768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-04-14 46672]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2002-07-01 8192]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-04-14 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-04-14 100432]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-04-14 23376]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-03-01 392704]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2002-07-01 203776]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 32768]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-28 220992]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2007-11-14 100992]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FXDRV;FXDRV; \??\D:\Fxdrv.sys []
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-14 88960]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-02 17536]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-05-02 20864]
S3 PID_08A0;Labtec WebCam Pro(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2004-01-21 271360]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-03 32768]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK); C:\WINDOWS\System32\DRIVERS\zd1211Bu.sys [2007-06-25 500736]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-27 153376]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-07-20 984576]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-02-25 1047880]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-04-16 435016]

-----------------EOF-----------------

A ten druhý zde:

CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11
----- EOF -----

#7 Příspěvek od **Caroprd111** » 16 dub 2010 21:53

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\RunServices: [csrcs] C:\WINDOWS\System32\csrcs.exe File not found
O15 - HKLM\..Trusted Domains: mojebanka.cz ([*] https in Trusted sites)
O15 - HKCU\..Trusted Domains: mojebanka.cz ([*] https in Trusted sites)
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Commands
[PURITY] 
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[CREATERESTOREPOINT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

papushka · #8 Příspěvek od **papushka** » 16 dub 2010 22:04

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\\csrcs deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mojebanka.cz\*\ deleted successfully.
Invalid CLSID key: *
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mojebanka.cz\*\ deleted successfully.
Invalid CLSID key: *
C:\WINDOWS\002182_.tmp deleted successfully.
C:\WINDOWS\005296_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SETA.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Janinka
->Temp folder emptied: 744485977 bytes
->Temporary Internet Files folder emptied: 1066188 bytes
->Java cache emptied: 55487897 bytes
->FireFox cache emptied: 41060404 bytes
->Flash cache emptied: 26774 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 28701818 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 55766 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 831,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: Janinka
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.1.1 log created on 04162010_225903

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

#9 Příspěvek od **Caroprd111** » 16 dub 2010 22:06

Jak to vypadá s PC

papushka · #10 Příspěvek od **papushka** » 16 dub 2010 22:07

Vše se zdá být v pořádku.

#11 Příspěvek od **Caroprd111** » 16 dub 2010 22:13

Poprosím o nový log z RSIT.

papushka · #12 Příspěvek od **papushka** » 16 dub 2010 22:32

Logfile of random's system information tool 1.06 (written by random/random)
Run by Janinka at 2010-04-16 23:31:19
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 22 GB (69%) free of 32 GB
Total RAM: 510 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:31:32, on 16.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\khooker.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Janinka\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Janinka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tn.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.nova.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 7827 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-27 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-27 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-07-20 2834432]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SiSRaid"=C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe [2005-03-01 897024]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]
"SiS Tray"=C:\WINDOWS\system32\sistray.EXE [2002-06-28 397312]
"SiS KHooker"=C:\WINDOWS\system32\khooker.exe [2002-06-28 282624]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-27 149280]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-04-14 2790472]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"csrcs"=C:\WINDOWS\system32\csrcs.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\Janinka\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDriveAutoRun"=255
"HonorAutoRunSetting"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-04-16 22:59:03 ----D---- C:\_OTL
2010-04-16 22:25:14 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-04-16 22:24:27 ----D---- C:\Program Files\Alwil Software
2010-04-16 22:24:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-04-16 21:57:27 ----RASHD---- C:\autorun.inf
2010-04-16 21:54:36 ----A---- C:\UsbFix.txt
2010-04-16 21:50:58 ----D---- C:\UsbFix
2010-04-16 20:33:38 ----D---- C:\Program Files\trend micro
2010-04-16 20:33:18 ----D---- C:\rsit
2010-04-16 19:39:15 ----D---- C:\Documents and Settings\Janinka\Data aplikací\ESET
2010-04-16 19:36:49 ----D---- C:\Program Files\ESET
2010-04-16 15:55:52 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2010-04-16 15:51:07 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2010-04-16 15:47:54 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-04-16 15:44:39 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-16 15:41:16 ----D---- C:\WINDOWS\system32\appmgmt
2010-04-16 15:30:13 ----D---- C:\Program Files\WinClamAVShield
2010-04-15 00:07:02 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-15 00:06:54 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-15 00:06:44 ----HDC---- C:\WINDOWS\$NtUninstallKB979402_WM9$
2010-04-15 00:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-15 00:04:21 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-15 00:04:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-15 00:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-11 14:10:59 ----D---- C:\Documents and Settings\Janinka\Data aplikací\Apple Computer
2010-04-11 14:08:45 ----D---- C:\Program Files\QuickTime
2010-04-11 14:08:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-04-11 14:07:49 ----D---- C:\Program Files\Common Files\Apple
2010-04-11 14:07:18 ----D---- C:\Program Files\Apple Software Update
2010-04-11 14:07:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple

======List of files/folders modified in the last 1 months======

2010-04-16 23:31:32 ----D---- C:\WINDOWS\Temp
2010-04-16 23:30:56 ----D---- C:\WINDOWS\Prefetch
2010-04-16 23:02:25 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-16 23:02:16 ----D---- C:\WINDOWS\system32\config
2010-04-16 23:00:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-16 23:00:23 ----SHD---- C:\System Volume Information
2010-04-16 23:00:23 ----D---- C:\WINDOWS\system32\Restore
2010-04-16 22:59:41 ----D---- C:\WINDOWS\system32
2010-04-16 22:59:41 ----D---- C:\WINDOWS
2010-04-16 22:28:26 ----SHD---- C:\WINDOWS\Installer
2010-04-16 22:27:57 ----HD---- C:\WINDOWS\inf
2010-04-16 22:27:56 ----D---- C:\WINDOWS\system32\drivers
2010-04-16 22:25:56 ----D---- C:\WINDOWS\WinSxS
2010-04-16 22:24:27 ----RD---- C:\Program Files
2010-04-16 21:57:18 ----SHD---- C:\RECYCLER
2010-04-16 21:46:30 ----D---- C:\Program Files\Common Files
2010-04-16 21:46:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2010-04-16 15:53:41 ----SD---- C:\WINDOWS\Tasks
2010-04-16 15:47:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2010-04-15 00:07:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-04-15 00:07:05 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-15 00:06:59 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-15 00:06:57 ----A---- C:\WINDOWS\imsins.BAK
2010-04-09 21:18:36 ----SD---- C:\Documents and Settings\Janinka\Data aplikací\Microsoft
2010-04-07 21:06:10 ----D---- C:\Program Files\Mozilla Firefox
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-02 14:53:54 ----A---- C:\WINDOWS\Kyor.ini
2010-03-31 22:59:13 ----D---- C:\Program Files\Internet Explorer
2010-03-28 20:38:16 ----D---- C:\WINDOWS\ie8updates
2010-03-28 20:38:02 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-28 20:36:14 ----D---- C:\WINDOWS\system32\cs-CZ
2010-03-28 10:33:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-19 21:46:00 ----D---- C:\WINDOWS\Minidump
2010-03-19 18:05:50 ----N---- C:\WINDOWS\system32\wmp.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-04-14 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-04-14 162768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-04-14 46672]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2002-07-01 8192]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-04-14 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-04-14 100432]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-04-14 23376]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-03-01 392704]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2002-07-01 203776]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2004-11-05 32768]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-28 220992]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2007-11-14 100992]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FXDRV;FXDRV; \??\D:\Fxdrv.sys []
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-14 88960]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-02 17536]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-05-02 20864]
S3 PID_08A0;Labtec WebCam Pro(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2004-01-21 271360]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-03 32768]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK); C:\WINDOWS\System32\DRIVERS\zd1211Bu.sys [2007-06-25 500736]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-27 153376]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-07-20 984576]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-02-25 1047880]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-04-16 435016]

-----------------EOF-----------------

#13 Příspěvek od **Caroprd111** » 17 dub 2010 08:35

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
Vložte do PC všechny flash disky, které používáte.
Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
Během skenování může být počítač restartován.

papushka · #14 Příspěvek od **papushka** » 23 dub 2010 17:22

Díky,

log z Combofix je tady:

ComboFix 10-04-21.01 - Janinka 23.04.2010 18:08:51.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.510.184 [GMT 2:00]
Spuštěný z: c:\documents and settings\Janinka\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.bak

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-23 do 2010-04-23 )))))))))))))))))))))))))))))))
.

2010-04-23 13:18 . 2010-04-23 13:18 2331776 ----a-w- c:\windows\system32\TUKernel.exe
2010-04-23 12:54 . 2010-04-23 12:54 -------- d-----w- c:\program files\WGA cracked v. 1.5.532
2010-04-16 20:59 . 2010-04-16 20:59 -------- d-----w- C:\_OTL
2010-04-16 20:26 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-16 20:26 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-16 20:26 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-16 20:26 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-16 20:26 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-16 20:26 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-16 20:26 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-16 20:25 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-16 20:25 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-16 20:24 . 2010-04-16 20:24 -------- d-----w- c:\program files\Alwil Software
2010-04-16 19:57 . 2010-04-16 19:57 16107712 ----a-w- C:\UsbFix_Upload_Me_DRAHOUSEK.zip
2010-04-16 19:50 . 2010-04-16 19:57 -------- d-----w- C:\UsbFix
2010-04-16 18:33 . 2010-04-16 21:31 -------- d-----w- c:\program files\trend micro
2010-04-16 18:33 . 2010-04-16 19:22 -------- d-----w- C:\rsit
2010-04-16 17:36 . 2010-04-16 20:28 -------- d-----w- c:\program files\ESET
2010-04-16 13:55 . 2010-02-25 09:56 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2010-04-16 13:51 . 2010-02-25 10:03 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2010-04-16 13:47 . 2010-04-16 13:56 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-04-16 13:30 . 2010-04-16 13:32 -------- d-----w- c:\program files\WinClamAVShield
2010-04-11 12:08 . 2010-04-11 12:09 -------- d-----w- c:\program files\QuickTime
2010-04-11 12:07 . 2010-04-11 12:07 -------- d-----w- c:\program files\Common Files\Apple
2010-04-11 12:07 . 2010-04-11 12:07 -------- d-----w- c:\program files\Apple Software Update
2010-03-28 18:28 . 2010-02-16 04:50 64000 -c----w- c:\windows\system32\dllcache\iecompat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-18 09:57 . 2009-07-20 09:45 -------- d-----w- c:\program files\Spyware Terminator
2010-04-11 12:11 . 2009-09-22 19:38 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-28 08:33 . 2002-12-05 12:00 47206 ----a-w- c:\windows\system32\perfc005.dat
2010-03-28 08:33 . 2002-12-05 12:00 312970 ----a-w- c:\windows\system32\perfh005.dat
2010-03-10 06:17 . 2002-12-05 12:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-04 20:25 . 2010-03-04 20:23 -------- d-----w- c:\program files\TO2SSM
2010-03-04 20:25 . 2010-03-04 19:59 -------- d-----w- c:\program files\Common Files\Motive
2010-02-25 06:18 . 2002-12-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2002-12-05 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:09 . 2002-12-05 12:00 2192128 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:09 . 2002-09-20 17:12 2068992 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:35 . 2002-12-05 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2002-12-05 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-10 09:34 . 2009-07-20 09:01 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-02-10 09:34 . 2009-07-20 09:01 3038 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-07-20 2834432]
"SiSRaid"="c:\program files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe" [2005-03-01 897024]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SiS Tray"="c:\windows\system32\sistray.EXE" [2002-06-27 397312]
"SiS KHooker"="c:\windows\system32\khooker.exe" [2002-06-27 282624]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"TO2SSM_McciTrayApp"=c:\program files\TO2SSM\McciTrayApp.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [16.4.2010 22:26 162768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [20.7.2009 11:50 138752]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [16.4.2010 22:26 19024]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [25.2.2010 11:59 1047880]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [20.9.2009 13:53 100992]
S3 FXDRV;FXDRV;\??\d:\fxdrv.sys --> d:\Fxdrv.sys [?]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK);c:\windows\system32\drivers\ZD1211BU.sys [20.7.2009 11:17 500736]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Janinka\Data aplikací\Mozilla\Firefox\Profiles\5all36zf.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60327&qkw=

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-23 18:13
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-04-23 18:16:10
ComboFix-quarantined-files.txt 2010-04-23 16:16

Před spuštěním: Volných bajtů: 22 611 271 680
Po spuštění: Volných bajtů: 22 578 556 928

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /TUTag=KESWLV /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /fastdetect /NoExecute=OptIn /TUTag=KESWLV-BAK

- - End Of File - - CDCF06A010713EC1508C2B09D75C7100

#15 Příspěvek od **Caroprd111** » 23 dub 2010 17:26

V logu vidím, že máte nelegální systém. Podle pravidel fóra nemůžu pokračovat, můžete maximálně vyčistit PC od nástrojů, co jsem použil.

Obrázek

Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter

Obrázek

Stáhněte T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

Spusťte.
Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít

VIRY.CZ

Win32/Packed.Autoit.Gen

Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen

Re: Win32/Packed.Autoit.Gen