Preventivka, prosim o kontrolu

Zpráva

mika666 · #1 Příspěvek od **mika666** » 29 dub 2010 08:32

Zatim se zda vse OK ale kdyby nahodou se tam neco objevilo

Diky

Logfile of random's system information tool 1.06 (written by random/random)
Run by NB at 2010-04-29 09:26:27
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 14 GB (38%) free of 38 GB
Total RAM: 758 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:19, on 29.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Wistron\AVManager\AVManager.exe
C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe
C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Documents and Settings\NB\Plocha\RSIT.exe
C:\Program Files\trend micro\NB.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AVManager] "C:\Program Files\Wistron\AVManager\AVManager.exe"
O4 - HKLM\..\Run: [MpsOnn] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\MpsOnn.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe -mini
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVR Control) - http://www.devalvr.com/instalacion/plug ... plugin.php
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O17 - HKLM\System\CS1\Services\Tcpip\..\{02D36FFE-5F1C-4DC8-882B-E0DB23AF3431}: NameServer = 172.16.150.249
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe
O23 - Service: G3 TCP COM Server service (G3TCPComServerService) - GORDIC® s.r.o. - C:\Program Files\Gordic\G3Win\TCPSrv\G3TCPSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 10437 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{D6B49CAA-4733-4BE9-90AF-578B3744F3B1}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-04-29 1615200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\Program Files\Free Download Manager\iefdm2.dll [2007-11-26 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-29 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-29 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2003-07-10 155648]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2003-07-10 114688]
"LaunchAp"=C:\Program Files\Launch Manager\LaunchAp.exe [2003-05-12 32768]
"HotkeyApp"=C:\Program Files\Launch Manager\HotkeyApp.exe [2003-09-04 40960]
"CtrlVol"=C:\Program Files\Launch Manager\CtrlVol.exe [2003-08-22 20480]
"LMgrOSD"=C:\Program Files\Launch Manager\OSD.exe [2003-06-25 204800]
"Wbutton"=C:\Program Files\Launch Manager\Wbutton.exe [2003-09-08 65536]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2003-02-14 88107]
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2002-11-25 172032]
"AVManager"=C:\Program Files\Wistron\AVManager\AVManager.exe [2003-10-15 77824]
"MpsOnn"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\MpsOnn.exe [2001-11-19 22528]
"Control Center"=C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe [2007-04-17 5342208]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-07-08 2173440]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-08-24 180269]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-04-29 2064736]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"=C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [2006-12-01 95800]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2009-06-20 3055616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe [2003-09-16 32881]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-08-24 180269]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Rychlé hledání Microsoft.lnk]
C:\PROGRA~1\MICROS~2\Office\FINDFAST.EXE [1997-11-26 111376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Spuštění Office.lnk]
C:\PROGRA~1\MICROS~2\Office\OSA.EXE [1997-11-26 51984]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
EPSON Status Monitor 3 Environment Check(3).lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2010-04-29 12464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-07-10 319488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe"="C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe:*:Enabled:eEBSvc"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe"="C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe:*:Enabled:Control Center"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"C:\Program Files\AVG\AVG8\avgam.exe"="C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe"
"C:\Program Files\AVG\AVG8\avgdiag.exe"="C:\Program Files\AVG\AVG8\avgdiag.exe:*:Enabled:avgdiag.exe"
"C:\Program Files\AVG\AVG8\avgdiagex.exe"="C:\Program Files\AVG\AVG8\avgdiagex.exe:*:Enabled:avgdiagex.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgnsx.exe"="C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\Java\j2re1.4.2_02\javaws\javaws.exe"="C:\Program Files\Java\j2re1.4.2_02\javaws\javaws.exe:*:Enabled:javaws"
"C:\Program Files\AVG\AVG9\avgam.exe"="C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe"
"C:\Program Files\AVG\AVG9\avgdiagex.exe"="C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe"
"C:\Program Files\AVG\AVG9\avgemc.exe"="C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ee1e113-4ed9-11dc-930c-000ae4562dee}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ee1e116-4ed9-11dc-930c-000ae4562dee}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ea7b1c2-226b-11de-96af-000ae4562dee}]
shell\AutoRun\command - H:\bOqYtp.EXe
shell\OpeN\command - H:\Boqytp.eXe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b76b3a99-47f5-11dd-947d-000ae4562dee}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ..\dokumenty\informace.rtf

======List of files/folders created in the last 1 months======

2010-04-29 09:26:27 ----D---- C:\rsit
2010-04-29 09:26:27 ----D---- C:\Program Files\trend micro
2010-04-29 08:32:34 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2010-04-29 08:16:02 ----HD---- C:\$AVG
2010-04-29 08:14:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\avg9
2010-04-29 07:54:52 ----D---- C:\Program Files\QuickTime
2010-04-29 07:54:22 ----SHD---- C:\Config.Msi
2010-04-29 07:53:50 ----D---- C:\Program Files\Common Files\Apple
2010-04-29 07:53:35 ----D---- C:\Program Files\Apple Software Update
2010-04-29 07:53:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2010-04-29 07:47:02 ----D---- C:\WINDOWS\system32\Adobe
2010-04-29 07:42:32 ----A---- C:\WINDOWS\system32\javaws.exe
2010-04-29 07:42:32 ----A---- C:\WINDOWS\system32\javaw.exe
2010-04-29 07:42:32 ----A---- C:\WINDOWS\system32\java.exe
2010-04-28 16:59:26 ----D---- C:\Program Files\Adobe
2010-04-28 16:56:55 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-04-28 16:53:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\NOS
2010-04-28 16:15:01 ----D---- C:\Documents and Settings\NB\Data aplikací\SUPERAntiSpyware.com
2010-04-28 16:15:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2010-04-28 16:12:30 ----D---- C:\Program Files\Mozilla Firefox
2010-04-21 12:33:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-04-21 12:08:28 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-04-10 07:48:04 ----D---- C:\Program Files\MSECache

======List of files/folders modified in the last 1 months======

2010-04-29 09:26:34 ----D---- C:\WINDOWS\Prefetch
2010-04-29 09:26:27 ----RD---- C:\Program Files
2010-04-29 09:24:46 ----D---- C:\WINDOWS\Temp
2010-04-29 09:23:22 ----D---- C:\WINDOWS
2010-04-29 09:22:23 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-29 08:42:29 ----D---- C:\WINDOWS\system32
2010-04-29 08:33:05 ----D---- C:\WINDOWS\system32\drivers
2010-04-29 08:19:14 ----D---- C:\WINDOWS\SxsCaPendDel
2010-04-29 08:14:35 ----D---- C:\Program Files\AVG
2010-04-29 08:13:27 ----SHD---- C:\WINDOWS\Installer
2010-04-29 08:13:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-04-29 08:13:24 ----D---- C:\WINDOWS\WinSxS
2010-04-29 08:11:26 ----SD---- C:\Documents and Settings\NB\Data aplikací\Microsoft
2010-04-29 08:05:51 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-04-29 07:54:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-04-29 07:53:50 ----D---- C:\Program Files\Common Files
2010-04-29 07:53:39 ----SD---- C:\WINDOWS\Tasks
2010-04-29 07:43:11 ----D---- C:\Program Files\Common Files\Java
2010-04-29 07:42:11 ----D---- C:\Program Files\Java
2010-04-29 07:14:18 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-29 07:13:50 ----D---- C:\Documents and Settings\NB\Data aplikací\Free Download Manager
2010-04-28 17:02:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-04-28 17:00:52 ----D---- C:\Program Files\Common Files\Adobe
2010-04-28 16:13:46 ----D---- C:\Documents and Settings\NB\Data aplikací\Mozilla
2010-04-28 16:13:26 ----D---- C:\Documents and Settings\NB\Data aplikací\Spyware Terminator
2010-04-28 16:02:04 ----D---- C:\Documents and Settings\NB\Data aplikací\Adobe
2010-04-28 16:01:58 ----RSD---- C:\WINDOWS\Fonts
2010-04-28 16:01:39 ----A---- C:\WINDOWS\TextSpy.ini
2010-04-28 15:46:32 ----D---- C:\Documents and Settings\NB\Data aplikací\Lavasoft
2010-04-28 15:46:30 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-04-28 10:48:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-04-27 22:03:31 ----A---- C:\WINDOWS\wincmd.ini
2010-04-27 14:00:48 ----D---- C:\Program Files\Spyware Terminator
2010-04-18 11:30:49 ----D---- C:\Program Files\CCleaner
2010-04-18 11:28:11 ----D---- C:\WINDOWS\Debug
2010-04-15 08:08:13 ----HD---- C:\WINDOWS\inf
2010-04-15 08:08:06 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-15 08:07:23 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-10 07:48:46 ----D---- C:\Program Files\Microsoft Office
2010-04-07 08:26:43 ----D---- C:\Program Files\ICQToolbar
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-03-31 09:07:25 ----D---- C:\Program Files\Internet Explorer
2010-03-31 08:02:27 ----D---- C:\WINDOWS\system32\cs-cz
2010-03-31 08:02:07 ----D---- C:\WINDOWS\ie7updates

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2010-04-29 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-04-29 29512]
R1 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2010-04-29 242896]
R1 Hotkey;Hotkey; C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 9867]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SASDIFSV;SASDIFSV; \??\C:\DOCUME~1\NB\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\DOCUME~1\NB\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys []
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-06-14 20747]
R2 hardlock;hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys []
R2 irda;Protokol IrDA; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192]
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-07-22 120062]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-07-22 96858]
R3 {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55};AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011; C:\WINDOWS\system32\drivers\wA301a.sys [2003-07-22 33847]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2003-02-14 1169792]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys [2002-12-17 42368]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 cs429x;Cirrus Logic WDM Audio Codec Driver; C:\WINDOWS\system32\drivers\cwawdm.sys [2003-07-15 111168]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2003-07-22 91419]
R3 KUSBusByTCPMasterBus;Master Bus of Kernel USB Software Bus by TCP; C:\WINDOWS\System32\Drivers\KUSBusByTCPMasterBus.sys [2006-12-20 52352]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NSCIRDA;NSC Infrared Device Driver; C:\WINDOWS\System32\DRIVERS\nscirda.sys [2008-04-13 28672]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver; C:\WINDOWS\System32\Drivers\WBMS.SYS [2003-04-15 30464]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver; C:\WINDOWS\System32\Drivers\WBSD.SYS [2003-05-06 26240]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S1 mailKmd;mailKmd; C:\WINDOWS\system32\drivers\mailKmd.sys []
S1 Wbutton;Wbutton; C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 KUSBusByTCP;%KUSBusByUSB.SvcDesc%; C:\WINDOWS\System32\Drivers\KUSBusByTCP.sys [2006-12-20 76672]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2008-04-13 22016]
S3 RT61;Ralink RT61 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-10-27 356096]
S3 SASENUM;SASENUM; \??\C:\DOCUME~1\NB\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS []
S3 Ser2pl;Prolific2 Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2004-06-28 42752]
S3 siusbmod;siusbmod; C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2006-01-23 27008]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg9emc;AVG E-mail Scanner; C:\Program Files\AVG\AVG9\avgemc.exe [2010-04-29 916760]
R2 avg9wd;AVG WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-04-29 308064]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe [2008-12-11 81920]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-29 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-07-24 53248]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-06-20 487424]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe [2008-12-11 2043904]
S3 G3TCPComServerService;G3 TCP COM Server service; C:\Program Files\Gordic\G3Win\TCPSrv\G3TCPSrv.exe [2009-06-05 1675688]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-12 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe []
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe []
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe []
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 29 dub 2010 12:42

Zdravím

Vložte do PC všechny flash disky, které používáte.

Obrázek

Stáhněte na plochu UsbFix http://pagesperso-orange.fr/NosTools/Ch ... UsbFix.exe

Spusťte, poté zvolte jazyk E - Enter
Zvolte 2 - Enter (je možný restart PC)
Po dokončení na Vás vyskočí log, vložte mi ho sem, případně ho najdete v C:\UsbFix.txt

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe

Spusťte, poté do spodního políčka vložte následující skript.

Kód: Vybrat vše

 netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys 
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys 
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys 
cdrom.sys 
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav 
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

Označte položku Pro všechny uživatele.
Označte položky Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Klikněte na tlačítko Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

mika666 · #3 Příspěvek od **mika666** » 29 dub 2010 13:48

Dnes uz to nestihnu, az zitra. Zatim diky

#4 Příspěvek od **Caroprd111** » 29 dub 2010 13:49

mika666 · #5 Příspěvek od **mika666** » 30 dub 2010 07:46

Dobre rano

UsbFix se dvěma flashkama

############################## | UsbFix V6.110 |

User : NB (Administrators) # MISTOSTAROSTA
Update on 28/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 7:34:55 | 30.4.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Celeron(R) M processor 1400MHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AVG Anti-Virus 9.0 [ Enabled | Updated ]

C:\ -> Místní pevný disk # 37,25 Go (13,59 Go free) # NTFS
D:\ -> Disk CD-ROM # 7,2 Go (0 Mo free) [VERONICA_GUERIN] # UDF
E:\ -> Vyměnitelný disk
F:\ -> Vyměnitelný disk
G:\ -> Vyměnitelný disk # 1006,45 Mo (940,38 Mo free) # FAT
H:\ -> Vyměnitelný disk # 3,72 Go (3,72 Go free) [KINGSTON] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\WINDOWS\System32\autorun.inf
Deleted ! C:\khw
Deleted ! C:\Recycler\S-1-5-21-1409082233-1682526488-1957994488-1004

################## | Registry |

################## | Mountpoints2 |

Deleted ! HKCU\...\Explorer\MountPoints2\{1ee1e113-4ed9-11dc-930c-000ae4562dee}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{1ee1e116-4ed9-11dc-930c-000ae4562dee}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{2ea7b1c2-226b-11de-96af-000ae4562dee}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{b76b3a99-47f5-11dd-947d-000ae4562dee}\Shell\AutoRun\Command

################## | Listing of the present files |

[25.05.2007 13:05|--a------|0] C:\AUTOEXEC.BAT
[25.05.2007 13:47|-rahs----|211] C:\boot.ini
[16.04.2003 14:00|-rahs----|4952] C:\Bootfont.bin
[23.10.2009 08:33|--a------|1438] C:\cert_sign.req
[25.05.2007 13:05|--a------|0] C:\CONFIG.SYS
[14.03.2010 19:49|--a------|39424] C:\dopis.doc
[10.11.2007 19:19|--ah-----|5200] C:\ffastun.ffa
[10.11.2007 19:19|--ah-----|557056] C:\ffastun.ffl
[10.11.2007 19:19|--ah-----|446464] C:\ffastun.ffo
[10.11.2007 19:19|--ah-----|4169728] C:\ffastun0.ffx
[11.11.2007 19:55|--a------|557056] C:\ffastunT.ffl
[25.05.2007 13:05|-rahs----|0] C:\IO.SYS
[25.05.2007 13:05|-rahs----|0] C:\MSDOS.SYS
[25.05.2007 13:43|-rahs----|47564] C:\NTDETECT.COM
[21.05.2009 10:57|-rahs----|250576] C:\ntldr
[?|?|?] C:\pagefile.sys
[02.11.2009 11:48|--a------|13030] C:\PDOXUSRS.NET
[30.04.2010 07:39|--a------|2397] C:\UsbFix.txt

################## | Vaccination |

# C:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# G:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).

################## | Upload |

Please send the file : C:\UsbFix_Upload_Me_MISTOSTAROSTA.zip : http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution .

################## | ! End of report # UsbFix V6.110 ! |

----------------------------------------------------------------------------
------------------------------------------------------------------------
-----------------------------------------------------------------------------

UsbFix s jednou flash a prenosnym HDD

############################## | UsbFix V6.110 |

User : NB (Administrators) # MISTOSTAROSTA
Update on 28/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 7:49:23 | 30.4.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Celeron(R) M processor 1400MHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AVG Anti-Virus 9.0 [ Enabled | Updated ]

C:\ -> Místní pevný disk # 37,25 Go (13,6 Go free) # NTFS
D:\ -> Disk CD-ROM # 7,2 Go (0 Mo free) [VERONICA_GUERIN] # UDF
E:\ -> Vyměnitelný disk
F:\ -> Vyměnitelný disk
G:\ -> Vyměnitelný disk # 980,72 Mo (950,03 Mo free) # FAT
H:\ -> Místní pevný disk # 298,02 Go (265,26 Go free) [Transcend] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\Recycler\S-1-5-21-1409082233-1682526488-1957994488-1004
Deleted ! H:\khw

################## | Registry |

################## | Mountpoints2 |

################## | Listing of the present files |

[25.05.2007 13:05|--a------|0] C:\AUTOEXEC.BAT
[25.05.2007 13:47|-rahs----|211] C:\boot.ini
[16.04.2003 14:00|-rahs----|4952] C:\Bootfont.bin
[23.10.2009 08:33|--a------|1438] C:\cert_sign.req
[25.05.2007 13:05|--a------|0] C:\CONFIG.SYS
[14.03.2010 19:49|--a------|39424] C:\dopis.doc
[10.11.2007 19:19|--ah-----|5200] C:\ffastun.ffa
[10.11.2007 19:19|--ah-----|557056] C:\ffastun.ffl
[10.11.2007 19:19|--ah-----|446464] C:\ffastun.ffo
[10.11.2007 19:19|--ah-----|4169728] C:\ffastun0.ffx
[11.11.2007 19:55|--a------|557056] C:\ffastunT.ffl
[25.05.2007 13:05|-rahs----|0] C:\IO.SYS
[25.05.2007 13:05|-rahs----|0] C:\MSDOS.SYS
[25.05.2007 13:43|-rahs----|47564] C:\NTDETECT.COM
[21.05.2009 10:57|-rahs----|250576] C:\ntldr
[?|?|?] C:\pagefile.sys
[02.11.2009 11:48|--a------|13030] C:\PDOXUSRS.NET
[30.04.2010 07:53|--a------|1937] C:\UsbFix.txt
[30.04.2010 07:40|--a------|2363] C:\UsbFix_Upload_Me_MISTOSTAROSTA.zip
[28.04.2010 13:58|--a------|536788] G:\Rezervnˇ fond 2009.JPG

################## | Vaccination |

# C:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# G:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# H:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).

################## | Upload |

Please send the file : C:\UsbFix_Upload_Me_MISTOSTAROSTA.zip : http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution .

################## | ! End of report # UsbFix V6.110 ! |

----------------------------------------------------------------------------
------------------------------------------------------------------------
-----------------------------------------------------------------------------

OTL

OTL Extras logfile created on: 30.4.2010 8:03:47 - Run 1
OTL by OldTimer - Version 3.2.3.0 Folder = C:\Documents and Settings\NB\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

758,00 Mb Total Physical Memory | 291,00 Mb Available Physical Memory | 38,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1140 2280 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37,25 Gb Total Space | 13,60 Gb Free Space | 36,52% Space Free | Partition Type: NTFS
Drive D: | 7,20 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MISTOSTAROSTA
Current User Name: NB
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe" = C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe:*:Enabled:eEBSvc -- ()
"C:\Program Files\ICQ6\ICQ.exe" = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe" = C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe:*:Enabled:Control Center -- ()
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" = C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator -- (Crawler.com)
"C:\Program Files\AVG\AVG8\avgam.exe" = C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe -- File not found
"C:\Program Files\AVG\AVG8\avgdiag.exe" = C:\Program Files\AVG\AVG8\avgdiag.exe:*:Enabled:avgdiag.exe -- File not found
"C:\Program Files\AVG\AVG8\avgdiagex.exe" = C:\Program Files\AVG\AVG8\avgdiagex.exe:*:Enabled:avgdiagex.exe -- File not found
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- File not found
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath -- File not found
"C:\Program Files\Java\j2re1.4.2_02\javaws\javaws.exe" = C:\Program Files\Java\j2re1.4.2_02\javaws\javaws.exe:*:Enabled:javaws -- ()
"C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{12955ADB-B35E-4AE2-A5E1-02023A859B47}" = FUS-3100 Control Center
"{18FFABA0-6C8B-41FB-A988-4AF3F9885B7D}_is1" = GORDIC® G3Win - TCP COM server
"{22FD32B5-26B7-490B-A01E-6EA854816E2C}_is1" = Spisová služba
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52E42344-1C48-453D-B80C-081C431F4E08}" = AVManager V1.1.0.6
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5D2CF9D0-113A-476B-986F-288B54571614}" = DevalVR plugin for Internet Explorer (remove)
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{64D5E9DE-7890-4FB0-8865-8B24BE1773F7}" = LightScribe 1.4.42.1
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7148F0A8-6813-11D6-A77B-00B0D0142020}" = Java 2 Runtime Environment, SE v1.4.2_02
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7E072CED-C3E0-4792-AE15-903F896BBF14}_is1" = Strážca systému 3.11
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{90120000-0020-0405-0000-0000000FF1CE}" = Sada Compatibility Pack pro systém Office 2007
"{90AF0405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{A542D955-9F05-4C74-8866-25DDC0DB15DB}" = SIEMENS USB Data Cable
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD117792-3EB6-4174-8F87-4AF06F90C4F9}_is1" = Paradox 7.0 Runtime
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.1.0
"{D7EED707-41D5-434B-A8AE-620558AF1667}" = Winbond SmartIO Driver
"{E2226A8B-BC77-4DE5-B12B-1C13418146EF}_is1" = GORDIC® G3Win - Elektronická spisová služba
"{E61CAE2E-6D6E-43C1-941B-17A69BC144C5}" = 602XML Filler
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EE564EB6-1AA4-4A8F-B17B-8BB8236FDACF}" = SketchMatrix
"{F0D7B090-DD6D-4AED-BEA2-6D090623E977}_is1" = GORDIC® G3Win - Nastavení DB profilů
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{F958F15A-4CE2-44E7-8179-97BBDCAF401A}" = OLYMPUS Master 2
"{F98388B4-BEDC-4799-90D3-C3C3624D2217}" = USB-to-PDA setting program
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink Wireless LAN Card
"57AEBD41-E899-4ECE-8F69-11CFD5709B05_is1" = Společné číselníky
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"AVG9Uninstall" = AVG 9.0
"Avidemux" = Avidemux v2.3.0_plus
"CANONBJ_Deinstall_CNMCP3m.DLL" = Canon S520
"CCleaner" = CCleaner
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"Diagram Designer" = Diagram Designer
"ESET Online Scanner" = ESET Online Scanner v3
"Excel" = Microsoft Excel 97
"FBDBServer_2_0_is1" = Firebird 2.0.5.13206 (win32)
"Free Download Manager_is1" = Free Download Manager 3.0
"gsle4" = LRC Editor 4.0 (remove only)
"HijackThis" = HijackThis 2.0.2
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Misys_0" = Misys 9.52 "c:\misys\is\"
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MWSnap 3" = MWSnap 3
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Občan a úřad - moderní rádce na CD-ROMu 1.0" = Občan a úřad - moderní rádce na CD-ROMu 1.0
"Picasa 3" = Picasa 3
"Podpůrné programy Evropské unie a České republiky na CD 1.7" = Podpůrné programy Evropské unie a České republiky na CD 1.7
"Popisovač CD/DVD_is1" = Popisovač CD/DVD 2.21
"RealPlayer 6.0" = RealPlayer
"Secunia PSI" = Secunia PSI
"SkyMap Pro 11" = SkyMap Pro 11
"Spyware Terminator_is1" = Spyware Terminator
"SubtitleWorkshop" = Subtitle Workshop 2.51
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 0.9.8a
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Word8.0" = Microsoft Word 97
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
"YouTube Downloader_is1" = YouTube Downloader 2.52

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Domestav Architekt" = Domestav Architekt
"Winamp Detect" = Winamp Application Detect

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 19.4.2010 8:50:37 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 19.4.2010 8:51:54 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 19.4.2010 8:52:04 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 19.4.2010 8:52:31 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 25.4.2010 4:11:53 | Computer Name = MISTOSTAROSTA | Source = FirebirdGuardianDefaultInstance | ID = 212
Description =

Error - 26.4.2010 3:19:15 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 26.4.2010 3:19:37 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 26.4.2010 3:20:15 | Computer Name = MISTOSTAROSTA | Source = MsiInstaller | ID = 11706
Description = Produkt: Nero - Burning Rom - Chyba 1706. Instalační balíček pro produkt
Nero - Burning Rom nebyl nalezen. Spusťte instalaci znovu pomocí platného instalačního
balíčku Nero - Burning Rom.msi.

Error - 27.4.2010 1:24:42 | Computer Name = MISTOSTAROSTA | Source = FirebirdGuardianDefaultInstance | ID = 212
Description =

Error - 27.4.2010 7:50:59 | Computer Name = MISTOSTAROSTA | Source = FirebirdGuardianDefaultInstance | ID = 212
Description =

[ System Events ]
Error - 27.4.2010 1:24:47 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7000
Description = Služba Firebird Server - DefaultInstance neuspěla při spuštění v důsledku
následující chyby: %%1053

Error - 27.4.2010 7:51:00 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7009
Description = Vypršel časový limit (30000 milisekund) čekání na připojení služby
Firebird Server - DefaultInstance.

Error - 27.4.2010 7:51:00 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7000
Description = Služba Firebird Server - DefaultInstance neuspěla při spuštění v důsledku
následující chyby: %%1053

Error - 27.4.2010 7:51:23 | Computer Name = MISTOSTAROSTA | Source = Dhcp | ID = 1000
Description = Zapůjčení adresy IP počítače 192.168.2.100 pro síťovou kartu se síťovou
adresou 000E2EA2B3BF byla ukončena.

Error - 27.4.2010 15:00:20 | Computer Name = MISTOSTAROSTA | Source = Dhcp | ID = 1000
Description = Zapůjčení adresy IP počítače 192.168.2.100 pro síťovou kartu se síťovou
adresou 000E2EA2B3BF byla ukončena.

Error - 27.4.2010 22:35:02 | Computer Name = MISTOSTAROSTA | Source = Dhcp | ID = 1000
Description = Zapůjčení adresy IP počítače 192.168.2.100 pro síťovou kartu se síťovou
adresou 000E2EA2B3BF byla ukončena.

Error - 28.4.2010 10:15:07 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7000
Description = Služba SASENUM neuspěla při spuštění v důsledku následující chyby:
%%2

Error - 30.4.2010 1:04:55 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: SASDIFSV SASKUTIL

Error - 30.4.2010 1:34:43 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: SASDIFSV SASKUTIL

Error - 30.4.2010 1:49:15 | Computer Name = MISTOSTAROSTA | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: SASDIFSV SASKUTIL

< End of report >

mika666 · #6 Příspěvek od **mika666** » 30 dub 2010 07:49

OTL logfile created on: 30.4.2010 8:03:47 - Run 1
OTL by OldTimer - Version 3.2.3.0 Folder = C:\Documents and Settings\NB\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

758,00 Mb Total Physical Memory | 291,00 Mb Available Physical Memory | 38,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1140 2280 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37,25 Gb Total Space | 13,60 Gb Free Space | 36,52% Space Free | Partition Type: NTFS
Drive D: | 7,20 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MISTOSTAROSTA
Current User Name: NB
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.29 13:56:17 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\NB\Plocha\OTL.exe
PRC - [2010.04.29 08:32:35 | 000,508,184 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010.04.29 08:32:34 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010.04.29 08:32:24 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010.04.29 08:32:22 | 000,751,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgscanx.exe
PRC - [2010.04.29 08:32:16 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010.04.29 08:32:07 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010.04.29 08:32:06 | 000,710,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010.04.29 08:32:01 | 000,836,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgam.exe
PRC - [2010.04.01 19:59:58 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009.06.20 13:01:16 | 000,487,424 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2008.12.11 17:05:28 | 000,081,920 | ---- | M] (FirebirdSQL Project) -- C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe
PRC - [2008.12.11 17:05:18 | 002,043,904 | ---- | M] (FirebirdSQL Project) -- C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010.04.29 13:56:17 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\NB\Plocha\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (sdCoreService)
SRV - File not found [On_Demand | Stopped] -- -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)
SRV - File not found [On_Demand | Stopped] -- -- (NBService)
SRV - [2010.04.29 08:32:24 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010.04.29 08:32:07 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2009.06.20 13:01:16 | 000,487,424 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2009.06.05 11:44:24 | 001,675,688 | ---- | M] (GORDIC® s.r.o.) [On_Demand | Stopped] -- C:\Program Files\Gordic\G3Win\TCPSrv\G3TCPSrv.exe -- (G3TCPComServerService)
SRV - [2008.12.11 17:05:28 | 000,081,920 | ---- | M] (FirebirdSQL Project) [Auto | Running] -- C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2008.12.11 17:05:18 | 002,043,904 | ---- | M] (FirebirdSQL Project) [On_Demand | Running] -- C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe -- (FirebirdServerDefaultInstance)

========== Driver Services (SafeList) ==========

DRV - [2010.04.29 08:32:37 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010.04.29 08:32:34 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010.04.29 08:32:07 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010.04.29 08:32:02 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\System32\Drivers\avgrkx86.sys -- (AvgRkx86)
DRV - [2009.06.20 13:01:16 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2009.06.17 14:20:34 | 000,012,648 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2009.04.03 11:18:26 | 000,130,936 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2008.04.13 20:54:36 | 000,028,672 | ---- | M] (National Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA)
DRV - [2008.01.03 12:49:25 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2006.12.20 11:36:38 | 000,052,352 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KUSBusByTCPMasterBus.sys -- (KUSBusByTCPMasterBus)
DRV - [2006.12.20 11:36:30 | 000,076,672 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KUSBusByTCP.sys -- (KUSBusByTCP)
DRV - [2006.01.23 14:15:06 | 000,027,008 | R--- | M] (Siemens AG ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\siusbmod.sys -- (siusbmod)
DRV - [2005.10.27 15:06:00 | 000,356,096 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61)
DRV - [2005.07.28 09:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (hardlock)
DRV - [2004.06.28 12:08:56 | 000,042,752 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2003.07.22 23:49:34 | 000,033,847 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wA301a.sys -- ({E2B953A6-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003.07.15 04:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x)
DRV - [2003.05.06 19:46:38 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\HOTKEY.sys -- (Hotkey)
DRV - [2003.04.15 17:04:18 | 000,030,464 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS)
DRV - [2003.02.14 22:59:14 | 001,169,792 | R--- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002.12.17 23:41:36 | 000,042,368 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchT ... f8&oe=utf8
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.812
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010.04.29 08:42:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.29 14:36:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.29 14:36:21 | 000,000,000 | ---D | M]

[2010.04.28 16:13:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Mozilla\Extensions
[2010.04.29 14:51:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Mozilla\Firefox\Profiles\gobehmap.default\extensions
[2010.04.29 14:51:44 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.04.29 07:42:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.04.29 07:42:15 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009.12.18 02:31:54 | 000,063,488 | ---- | M] (Nullsoft) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2010.04.01 18:51:34 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.04.01 18:51:34 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.04.01 18:51:34 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.04.01 18:51:34 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.04.01 18:51:34 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2010.04.29 13:12:31 | 000,393,065 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 13576 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVManager] C:\Program Files\Wistron\AVManager\AVManager.exe (Wistron Corporation)
O4 - HKLM..\Run: [Control Center] C:\Program Files\LevelOne FUS-3100\FUS-3100 Control Center\Control Center.exe ()
O4 - HKLM..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [MpsOnn] C:\WINDOWS\system32\spool\drivers\w32x86\3\MPSONN.EXE (CANON INC.)
O4 - HKLM..\Run: [SpywareTerminator] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe ()
O4 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O7 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Stáhnout Free Download Managerem - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Stáhnout video Free Download Managerem - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - C:\Program Files\Free Download Manager\dlselected.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)
O15 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (Reg Error: Key error.)
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} http://www.devalvr.com/instalacion/plug ... plugin.php (DevalVR Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resourc ... oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl ... rashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinsta ... s-i586.cab (Java Plug-in 1.4.2_02)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.123.254 192.168.124.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\NB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\NB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.05.25 13:05:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010.04.30 07:39:00 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007.05.25 13:04:54 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54338281256517632)

========== Files/Folders - Created Within 30 Days ==========

File not found -- C:\Documents and Settings\NB\Dokumenty\CAMVON5E.
File not found -- C:\Documents and Settings\NB\Dokumenty\CAFQSZ79.
File not found -- C:\Documents and Settings\NB\Dokumenty\CA36A1NJ.
[2010.04.30 07:39:00 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010.04.30 07:30:25 | 000,000,000 | ---D | C] -- C:\UsbFix
[2010.04.29 14:47:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Data aplikací\Software Informer
[2010.04.29 14:47:22 | 000,000,000 | ---D | C] -- C:\Program Files\Software Informer
[2010.04.29 14:37:13 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_42.dll
[2010.04.29 14:37:11 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_32.dll
[2010.04.29 14:37:01 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_31.dll
[2010.04.29 14:36:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2010.04.29 14:36:22 | 000,000,000 | ---D | C] -- C:\Program Files\Winamp Detect
[2010.04.29 14:36:04 | 000,066,544 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpya64.exe
[2010.04.29 14:36:04 | 000,066,032 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsa64.exe
[2010.04.29 14:36:03 | 001,858,032 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxsfs.dll
[2010.04.29 14:36:03 | 000,129,520 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxafs.dll
[2010.04.29 14:33:33 | 014,962,704 | ---- | C] (Nullsoft, Inc.) -- C:\Documents and Settings\NB\Plocha\winamp557_full_emusic-7plus_all.exe
[2010.04.29 14:33:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Data aplikací\vlc
[2010.04.29 13:56:09 | 000,563,712 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\NB\Plocha\OTL.exe
[2010.04.29 12:57:20 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2010.04.29 12:54:54 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010.04.29 12:54:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
[2010.04.29 12:54:00 | 000,716,320 | ---- | C] (Secunia) -- C:\Documents and Settings\NB\Plocha\PSISetup.exe
[2010.04.29 09:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.04.29 09:26:27 | 000,000,000 | ---D | C] -- C:\rsit
[2010.04.29 09:20:47 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\NB\Recent
[2010.04.29 08:32:34 | 000,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010.04.29 08:16:02 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010.04.29 08:14:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\avg9
[2010.04.29 07:54:52 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.04.29 07:54:22 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.04.29 07:53:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010.04.29 07:53:35 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.04.29 07:53:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Apple
[2010.04.29 07:47:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010.04.29 07:42:32 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.04.29 07:42:32 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.04.29 07:42:32 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.04.29 07:42:32 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.04.28 16:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2010.04.28 16:56:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010.04.28 16:53:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\NOS
[2010.04.28 16:47:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Dokumenty\Stažené soubory
[2010.04.28 16:15:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Data aplikací\SUPERAntiSpyware.com
[2010.04.28 16:15:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
[2010.04.28 16:13:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Local Settings\Data aplikací\Mozilla
[2010.04.28 16:12:30 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010.04.21 12:33:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Sun
[2010.04.21 12:08:28 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.04.13 18:13:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NB\Dokumenty\ping
[2010.04.10 07:48:04 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[8 C:\Documents and Settings\NB\Dokumenty\*.tmp files -> C:\Documents and Settings\NB\Dokumenty\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

mika666 · #7 Příspěvek od **mika666** » 30 dub 2010 07:51

pokracovani OTL

========== Files - Modified Within 30 Days ==========

File not found -- C:\Documents and Settings\NB\Dokumenty\CAMVON5E.
File not found -- C:\Documents and Settings\NB\Dokumenty\CAFQSZ79.
File not found -- C:\Documents and Settings\NB\Dokumenty\CA36A1NJ.
[2010.04.30 07:54:35 | 000,002,299 | ---- | M] () -- C:\UsbFix_Upload_Me_MISTOSTAROSTA.zip
[2010.04.30 07:48:38 | 008,405,015 | ---- | M] () -- C:\WINDOWS\TempFile
[2010.04.30 07:48:33 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.04.30 07:48:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.04.30 07:45:56 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\NB\ntuser.ini
[2010.04.30 07:45:55 | 011,272,192 | -H-- | M] () -- C:\Documents and Settings\NB\NTUSER.DAT
[2010.04.30 07:08:49 | 059,393,922 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010.04.30 07:05:34 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D6B49CAA-4733-4BE9-90AF-578B3744F3B1}.job
[2010.04.29 14:53:52 | 000,633,451 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\index.html
[2010.04.29 14:47:17 | 000,000,664 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\Free Download Manager.lnk
[2010.04.29 14:37:31 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Winamp.lnk
[2010.04.29 14:33:54 | 014,962,704 | ---- | M] (Nullsoft, Inc.) -- C:\Documents and Settings\NB\Plocha\winamp557_full_emusic-7plus_all.exe
[2010.04.29 14:32:36 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\VLC media player.lnk
[2010.04.29 14:24:41 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Adobe Reader 9.lnk
[2010.04.29 13:56:17 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\NB\Plocha\OTL.exe
[2010.04.29 13:55:59 | 001,777,790 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\UsbFix.exe
[2010.04.29 13:12:31 | 000,393,065 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.04.29 12:55:08 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\Spybot - Search & Destroy.lnk
[2010.04.29 12:54:00 | 000,716,320 | ---- | M] (Secunia) -- C:\Documents and Settings\NB\Plocha\PSISetup.exe
[2010.04.29 09:23:17 | 000,142,832 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.04.29 09:18:24 | 000,781,909 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\RSIT.exe
[2010.04.29 08:32:37 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010.04.29 08:32:34 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010.04.29 08:32:34 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010.04.29 08:32:07 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010.04.29 08:32:02 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgrkx86.sys
[2010.04.29 08:15:12 | 000,001,507 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\AVG 9.0.lnk
[2010.04.29 08:15:03 | 000,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010.04.29 07:57:33 | 000,041,276 | ---- | M] () -- C:\WINDOWS\NB8.xlb
[2010.04.29 07:55:16 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\QuickTime Player.lnk
[2010.04.29 07:53:40 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.04.29 07:42:15 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.04.29 07:42:15 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.04.29 07:42:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.04.29 07:42:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.04.29 07:42:15 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.04.28 16:13:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010.04.28 16:12:44 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Mozilla Firefox.lnk
[2010.04.28 16:12:23 | 000,000,610 | ---- | M] () -- C:\WINDOWS\System32\BIN_STRSBW.SPT
[2010.04.28 16:01:39 | 000,000,030 | ---- | M] () -- C:\WINDOWS\TextSpy.ini
[2010.04.28 15:19:49 | 000,014,131 | ---- | M] () -- C:\WINDOWS\KURIMSKY_SCHEDULE.VUE
[2010.04.28 12:21:28 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\NB\Dokumenty\Drobné sakrální stavby_Uherský Ostroh.xls
[2010.04.28 07:31:45 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.04.27 22:03:31 | 000,002,045 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.04.23 11:45:50 | 000,254,976 | ---- | M] () -- C:\Documents and Settings\NB\Dokumenty\Výroční zpráva 2009.doc
[2010.04.21 13:06:00 | 000,001,866 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\Domestav Architekt.lnk
[2010.04.19 07:45:12 | 000,028,120 | ---- | M] () -- C:\Documents and Settings\NB\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.04.18 11:31:38 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\NB\Plocha\CCleaner.lnk
[2010.04.02 10:21:25 | 000,000,054 | -H-- | M] () -- C:\Documents and Settings\NB\Dokumenty\~$louva o dílo (s.r.o.)-Ostroh - církev obch.zák..doc
[8 C:\Documents and Settings\NB\Dokumenty\*.tmp files -> C:\Documents and Settings\NB\Dokumenty\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.30 07:40:05 | 000,002,299 | ---- | C] () -- C:\UsbFix_Upload_Me_MISTOSTAROSTA.zip
[2010.04.29 14:53:48 | 000,633,451 | ---- | C] () -- C:\Documents and Settings\NB\Plocha\index.html
[2010.04.29 14:37:31 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Winamp.lnk
[2010.04.29 14:32:36 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\VLC media player.lnk
[2010.04.29 14:24:41 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Adobe Reader 9.lnk
[2010.04.29 13:55:44 | 001,777,790 | ---- | C] () -- C:\Documents and Settings\NB\Plocha\UsbFix.exe
[2010.04.29 12:55:08 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\NB\Plocha\Spybot - Search & Destroy.lnk
[2010.04.29 09:18:23 | 000,781,909 | ---- | C] () -- C:\Documents and Settings\NB\Plocha\RSIT.exe
[2010.04.29 08:15:12 | 000,001,507 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\AVG 9.0.lnk
[2010.04.29 07:55:15 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\QuickTime Player.lnk
[2010.04.28 16:13:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.04.28 16:12:44 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Mozilla Firefox.lnk
[2010.04.28 12:21:27 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\NB\Dokumenty\Drobné sakrální stavby_Uherský Ostroh.xls
[2010.04.23 11:45:50 | 000,254,976 | ---- | C] () -- C:\Documents and Settings\NB\Dokumenty\Výroční zpráva 2009.doc
[2010.04.21 13:06:00 | 000,001,866 | ---- | C] () -- C:\Documents and Settings\NB\Plocha\Domestav Architekt.lnk
[2010.04.02 09:56:43 | 000,000,054 | -H-- | C] () -- C:\Documents and Settings\NB\Dokumenty\~$louva o dílo (s.r.o.)-Ostroh - církev obch.zák..doc
[2009.07.01 15:42:25 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009.06.20 13:01:16 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2008.12.29 23:44:05 | 000,001,125 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2008.01.09 15:01:48 | 000,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008.01.03 13:04:39 | 000,000,374 | ---- | C] () -- C:\WINDOWS\Misys.ini
[2008.01.03 12:49:25 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2007.11.10 10:57:58 | 000,018,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys
[2007.11.10 10:57:57 | 000,044,544 | -HS- | C] () -- C:\WINDOWS\Strsysk.dll
[2007.11.10 10:57:56 | 000,024,064 | -HS- | C] () -- C:\WINDOWS\Strsys.dll
[2007.08.24 22:04:43 | 000,000,029 | ---- | C] () -- C:\WINDOWS\pslabeler.ini
[2007.08.24 22:04:36 | 000,000,025 | ---- | C] () -- C:\WINDOWS\calcpslab.ini
[2007.08.24 21:36:40 | 000,000,814 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007.08.08 07:30:44 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\windblt.dll
[2007.08.01 14:28:21 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007.08.01 09:22:44 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.06.14 17:56:59 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Install6x.dll
[2007.05.28 11:23:11 | 000,000,030 | ---- | C] () -- C:\WINDOWS\TextSpy.ini
[2007.05.28 08:03:17 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3m.DLL
[2007.05.28 07:55:06 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\EEBAPI.dll
[2007.05.28 07:55:06 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\EEBDSCVR.dll
[2007.05.28 07:55:06 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\EBAPI.dll
[2007.05.27 08:49:02 | 000,002,045 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2007.05.25 14:12:44 | 000,007,004 | ---- | C] () -- C:\WINDOWS\System32\drivers\VolDName.sys
[2007.05.25 14:08:03 | 000,009,867 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys
[2005.10.14 11:56:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.10.14 11:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 11:56:50 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005.10.14 11:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005.10.14 11:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005.10.14 11:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005.10.14 11:56:50 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005.10.14 11:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[1997.11.26 00:00:00 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\XLREC.DLL
[1997.11.26 00:00:00 | 000,025,600 | ---- | C] () -- C:\WINDOWS\System32\RECNCL.DLL
[1997.11.26 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1997.11.26 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2010.04.29 08:14:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\avg9
[2008.12.28 13:19:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\FreeDownloadManager.ORG
[2009.08.26 09:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\gepro
[2010.04.29 12:24:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
[2010.04.29 08:05:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2009.11.09 09:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Data aplikací\Gordic
[2010.04.29 14:59:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Free Download Manager
[2007.06.04 12:32:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Gordic
[2007.08.23 19:28:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\ICQ
[2007.08.23 19:17:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\ICQ Toolbar
[2007.11.14 22:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\LANGMaster
[2009.12.01 08:39:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\mojosoft
[2010.04.29 14:57:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Software Informer
[2010.04.28 16:13:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Spyware Terminator
[2009.09.26 06:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Transcend
[2008.03.30 11:05:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Zoner
[2010.04.30 07:05:34 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{D6B49CAA-4733-4BE9-90AF-578B3744F3B1}.job

========== Purity Check ==========

========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"OM2_Monitor" = "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart -- [2006.12.01 21:28:06 | 000,095,800 | ---- | M] (OLYMPUS IMAGING CORP.)
"ctfmon.exe" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2009.06.20 13:01:17 | 003,055,616 | ---- | M] (Crawler.com)

< c:\windows\*.* /U >
[4 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.04.28 16:02:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Adobe
[2007.08.01 10:29:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Ahead
[2007.10.27 09:31:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Apple Computer
[2010.03.23 09:50:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\dvdcss
[2010.04.29 14:59:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Free Download Manager
[2007.08.12 16:25:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Google
[2007.06.04 12:32:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Gordic
[2007.07.02 06:49:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Help
[2007.08.23 19:28:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\ICQ
[2007.08.23 19:17:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\ICQ Toolbar
[2007.05.25 13:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Identities
[2008.06.11 08:32:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\InstallShield
[2007.11.14 22:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\LANGMaster
[2010.04.28 15:46:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Lavasoft
[2008.05.09 15:16:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Macromedia
[2010.04.29 08:11:26 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NB\Data aplikací\Microsoft
[2009.12.01 08:39:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\mojosoft
[2010.04.28 16:13:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Mozilla
[2010.03.09 12:41:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\MSN6
[2009.06.20 12:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\PC Tools
[2008.05.02 17:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Real
[2009.11.19 18:48:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Skype
[2009.11.19 18:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\skypePM
[2010.04.29 14:57:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Software Informer
[2010.04.28 16:13:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Spyware Terminator
[2008.05.28 09:35:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Sun
[2010.04.28 16:15:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\SUPERAntiSpyware.com
[2009.09.26 06:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Transcend
[2008.08.08 18:34:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\U3
[2010.04.29 14:33:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\vlc
[2008.03.30 11:05:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NB\Data aplikací\Zoner

< %APPDATA%\*.exe /s >
[2010.02.01 03:45:40 | 000,038,784 | ---- | M] () -- C:\Documents and Settings\NB\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.04.27 10:29:57 | 000,439,816 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\NB\Data aplikací\Real\Update\setup3.10\setup.exe
[2005.06.06 11:29:14 | 000,110,592 | ---- | M] () -- C:\Documents and Settings\NB\Data aplikací\U3\temp\cleanup.exe

< MD5 for: AGP440.SYS >
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2003.04.16 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: CDROM.SYS >
[2003.04.16 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:cdrom.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:cdrom.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2009.12.22 20:39:20 | 000,062,592 | ---- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D -- C:\WINDOWS\system32\dllcache\cdrom.sys
[2004.08.03 22:59:54 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2004.08.17 15:49:04 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2004.08.17 15:49:08 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 15:11:59 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=9B32416BD5988C97B6397CE0B02CAF97 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:23:39 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=ED7B460B142A32097B8A8F6ECC941815 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2003.04.16 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:hal.dll
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:hal.dll
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2004.08.03 22:59:08 | 000,081,280 | ---- | M] (Microsoft Corporation) MD5=4AF58CA3425F28FC5E3DB47DC122F722 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:27 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:Changer.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys
[2004.08.03 23:00:14 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=DAF1A8193B6CAF0FB858CADCC5C4AF4A -- C:\WINDOWS\$NtServicePackUninstall$\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.05.21 10:51:27 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2001.10.24 11:44:12 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2003.04.16 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2004.08.17 15:49:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2004.08.03 23:14:30 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2004.08.17 15:49:14 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004.08.17 15:49:18 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2004.08.17 15:49:28 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2004.08.17 15:49:28 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.06.20 12:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2007.10.30 18:53:32 | 000,360,832 | ---- | M] (Microsoft Corporation) MD5=64798ECFA43D78C7178375FCDD16D8C8 -- C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[2008.06.20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2006.04.20 14:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2004.08.17 15:49:28 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004.08.17 15:49:28 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2004.08.17 15:49:22 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2003.04.16 14:00:00 | 001,114,896 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\esent97.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007.05.25 14:50:55 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007.05.25 14:50:55 | 000,606,208 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007.05.25 14:50:55 | 000,401,408 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2003.04.16 14:00:00 | 000,308,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\netui2.dll
[2006.06.28 17:59:26 | 000,024,576 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\nlsdl.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< %systemroot%\system32\drivers\*.sys /3 >
[2010.04.29 08:32:07 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgldx86.sys
[2010.04.29 08:32:34 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgmfx86.sys
[2010.04.29 08:32:02 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgrkx86.sys
[2010.04.29 08:32:37 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgtdix.sys

< %systemroot%\system32\*.* /3 >
[2010.04.29 08:32:34 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\avgrsstx.dll
[2010.04.28 16:12:23 | 000,000,610 | ---- | M] () -- C:\WINDOWS\system32\BIN_STRSBW.SPT
[2010.04.29 07:42:15 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\deployJava1.dll
[2010.04.29 09:23:17 | 000,142,832 | ---- | M] () -- C:\WINDOWS\system32\FNTCACHE.DAT
[2010.04.29 07:42:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\java.exe
[2010.04.29 07:42:15 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\javacpl.cpl
[2010.04.29 07:42:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\javaw.exe
[2010.04.29 07:42:15 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\javaws.exe
[2010.04.28 07:31:45 | 000,013,646 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:DFC5A2B2
< End of report >

#8 Příspěvek od **Caroprd111** » 30 dub 2010 13:09

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
SRV - File not found [On_Demand | Stopped] -- -- (sdCoreService)
SRV - File not found [On_Demand | Stopped] -- -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)
SRV - File not found [On_Demand | Stopped] -- -- (NBService)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O15 - HKU\S-1-5-21-1409082233-1682526488-1957994488-1004\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl ... rashim.cab (Reg Error: Key error.)
File not found -- C:\Documents and Settings\NB\Dokumenty\CAMVON5E.
File not found -- C:\Documents and Settings\NB\Dokumenty\CAFQSZ79.
File not found -- C:\Documents and Settings\NB\Dokumenty\CA36A1NJ.
[8 C:\Documents and Settings\NB\Dokumenty\*.tmp files -> C:\Documents and Settings\NB\Dokumenty\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:DFC5A2B2

:Commands
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[RESETHOSTS] 
[CREATERESTOREPOINT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

Obrázek

Tohle otestujte na http://www.virustotal.com/cs/
C:\WINDOWS\system32\esent97.dll
C:\WINDOWS\system32\netui2.dll
C:\WINDOWS\system32\nlsdl.dll
C:\WINDOWS\System32\drivers\VolDName.sys
C:\WINDOWS\System32\CNMVS3m.DLL
C:\WINDOWS\Strsys.dll
C:\ffastun.ffa

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

mika666 · #9 Příspěvek od **mika666** » 03 kvě 2010 08:05

http://www.virustotal.com/cs/analisis/8 ... 1272869383

http://www.virustotal.com/cs/analisis/b ... 1272869503

http://www.virustotal.com/cs/analisis/c ... 1272869579

http://www.virustotal.com/cs/analisis/9 ... 1272869689

http://www.virustotal.com/cs/analisis/4 ... 1272869761

http://www.virustotal.com/cs/analisis/f ... 1272869813

http://www.virustotal.com/cs/analisis/9 ... 1272869893

All processes killed
========== OTL ==========
Service sdCoreService stopped successfully!
Service sdCoreService deleted successfully!
Service sdAuxService stopped successfully!
Service sdAuxService deleted successfully!
Service NMIndexingService stopped successfully!
Service NMIndexingService deleted successfully!
Service NBService stopped successfully!
Service NBService deleted successfully!
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry value HKEY_USERS\S-1-5-21-1409082233-1682526488-1957994488-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\\ deleted successfully.
Starting removal of ActiveX control {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
C:\Program Files\Yahoo!\Common\yinst.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\Documents and Settings\NB\Dokumenty\~WRL0003.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL0724.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL1128.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL1968.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL2092.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL2162.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL3219.tmp deleted successfully.
C:\Documents and Settings\NB\Dokumenty\~WRL3412.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET2C0.tmp deleted successfully.
C:\WINDOWS\System32\SET2C4.tmp deleted successfully.
C:\WINDOWS\System32\SET2CC.tmp deleted successfully.
C:\WINDOWS\002025_.tmp deleted successfully.
C:\WINDOWS\005148_.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET7.tmp deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:DFC5A2B2 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NB
->Temp folder emptied: 12085839 bytes
->Temporary Internet Files folder emptied: 30520300 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 83509771 bytes
->Flash cache emptied: 44658 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 758323 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2098243 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 36281683 bytes

Total Files Cleaned = 158,00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NB
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.3.0 log created on 05032010_084038

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#10 Příspěvek od **Caroprd111** » 03 kvě 2010 13:00

Na virustotal.com ještě prosím otestujte:
C:\WINDOWS\System32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys

mika666 · #11 Příspěvek od **mika666** » 03 kvě 2010 13:18

http://www.virustotal.com/cs/analisis/5 ... 1272888936

#12 Příspěvek od **Caroprd111** » 03 kvě 2010 13:38

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
[2007.11.10 10:57:58 | 000,018,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys
[2007.11.10 10:57:57 | 000,044,544 | -HS- | C] () -- C:\WINDOWS\Strsysk.dll
[2007.11.10 10:57:56 | 000,024,064 | -HS- | C] () -- C:\WINDOWS\Strsys.dll

:Commands
[REBOOT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

mika666 · #13 Příspěvek od **mika666** » 04 kvě 2010 09:45

Skript jsem použil a žádný log po restartu na mně nevyskočil!?
Co dál?

mika666 · #14 Příspěvek od **mika666** » 04 kvě 2010 09:47

Hopla, už ho mám

========== OTL ==========
C:\WINDOWS\system32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys moved successfully.
C:\WINDOWS\Strsysk.dll moved successfully.
C:\WINDOWS\Strsys.dll moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.3.0 log created on 05042010_102615

#15 Příspěvek od **Caroprd111** » 04 kvě 2010 12:47

Jak to vypadá s PC

VIRY.CZ

Preventivka, prosim o kontrolu

Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu

Re: Preventivka, prosim o kontrolu