VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Nalezen vir ve VT

https://forum.viry.cz:443/viewtopic.php?t=100983

Stránka 1 z 1

Nalezen vir ve VT

Napsal: 10 kvě 2010 19:03
od KAREL.CZ
Zdarvicko avast mi nahlasil vir v tomto souboru (Win32:Malware-gen byl nalezen v souboru C:\Program Filles\Ventrilo\Ventrilo.exe) prosim o pomoc zasilam RSIT dekuji.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-05-10 20:01:34
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 50 GB (16%) free of 305 GB
Total RAM: 3582 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:01:42, on 10.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (file missing)
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_1.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_1.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_1.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [Zboard] C:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [nDVDControl] C:\Program Files\DNsoft.be\nDVD\nDVDControl.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ns1.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bw+0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {9A117BB8-17CE-4D84-B5A1-5302A74BA198} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 22105 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - C:\PROGRA~1\ICQTOO~1\toolbaru.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfree.dll [2007-12-10 1510424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files\BS_Player\tbBS_1.dll [2010-01-25 2166296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]
{ecdee021-0d17-467f-a1ff-c7a115230949} - free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfree.dll [2007-12-10 1510424]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll []
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files\BS_Player\tbBS_1.dll [2010-01-25 2166296]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2004-12-10 49152]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-11-13 8523776]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-11-13 81920]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe [2006-01-06 188416]
"Zboard"=C:\Program Files\Ideazon\ZEngine\Zboard.exe [2006-02-08 32768]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-05-01 843776]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2006-04-10 729088]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2005-12-10 133016]
""= []
"Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-07-01 37888]
"SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe []
"PCSuiteTrayApplication"=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-07 57344]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"NBAgent"=C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-03-26 1234216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-23 32768]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []
"nDVDControl"=C:\Program Files\DNsoft.be\nDVD\nDVDControl.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
ns1.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe"="C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe:*:Enabled:Ultima Online Client"
"C:\Program Files\UOAM\uoam.exe"="C:\Program Files\UOAM\uoam.exe:*:Enabled:Ultima Online's premier mapping tool."
"C:\Program Files\TeamViewer3\TeamViewer.exe"="C:\Program Files\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\TmUnitedForever\TmForever.exe"="C:\Program Files\TmUnitedForever\TmForever.exe:*:Enabled:TmForever"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\UT2004\System\UT2004.exe"="C:\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client2.exe"="C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client2.exe:*:Enabled:Ultima Online Client"
"C:\SERVER\cedserver.exe"="C:\SERVER\cedserver.exe:*:Enabled:cedserver"
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe"="C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7c677f8-01e7-11de-82f7-0018f3ce089f}]
shell\AutoRun\command - L:\AutoTransfer.exe


======List of files/folders created in the last 1 months======

2010-04-21 14:42:53 ----D---- C:\Documents and Settings\Administrator\Data aplikací\NeroDigital(TM)
2010-04-18 14:15:28 ----D---- C:\Program Files\Ask.com
2010-04-18 12:06:52 ----D---- C:\WINDOWS\Prefetch
2010-04-18 11:01:59 ----HDC---- C:\WINDOWS\$NtUninstallKB976325$
2010-04-18 11:01:06 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-04-18 11:00:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-04-18 10:59:24 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-04-18 10:58:35 ----HDC---- C:\WINDOWS\$NtUninstallKB974455$
2010-04-18 10:57:46 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-04-18 10:56:58 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-04-18 10:56:08 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-04-18 10:55:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-04-18 10:54:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-04-18 10:53:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-04-18 10:52:55 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-04-18 10:52:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-04-18 10:51:15 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
2010-04-18 10:50:22 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-04-18 10:49:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-04-18 10:48:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-04-18 10:47:52 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-04-18 10:46:59 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-04-18 10:46:07 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-04-18 10:45:21 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-04-18 10:44:33 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-04-18 10:43:45 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-04-18 10:42:55 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2010-04-18 10:42:04 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-04-18 10:41:11 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-04-18 10:40:16 ----HDC---- C:\WINDOWS\$NtUninstallKB974455_1$
2010-04-18 10:39:23 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
2010-04-18 10:38:33 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-04-18 10:37:40 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2010-04-18 10:36:50 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2010-04-18 10:35:54 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-04-18 10:35:09 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-04-18 10:34:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-04-18 10:33:34 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
2010-04-18 10:32:43 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-04-18 10:31:53 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-04-18 10:31:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2010-04-18 10:30:16 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-04-18 10:29:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-04-18 10:28:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2010-04-18 10:27:43 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-04-18 10:26:54 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2010-04-18 10:26:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-04-18 10:25:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2010-04-18 10:24:37 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-04-18 10:23:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-04-18 10:22:49 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-04-18 10:21:56 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-04-18 10:21:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$
2010-04-18 10:20:19 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-04-18 10:19:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_1$
2010-04-18 10:18:41 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2010-04-18 10:17:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2010-04-18 10:17:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-04-18 10:16:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-04-18 10:15:38 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-04-18 10:14:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-04-18 10:13:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2010-04-18 10:13:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-04-18 10:12:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-04-18 10:11:25 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-04-18 10:10:39 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-04-18 10:09:51 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-04-18 10:09:12 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2010-04-18 10:08:15 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-04-18 10:05:18 ----N---- C:\WINDOWS\system32\smtpapi.dll
2010-04-18 10:05:18 ----N---- C:\WINDOWS\system32\rwnh.dll
2010-04-18 10:05:18 ----N---- C:\WINDOWS\system32\comsdupd.exe
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\azroles.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ati3duag.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2010-04-18 10:05:15 ----N---- C:\WINDOWS\system32\aaclient.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eapsvc.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eapqec.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eappprxy.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eapphost.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eappgnui.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eappcfg.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\eapolqec.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3ui.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3svc.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3msm.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dot3api.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dimsroam.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2010-04-18 10:05:14 ----N---- C:\WINDOWS\system32\credssp.dll
2010-04-18 10:05:13 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2010-04-18 10:05:12 ----N---- C:\WINDOWS\system32\kbdpash.dll
2010-04-18 10:05:12 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2010-04-18 10:05:12 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2010-04-18 10:05:12 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mssha.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mmcperf.exe
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mmcex.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2010-04-18 10:05:11 ----N---- C:\WINDOWS\system32\kmsvc.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\rasqec.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\qutil.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\qcliprov.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\qagentrt.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\qagent.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\onex.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\napstat.exe
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\napmontr.dll
2010-04-18 10:05:10 ----N---- C:\WINDOWS\system32\napipsec.dll
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\slserv.exe
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\slrundll.exe
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\slgen.dll
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\slextspk.dll
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\slcoinst.dll
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\setupn.exe
2010-04-18 10:05:09 ----N---- C:\WINDOWS\system32\s3gnb.dll
2010-04-18 10:05:08 ----N---- C:\WINDOWS\system32\tspkg.dll
2010-04-18 10:05:08 ----N---- C:\WINDOWS\system32\tsgqec.dll
2010-04-18 10:05:07 ----N---- C:\WINDOWS\system32\xmllite.dll
2010-04-18 10:05:07 ----N---- C:\WINDOWS\system32\wlanapi.dll
2010-04-18 10:05:07 ----N---- C:\WINDOWS\slrundll.exe
2010-04-18 10:05:07 ----D---- C:\WINDOWS\system32\cs-cz
2010-04-18 10:05:06 ----D---- C:\WINDOWS\l2schemas
2010-04-18 10:05:05 ----D---- C:\WINDOWS\system32\cs
2010-04-18 10:05:05 ----D---- C:\WINDOWS\system32\bits
2010-04-18 10:01:27 ----D---- C:\WINDOWS\network diagnostic
2010-04-18 09:59:46 ----A---- C:\WINDOWS\002996_.tmp
2010-04-18 09:57:30 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-04-18 02:06:34 ----D---- C:\Program Files\Microsoft.NET
2010-04-18 02:04:52 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-04-18 02:04:38 ----A---- C:\WINDOWS\system32\D3DX9_42.dll

======List of files/folders modified in the last 1 months======

2010-05-10 19:47:30 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-10 17:36:23 ----D---- C:\WINDOWS\Temp
2010-05-10 13:33:39 ----D---- C:\WINDOWS\system32
2010-05-10 13:33:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-05-10 13:32:09 ----D---- C:\WINDOWS
2010-05-10 13:29:39 ----SD---- C:\WINDOWS\Tasks
2010-05-10 07:44:40 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-09 22:14:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google Updater
2010-05-09 11:23:10 ----D---- C:\Program Files\UOAM
2010-05-09 03:53:26 ----SHD---- C:\WINDOWS\Installer
2010-05-09 03:52:59 ----D---- C:\Program Files\Google
2010-05-08 14:12:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\TrackMania
2010-05-08 10:33:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\ICQ
2010-05-03 22:54:27 ----D---- C:\Program Files\rajce
2010-05-01 16:43:12 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Mumble
2010-04-29 11:05:07 ----A---- C:\WINDOWS\wincmd.ini
2010-04-29 10:48:56 ----D---- C:\FILM
2010-04-27 22:47:04 ----A---- C:\WINDOWS\NeroDigital.ini
2010-04-18 14:23:12 ----D---- C:\Program Files\Nero
2010-04-18 14:17:23 ----D---- C:\Program Files\Common Files\Nero
2010-04-18 14:17:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Nero
2010-04-18 14:15:28 ----RD---- C:\Program Files
2010-04-18 13:34:11 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Nero
2010-04-18 12:08:18 ----A---- C:\WINDOWS\OEWABLog.txt
2010-04-18 12:07:16 ----A---- C:\WINDOWS\setuplog.txt
2010-04-18 12:05:57 ----D---- C:\WINDOWS\system32\Setup
2010-04-18 12:05:57 ----D---- C:\WINDOWS\AppPatch
2010-04-18 12:05:56 ----D---- C:\WINDOWS\system32\wbem
2010-04-18 12:05:55 ----RSD---- C:\WINDOWS\Fonts
2010-04-18 12:05:47 ----D---- C:\WINDOWS\system32\drivers
2010-04-18 11:02:16 ----HD---- C:\WINDOWS\inf
2010-04-18 11:02:14 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-18 11:02:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-18 10:52:19 ----D---- C:\Program Files\Outlook Express
2010-04-18 10:13:39 ----D---- C:\WINDOWS\security
2010-04-18 10:10:05 ----D---- C:\Program Files\Messenger
2010-04-18 10:05:25 ----D---- C:\WINDOWS\WinSxS
2010-04-18 10:05:19 ----D---- C:\WINDOWS\ehome
2010-04-18 10:05:17 ----D---- C:\WINDOWS\system32\inetsrv
2010-04-18 10:05:17 ----D---- C:\WINDOWS\ime
2010-04-18 10:05:17 ----D---- C:\WINDOWS\Help
2010-04-18 10:05:06 ----D---- C:\WINDOWS\system32\usmt
2010-04-18 10:05:06 ----D---- C:\Program Files\Internet Explorer
2010-04-18 10:05:05 ----D---- C:\WINDOWS\PeerNet
2010-04-18 10:05:05 ----D---- C:\Program Files\Movie Maker
2010-04-18 10:03:28 ----D---- C:\WINDOWS\ServicePackFiles
2010-04-18 10:03:21 ----D---- C:\WINDOWS\system32\Restore
2010-04-18 10:03:21 ----D---- C:\WINDOWS\system32\npp
2010-04-18 10:03:20 ----D---- C:\WINDOWS\msagent
2010-04-18 10:03:19 ----D---- C:\WINDOWS\srchasst
2010-04-18 10:03:16 ----D---- C:\Program Files\NetMeeting
2010-04-18 10:03:15 ----D---- C:\WINDOWS\system32\Com
2010-04-18 10:03:13 ----D---- C:\Program Files\Windows NT
2010-04-18 10:03:13 ----D---- C:\Program Files\Windows Media Player
2010-04-18 10:03:09 ----D---- C:\Program Files\Common Files\System
2010-04-18 10:02:52 ----D---- C:\WINDOWS\system32\oobe
2010-04-18 10:02:51 ----D---- C:\WINDOWS\system
2010-04-18 09:59:43 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-04-18 09:36:37 ----D---- C:\WINDOWS\Microsoft.NET
2010-04-18 09:36:35 ----RSD---- C:\WINDOWS\assembly
2010-04-18 02:04:51 ----D---- C:\WINDOWS\system32\DirectX
2010-04-18 02:02:11 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-04-18 01:56:46 ----D---- C:\INSTALACE
2010-04-18 00:26:13 ----A---- C:\WINDOWS\Irremote.ini
2010-04-15 17:55:12 ----D---- C:\bwinPoker

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-05-02 229376]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-04-27 93824]
R3 Alpham;Ideazon Merc Composite Keyboard Driver; C:\WINDOWS\system32\DRIVERS\Alpham.sys [2005-12-04 34944]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 Dot4 HPH11;Dot4 HPH11; C:\WINDOWS\system32\DRIVERS\hphid411.sys [2006-01-06 50896]
R3 Dot4Print HPH11;Print Class Driver for IEEE-1284.4 HPH11; C:\WINDOWS\system32\DRIVERS\hphipr11.sys [2006-01-06 16112]
R3 Dot4Storage HPH11;Storage Class Driver for IEEE-1284.4 (HPH11); C:\WINDOWS\System32\Drivers\hphs2k11.sys [2006-01-06 50276]
R3 Dot4Usb HPH11;Dot4Usb HPH11; C:\WINDOWS\System32\drivers\hphius11.sys [2006-01-06 18928]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2009-01-02 223128]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-06-10 25544]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidKE.Sys [2004-12-10 24704]
R3 LHidUsbK;Logitech SetPoint USB Receiver device driver; C:\WINDOWS\System32\Drivers\LHidUsbK.Sys [2004-12-10 36480]
R3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2004-12-10 68992]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-11-13 7429088]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-07-10 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-07-10 20480]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-14 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-14 38912]
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-14 206976]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;Filtr Dot4USB Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 mbr;mbr; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys []
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-14 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-02-15 47360]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 w200bus;Sony Ericsson W200 driver (WDM); C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 61504]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 9328]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 97056]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 88560]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 86368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 NAUpdate;@C:\Program Files\Nero\Update\NASvc.exe,-200; C:\Program Files\Nero\Update\NASvc.exe [2010-03-25 490280]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-11-13 155716]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-01-25 66872]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 Pml Driver HPH11;Pml Driver HPH11; C:\WINDOWS\system32\HPHipm11.exe [2006-01-06 77824]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: Nalezen vir ve VT

Napsal: 10 kvě 2010 19:08
od Rudy
1. Soubor C:\Program Filles\Ventrilo\Ventrilo.exe otestujte online na www.virustotal.com . Výsledek oznamte.
2. Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Re: Nalezen vir ve VT

Napsal: 10 kvě 2010 19:34
od KAREL.CZ
Zasilam log z ComboFix:

ComboFix 10-05-09.08 - Administrator 10.05.2010 20:25:27.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3582.3151 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100510-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-04-10 do 2010-05-10 )))))))))))))))))))))))))))))))
.

2010-05-10 18:14 . 2010-05-10 18:14 390144 ----a-w- c:\windows\system32\CF14246.exe
2010-04-18 12:15 . 2010-04-18 12:15 -------- d-----w- c:\program files\Ask.com
2010-04-18 08:01 . 2008-04-14 06:51 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll
2010-04-18 00:06 . 2010-04-18 00:06 -------- d-----w- c:\program files\Microsoft.NET
2010-04-18 00:04 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-04-18 00:04 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-10 18:21 . 2001-10-25 12:00 82372 ----a-w- c:\windows\system32\perfc005.dat
2010-05-10 18:21 . 2001-10-25 12:00 437558 ----a-w- c:\windows\system32\perfh005.dat
2010-05-09 09:23 . 2009-01-18 01:42 -------- d-----w- c:\program files\UOAM
2010-05-09 01:52 . 2009-01-12 22:42 -------- d-----w- c:\program files\Google
2010-05-03 20:54 . 2009-10-21 19:04 -------- d-----w- c:\program files\rajce
2010-04-18 12:23 . 2009-04-25 10:22 -------- d-----w- c:\program files\Nero
2010-04-18 12:17 . 2009-04-25 10:22 -------- d-----w- c:\program files\Common Files\Nero
2010-04-18 08:06 . 2008-12-23 18:20 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-18 08:06 . 2008-12-23 18:20 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-04-07 07:56 . 2008-12-23 23:20 -------- d-----w- c:\program files\Endor Updater
2010-04-05 10:40 . 2009-02-08 20:46 -------- d-----w- c:\program files\Share Rapid Uploader
2010-04-05 08:42 . 2010-01-16 00:17 -------- d-----w- c:\program files\ParadisePoker
2010-04-02 17:12 . 2010-04-02 17:12 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-01 14:14 . 2010-03-06 12:52 -------- d-----w- c:\program files\ICQ7.0
2010-03-26 19:53 . 2010-03-26 19:30 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-22 07:07 . 2010-03-22 07:06 -------- d-----w- c:\program files\Mumble
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 12:46 1510424 ----a-w- c:\program files\free-downloads.net\tbfree.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
2010-01-25 18:57 2166296 ----a-w- c:\program files\BS_Player\tbBS_1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2008-12-23 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-13 8523776]
"nwiz"="nwiz.exe" [2007-11-13 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-13 81920]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2006-01-06 188416]
"Zboard"="c:\program files\Ideazon\ZEngine\Zboard.exe" [2006-02-08 32768]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-03-26 1234216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ns1.exe [2009-10-30 0]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-12-23 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-23 434176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\EA Games\\Ultima Online Mondain's Legacy\\client.exe"=
"c:\\Program Files\\UOAM\\uoam.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\UT2004\\System\\UT2004.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\EA Games\\Ultima Online Mondain's Legacy\\client2.exe"=
"c:\\SERVER\\cedserver.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [27.2.2009 7:28 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2009 7:28 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [11.7.2009 23:50 246520]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [25.3.2010 14:39 490280]
R3 Alpham;Ideazon Merc Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [4.12.2005 14:55 34944]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.12.2008 14:47 721904]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.1.2010 18:35 135664]
.
Obsah adresáře 'Naplánované úlohy'

2010-05-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-12 00:33]

2010-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:35]

2010-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:35]

2010-05-10 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 14:50]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\bj17soe4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://cs.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:cs:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKCU-Run-nDVDControl - c:\program files\DNsoft.be\nDVD\nDVDControl.exe
HKLM-Run-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-10 20:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):94,0c,e1,ec,00,0b,62,9a,00,b4,b0,c5,53,52,11,b5,02,89,51,48,7a,
46,7e,9c,f4,cc,ca,4f,3e,90,1b,56,8a,59,5f,e3,00,69,9c,61,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):d4,b2,db,d4,1c,d1,80,32,7b,b4,11,b9,0e,92,ab,7a,60,51,f2,c0,94,
8f,4c,63,d5,0f,1b,42,c1,cc,c8,4a,c9,8a,d0,af,7c,23,8d,37,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{92622b8d-c9d1-4a1e-8fe9-1c1aa99c7f6d}]
@Denied: (Full) (Everyone)
"Model"=dword:00000045
"Therad"=dword:00000019

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d220f9a4-a535-49b4-aeeb-b8c614de33ca}]
@Denied: (Full) (Everyone)
"Model"=dword:00000073
"Therad"=dword:0000000f
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,a5,9a,90,a0,4e,17,2f,5a,2a,92,b9,42,36,24,\
.
Celkový čas: 2010-05-10 20:32:06
ComboFix-quarantined-files.txt 2010-05-10 18:31

Před spuštěním: Volných bajtů: 52 575 436 800
Po spuštění: Volných bajtů: 57 602 723 840

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
;
;Warning: Boot.ini is used on Windows XP and earlier operating systems.
;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.
;
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT

- - End Of File - - 2F414D3598B90B692A6118356B38B2BF

Re: Nalezen vir ve VT

Napsal: 10 kvě 2010 19:56
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Jak dopadla kontrola toho souboru?

Re: Nalezen vir ve VT

Napsal: 10 kvě 2010 20:17
od KAREL.CZ
Provedeno dalsi log:

ComboFix 10-05-10.01 - Administrator 10.05.2010 21:10:27.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3582.3103 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100510-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-10 do 2010-05-10 )))))))))))))))))))))))))))))))
.

2010-05-10 18:14 . 2010-05-10 18:14 390144 ----a-w- c:\windows\system32\CF14246.exe
2010-04-18 08:01 . 2008-04-14 06:51 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll
2010-04-18 00:06 . 2010-04-18 00:06 -------- d-----w- c:\program files\Microsoft.NET
2010-04-18 00:04 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-04-18 00:04 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-10 18:33 . 2001-10-25 12:00 82372 ----a-w- c:\windows\system32\perfc005.dat
2010-05-10 18:33 . 2001-10-25 12:00 437558 ----a-w- c:\windows\system32\perfh005.dat
2010-05-09 09:23 . 2009-01-18 01:42 -------- d-----w- c:\program files\UOAM
2010-05-09 01:52 . 2009-01-12 22:42 -------- d-----w- c:\program files\Google
2010-05-03 20:54 . 2009-10-21 19:04 -------- d-----w- c:\program files\rajce
2010-04-18 12:23 . 2009-04-25 10:22 -------- d-----w- c:\program files\Nero
2010-04-18 12:17 . 2009-04-25 10:22 -------- d-----w- c:\program files\Common Files\Nero
2010-04-18 08:06 . 2008-12-23 18:20 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-18 08:06 . 2008-12-23 18:20 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-04-07 07:56 . 2008-12-23 23:20 -------- d-----w- c:\program files\Endor Updater
2010-04-05 10:40 . 2009-02-08 20:46 -------- d-----w- c:\program files\Share Rapid Uploader
2010-04-05 08:42 . 2010-01-16 00:17 -------- d-----w- c:\program files\ParadisePoker
2010-04-02 17:12 . 2010-04-02 17:12 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-01 14:14 . 2010-03-06 12:52 -------- d-----w- c:\program files\ICQ7.0
2010-03-26 19:53 . 2010-03-26 19:30 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-22 07:07 . 2010-03-22 07:06 -------- d-----w- c:\program files\Mumble
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-10 12:46 1510424 ----a-w- c:\program files\free-downloads.net\tbfree.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
2010-01-25 18:57 2166296 ----a-w- c:\program files\BS_Player\tbBS_1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2007-12-10 1510424]
"{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_1.dll" [2010-01-25 2166296]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2008-12-23 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-13 8523776]
"nwiz"="nwiz.exe" [2007-11-13 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-13 81920]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2006-01-06 188416]
"Zboard"="c:\program files\Ideazon\ZEngine\Zboard.exe" [2006-02-08 32768]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-03-26 1234216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ns1.exe [2009-10-30 0]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-12-23 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-23 434176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\EA Games\\Ultima Online Mondain's Legacy\\client.exe"=
"c:\\Program Files\\UOAM\\uoam.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\UT2004\\System\\UT2004.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\EA Games\\Ultima Online Mondain's Legacy\\client2.exe"=
"c:\\SERVER\\cedserver.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [27.2.2009 7:28 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2009 7:28 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [11.7.2009 23:50 246520]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [25.3.2010 14:39 490280]
R3 Alpham;Ideazon Merc Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [4.12.2005 14:55 34944]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.12.2008 14:47 721904]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.1.2010 18:35 135664]
.
Obsah adresáře 'Naplánované úlohy'

2010-05-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-12 00:33]

2010-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:35]

2010-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:35]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\bj17soe4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://cs.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:cs:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):94,0c,e1,ec,00,0b,62,9a,00,b4,b0,c5,53,52,11,b5,02,89,51,48,7a,
46,7e,9c,f4,cc,ca,4f,3e,90,1b,56,8a,59,5f,e3,00,69,9c,61,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):d4,b2,db,d4,1c,d1,80,32,7b,b4,11,b9,0e,92,ab,7a,60,51,f2,c0,94,
8f,4c,63,d5,0f,1b,42,c1,cc,c8,4a,c9,8a,d0,af,7c,23,8d,37,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{92622b8d-c9d1-4a1e-8fe9-1c1aa99c7f6d}]
@Denied: (Full) (Everyone)
"Model"=dword:00000045
"Therad"=dword:00000019

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d220f9a4-a535-49b4-aeeb-b8c614de33ca}]
@Denied: (Full) (Everyone)
"Model"=dword:00000073
"Therad"=dword:0000000f
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,a5,9a,90,a0,4e,17,2f,5a,2a,92,b9,42,36,24,\
.
Celkový čas: 2010-05-10 21:15:19
ComboFix-quarantined-files.txt 2010-05-10 19:15
ComboFix2.txt 2010-05-10 18:32

Před spuštěním: Volných bajtů: 57 606 139 904
Po spuštění: Volných bajtů: 57 592 504 320

- - End Of File - - 3EC4F0012F9DFB74A72425F2D8726895

Re: Nalezen vir ve VT

Napsal: 10 kvě 2010 21:23
od Rudy
Log již vypadá čistý. Podruhé pokládám stejnou otázku:
Jak dopadla kontrola toho souboru?

Re: Nalezen vir ve VT

Napsal: 11 kvě 2010 05:37
od KAREL.CZ
Omlouvam se nejak jsem to prehlid.Tu je ten vysledek:

Soubor Ventrilo.exe přijatý 2010.05.11 04:30:04 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 1/41 (2.44%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: 3.
Odhadovaný čas začátku mezi 61 a 87 sekundami.
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.11.00 2010.05.10 -
AntiVir 8.2.1.236 2010.05.10 -
Antiy-AVL 2.0.3.7 2010.05.10 -
Authentium 5.2.0.5 2010.05.11 -
Avast 4.8.1351.0 2010.05.10 -
Avast5 5.0.332.0 2010.05.10 -
AVG 9.0.0.787 2010.05.11 -
BitDefender 7.2 2010.05.11 -
CAT-QuickHeal 10.00 2010.05.11 -
ClamAV 0.96.0.3-git 2010.05.11 -
Comodo 4821 2010.05.11 -
DrWeb 5.0.2.03300 2010.05.11 -
eSafe 7.0.17.0 2010.05.10 Win32.MaliciousSoftw
eTrust-Vet 35.2.7478 2010.05.10 -
F-Prot 4.5.1.85 2010.05.10 -
F-Secure 9.0.15370.0 2010.05.11 -
Fortinet 4.1.133.0 2010.05.10 -
GData 21 2010.05.11 -
Ikarus T3.1.1.84.0 2010.05.11 -
Jiangmin 13.0.900 2010.05.10 -
Kaspersky 7.0.0.125 2010.05.11 -
McAfee 5.400.0.1158 2010.05.11 -
McAfee-GW-Edition 2010.1 2010.05.10 -
Microsoft 1.5703 2010.05.11 -
NOD32 5103 2010.05.10 -
Norman 6.04.12 2010.05.10 -
nProtect 2010-05-10.01 2010.05.10 -
Panda 10.0.2.7 2010.05.10 -
PCTools 7.0.3.5 2010.05.11 -
Prevx 3.0 2010.05.11 -
Rising 22.47.01.01 2010.05.11 -
Sophos 4.53.0 2010.05.11 -
Sunbelt 6289 2010.05.11 -
Symantec 20101.1.0.89 2010.05.11 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.11 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.11 -
VBA32 3.12.12.4 2010.05.06 -
ViRobot 2010.5.10.2308 2010.05.10 -
VirusBuster 5.0.27.0 2010.05.10 -
Rozšiřující informace
File size: 561152 bytes
MD5...: 97405fadf71d69416ffa81d111d9f456
SHA1..: c1b4282d2e2911a976c1535919abbe5d1bac0793
SHA256: 3daaa3e37109d2a7052ee3375552dbeafe34e05d7d69f1a931c45cffdfab005c
ssdeep: 6144:6HuZtuWIlx815RFmu9MNbjiw64U5DoJhmHWlDYTHWCgAAlLEuYXPzgeBRvz
+jxlz:6OvqxIj9wPyDe0WlDAWfAAlL1YXzJe
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3efa0
timedatestamp.....: 0x3fe763cd (Mon Dec 22 21:36:13 2003)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x60e5a 0x61000 6.53 8df752ae8ac34bda089f1384b30b0e91
.rdata 0x62000 0x12ba2 0x13000 4.81 8e2bc9c941c81f8d335551353bfc3fed
.data 0x75000 0xe808 0xb000 4.57 bbf5a92cf068161d8b42ee995416f346
.rsrc 0x84000 0x81c8 0x9000 3.49 3e44b195641631a12337eab461424e8d

( 17 imports )
> WINMM.dll: waveInGetNumDevs, waveInGetDevCapsA, waveOutGetNumDevs, mixerGetNumDevs, waveOutPrepareHeader, waveInStop, waveOutGetDevCapsA, waveInUnprepareHeader, waveOutUnprepareHeader, mixerGetDevCapsA, waveOutClose, waveOutWrite, waveInAddBuffer, waveOutOpen, waveInStart, waveInOpen, waveInClose, waveInReset, mixerGetLineControlsA, waveInPrepareHeader, mixerGetLineInfoA, mixerClose, mixerGetControlDetailsA, mixerSetControlDetails, mixerOpen
> MSACM32.dll: acmStreamClose, acmDriverDetailsA, acmFormatSuggest, acmStreamOpen, acmFormatEnumA, acmDriverClose, acmMetrics, acmDriverOpen, acmStreamUnprepareHeader, acmStreamConvert, acmDriverEnum, acmStreamPrepareHeader
> WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> DINPUT.dll: DirectInputCreateA
> DSOUND.dll: -, -
> KERNEL32.dll: GetFileSize, GetFileTime, GetFileAttributesA, lstrcpynA, CreateFileA, lstrcmpA, ReadFile, WriteFile, SuspendThread, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, DeleteFileA, DuplicateHandle, SetFilePointer, GetThreadLocale, GlobalFlags, SizeofResource, LocalAlloc, InitializeCriticalSection, TlsAlloc, GlobalHandle, TlsFree, LeaveCriticalSection, GlobalReAlloc, EnterCriticalSection, TlsSetValue, LocalReAlloc, TlsGetValue, GetProcessVersion, GetCPInfo, GetOEMCP, WritePrivateProfileStringA, DeleteCriticalSection, FileTimeToSystemTime, FileTimeToLocalFileTime, FindResourceExA, RtlUnwind, GetTimeZoneInformation, GetSystemTime, HeapFree, ExitProcess, TerminateProcess, HeapReAlloc, FormatMessageA, ResumeThread, RaiseException, CreateThread, ExitThread, HeapSize, GetACP, LCMapStringA, LCMapStringW, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetProcAddress, FreeLibrary, GetUserDefaultLangID, lstrlenW, WideCharToMultiByte, GetCommandLineA, lstrcatA, lstrlenA, WinExec, lstrcpyA, GetModuleFileNameA, GetLocalTime, GetLastError, GetVersionExA, WaitForSingleObject, ReleaseMutex, SetEvent, Sleep, CloseHandle, CreateEventA, CreateMutexA, FindFirstFileA, FindNextFileA, FindClose, InterlockedExchange, GetProfileStringA, CreateDirectoryA, SetLastError, InterlockedIncrement, LocalFree, InterlockedDecrement, GetCurrentThreadId, LoadLibraryA, GetVersion, GlobalAddAtomA, GlobalGetAtomNameA, lstrcmpiA, LockResource, GlobalFindAtomA, GlobalDeleteAtom, WaitForMultipleObjects, FindResourceA, LoadResource, GetModuleHandleA, ResetEvent, GlobalFree, SetPriorityClass, MulDiv, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, SetThreadPriority, CreateProcessA, MultiByteToWideChar, GetTickCount, GlobalUnlock, GlobalAlloc, GlobalLock, HeapAlloc, LoadLibraryW, GetStartupInfoA, GetVolumeInformationA, GetFullPathNameA, SetErrorMode
> USER32.dll: ReleaseDC, GetDC, ClientToScreen, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, DestroyMenu, ValidateRect, TranslateMessage, GetMessageA, SetCursor, SetWindowContextHelpId, MapDialogRect, InflateRect, WindowFromPoint, LoadStringA, CharUpperA, GetClassNameA, PtInRect, LoadCursorA, GetSysColorBrush, InvalidateRect, CharNextA, CopyAcceleratorTableA, GetNextDlgGroupItem, RegisterClipboardFormatA, MoveWindow, ShowWindow, PostThreadMessageA, CheckDlgButton, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, SetMenuItemBitmaps, UpdateWindow, SendDlgItemMessageA, MapWindowPoints, GetSysColor, PeekMessageA, DispatchMessageA, SetFocus, AdjustWindowRectEx, IsWindowVisible, GetCapture, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetMenuItemID, TrackPopupMenu, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, DefWindowProcA, CreateWindowExA, GetClassLongA, SetPropA, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, GetWindow, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, OffsetRect, SystemParametersInfoA, GetWindowPlacement, GetNextDlgTabItem, EndDialog, GetActiveWindow, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, DestroyWindow, GetWindowLongA, GetDlgItem, IsWindowEnabled, GetParent, GetFocus, CheckMenuItem, SetForegroundWindow, LoadMenuA, GetSubMenu, EnableMenuItem, ModifyMenuA, DrawIcon, OpenClipboard, EmptyClipboard, CloseClipboard, SetClipboardData, ScreenToClient, PostQuitMessage, GetDesktopWindow, IntersectRect, UnregisterHotKey, RegisterHotKey, CallNextHookEx, GetKeyState, KillTimer, SetTimer, GetAsyncKeyState, UnhookWindowsHookEx, SetWindowsHookExA, PostMessageA, IsIconic, CopyRect, GetSystemMetrics, MessageBeep, CreatePopupMenu, AppendMenuA, GetCursorPos, IsRectEmpty, GetClientRect, GetWindowRect, LoadIconA, SetRect, SendMessageA, EnableWindow, SetWindowTextA, IsDialogMessageA, MessageBoxA, IsChild, keybd_event, BringWindowToTop, GetTopWindow, ExcludeUpdateRgn, IsWindowUnicode, DefDlgProcA, DrawFocusRect, ShowCaret, UnregisterClassA, HideCaret
> GDI32.dll: IntersectClipRect, SetWindowExtEx, ScaleWindowExtEx, GetTextExtentPointA, SaveDC, DeleteObject, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetBkMode, GetStockObject, SelectObject, RestoreDC, DeleteDC, PatBlt, CreateBitmap, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateDIBitmap, BitBlt, CreateCompatibleDC, GetDeviceCaps, GetWindowExtEx, CreateSolidBrush, PtVisible, RectVisible, ExtTextOutA, Escape, TextOutA, GetMapMode, DPtoLP, GetTextColor, LPtoDP, EnumFontFamiliesExA, GetBkColor, GetViewportExtEx
> comdlg32.dll: GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA
> WINSPOOL.DRV: OpenPrinterA, ClosePrinter, DocumentPropertiesA
> ADVAPI32.dll: RegCloseKey, RegQueryValueA, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA
> SHELL32.dll: Shell_NotifyIconA, ShellExecuteA, SHGetSpecialFolderPathA
> COMCTL32.dll: DestroyPropertySheetPage, PropertySheetA, ImageList_ReplaceIcon, -, ImageList_Destroy, ImageList_Create, CreatePropertySheetPageA
> oledlg.dll: -
> ole32.dll: CoRegisterMessageFilter, OleFlushClipboard, CoRevokeClassObject, OleInitialize, CoTaskMemAlloc, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoCreateInstance, CoTaskMemFree, CoInitializeEx, OleIsCurrentClipboard, CoFreeUnusedLibraries, OleUninitialize
> OLEPRO32.DLL: -
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
sigcheck:
publisher....:
copyright....: Copyright (C) 1999-2003 Flagship Industries, Inc.
product......: Ventrilo Application
description..: Ventrilo by Flagship Industries, Inc.
original name: Ventrilo.EXE
internal name: Ventrilo
file version.: 2, 1, 4, 0
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned

Re: Nalezen vir ve VT

Napsal: 11 kvě 2010 18:00
od Rudy
Světové antiviry mlčí, pouze eSafe ho označil jako zákeřný. Jelikož tento antivir je mírně řečeno podprůměrný, vypadá to spíše na falešnou detekci Avastu (někdy se mu to stává). Vyčkejte nové aktualizace a pokud se situace nezmění, informujte společnost Avast.

Re: Nalezen vir ve VT

Napsal: 12 kvě 2010 17:40
od KAREL.CZ
VT jde uz postit normalne dekuji za rady.

Re: Nalezen vir ve VT

Napsal: 12 kvě 2010 18:03
od Rudy
Nemáte zač!
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz