Kontrola logu

Zpráva

srbino · #1 Příspěvek od **srbino** » 25 kvě 2010 19:13

Dobrý den, prosím o kontrolu logu, děkuji

Logfile of random's system information tool 1.07 (written by random/random)
Run by Bartman at 2010-05-25 20:11:29
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 25 GB (16%) free of 153 GB
Total RAM: 2559 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:11:41, on 25.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Bartman\Local Settings\Temporary Internet Files\Content.IE5\Q3EIYNJO\RSIT[1].exe
C:\Program Files\trend micro\Bartman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: GIGABYTE Gamer HUD.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rychlé spuštění aplikace HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Faces of War Drivers Auto Removal (pr2akrnb) (pr2akrnb) - Cenega Czech - C:\WINDOWS\system32\pr2akrnb.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7666 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\User_Feed_Synchronization-{C125B866-6152-48BB-9720-4C62DB57C12C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-16 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-16 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-07-09 1657376]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-07-14 13877248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-07-14 86016]
"NokiaMusic FastStart"=C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe [2009-11-06 2090272]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2004-05-12 241664]
"BDRegion"=C:\Program Files\Cyberlink\Shared files\brs.exe [2009-11-19 75048]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-05-06 2815192]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Rychlé spuštění aplikace HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\Bartman\Nabídka Start\Programy\Po spuštění
GIGABYTE Gamer HUD.lnk - C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\HUD.exe1_1A3210EE749448799270A721ED7F9947.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2010-01-14 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2010-01-14 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2010-01-14 304128]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoResolveSearch"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe:*:Enabled:Sacred 2 Game Server"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2"
"C:\Program Files\InterVideo\DVD8\WinDVD.exe"="C:\Program Files\InterVideo\DVD8\WinDVD.exe:*:Disabled:WinDVD"
"C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe"="C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe:*:Enabled:Nokia Ovi Suite 2"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\base\bin\Settlers6.exe"="C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\base\bin\Settlers6.exe:*:Enabled:THE SETTLERS - Vzestup říše"
"C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\extra1\bin\Settlers6.exe"="C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\extra1\bin\Settlers6.exe:*:Enabled:THE SETTLERS - Vzestup říše - Východní království"
"C:\Program Files\Microsoft Games\Motocross Madness 2\MCM2.EXE"="C:\Program Files\Microsoft Games\Motocross Madness 2\MCM2.EXE:*:Disabled:Microsoft® Motocross Madness 2"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"
"C:\Program Files\Codemasters\GRID\GRID.exe"="C:\Program Files\Codemasters\GRID\GRID.exe:*:Disabled:GRID Executable"
"C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe"="C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe:*:Disabled:Anno4Web"
"C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\AddonWeb.exe"="C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\AddonWeb.exe:*:Disabled:AddonWeb"
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe"="C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"

======List of files/folders created in the last 1 months======

2010-05-22 10:56:17 ----D---- C:\Program Files\Arkanoid 2
2010-05-22 10:52:11 ----A---- C:\WINDOWS\spidla.INI
2010-05-22 09:56:04 ----D---- C:\Program Files\City Life Deluxe
2010-05-19 19:35:03 ----D---- C:\Documents and Settings\Bartman\Data aplikací\Boolat Games
2010-05-19 19:34:31 ----D---- C:\Program Files\Restaurace U Amálky
2010-05-19 13:20:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\IObit
2010-05-18 20:05:20 ----D---- C:\Documents and Settings\Bartman\Data aplikací\FashionCrazeChech
2010-05-18 20:04:03 ----D---- C:\Program Files\Módní salón
2010-05-17 19:16:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Aliasworlds
2010-05-17 19:15:48 ----D---- C:\Program Files\Restaurace Medvěda Míši
2010-05-16 21:37:23 ----D---- C:\Documents and Settings\Bartman\Data aplikací\Meridian93
2010-05-16 21:37:12 ----D---- C:\Program Files\Kouzelná farma
2010-05-16 18:37:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-05-16 18:37:29 ----D---- C:\Program Files\Common Files\Java
2010-05-16 18:37:12 ----A---- C:\WINDOWS\system32\javaws.exe
2010-05-16 18:37:12 ----A---- C:\WINDOWS\system32\javaw.exe
2010-05-16 18:37:12 ----A---- C:\WINDOWS\system32\java.exe
2010-05-16 18:37:12 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-05-16 18:36:57 ----D---- C:\Program Files\Java
2010-05-16 18:36:40 ----D---- C:\Documents and Settings\Bartman\Data aplikací\Sun
2010-05-16 15:24:34 ----D---- C:\Program Files\NCSoft
2010-05-16 15:13:10 ----D---- C:\Documents and Settings\Bartman\Data aplikací\GetRightToGo
2010-05-16 09:35:18 ----D---- C:\Program Files\Firefly Studios
2010-05-14 21:00:04 ----D---- C:\Temp
2010-05-14 20:59:52 ----A---- C:\WINDOWS\system32\wmvdmoe.dll
2010-05-14 20:59:52 ----A---- C:\WINDOWS\system32\wmv8dmoe.dll
2010-05-14 20:59:52 ----A---- C:\WINDOWS\system32\wmv8dmod.dll
2010-05-14 20:59:51 ----A---- C:\WINDOWS\system32\wmvcore2.dll
2010-05-14 20:58:26 ----D---- C:\Program Files\coolpro2
2010-05-13 12:51:38 ----D---- C:\Documents and Settings\Bartman\Data aplikací\InstallShield
2010-05-12 10:58:13 ----D---- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO
2010-05-12 10:58:11 ----D---- C:\Program Files\Webteh
2010-05-12 07:52:20 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-05-01 20:45:24 ----D---- C:\Program Files\GamePark
2010-04-30 16:32:04 ----D---- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Pro
2010-04-30 16:32:04 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Pro
2010-04-27 17:41:40 ----D---- C:\Program Files\RoboBlitz

======List of files/folders modified in the last 1 months======

2010-05-25 20:11:34 ----D---- C:\WINDOWS\Prefetch
2010-05-25 20:11:31 ----D---- C:\Program Files\trend micro
2010-05-25 20:07:51 ----D---- C:\Documents and Settings\Bartman\Data aplikací\uTorrent
2010-05-25 17:49:33 ----D---- C:\WINDOWS\temp
2010-05-25 17:45:46 ----D---- C:\WINDOWS
2010-05-25 11:25:42 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-24 22:26:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-22 15:41:00 ----D---- C:\Documents and Settings\Bartman\Data aplikací\Skype
2010-05-22 15:40:34 ----D---- C:\Documents and Settings\Bartman\Data aplikací\skypePM
2010-05-22 10:56:17 ----RD---- C:\Program Files
2010-05-21 16:39:53 ----A---- C:\WINDOWS\NeroDigital.ini
2010-05-19 13:22:45 ----SHD---- C:\WINDOWS\Installer
2010-05-19 13:22:45 ----D---- C:\Config.Msi
2010-05-16 21:50:26 ----D---- C:\Program Files\Kalypso
2010-05-16 18:37:29 ----D---- C:\Program Files\Common Files
2010-05-16 18:37:12 ----D---- C:\WINDOWS\system32
2010-05-16 15:24:34 ----HD---- C:\Program Files\InstallShield Installation Information
2010-05-16 09:38:35 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-05-15 15:34:41 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-05-15 14:42:51 ----D---- C:\Documents and Settings\Bartman\Data aplikací\Tropico 3
2010-05-15 14:24:03 ----HD---- C:\WINDOWS\inf
2010-05-15 14:23:31 ----RSD---- C:\WINDOWS\assembly
2010-05-15 14:22:54 ----D---- C:\WINDOWS\system32\DirectX
2010-05-15 12:48:02 ----D---- C:\WINDOWS\Debug
2010-05-15 11:33:12 ----D---- C:\Program Files\uTorrent
2010-05-14 21:00:04 ----A---- C:\WINDOWS\win.ini
2010-05-14 21:00:04 ----A---- C:\WINDOWS\system.ini
2010-05-14 14:09:57 ----D---- C:\Program Files\Activision
2010-05-13 12:52:13 ----D---- C:\Program Files\Ubisoft
2010-05-12 09:29:16 ----D---- C:\Program Files\The KMPlayer
2010-05-12 08:48:07 ----A---- C:\WINDOWS\AviSplitter.INI
2010-05-12 08:00:23 ----D---- C:\Program Files\Outlook Express
2010-05-12 07:52:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-05-12 07:52:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-12 07:52:19 ----HD---- C:\WINDOWS\$hf_mig$
2010-05-06 22:59:36 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-04-30 20:51:06 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-27 17:14:48 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-05-06 28880]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-05-06 164048]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-05-06 46672]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/04/07 10:36:19]; \??\C:\Program Files\CyberLink\PowerDVD9\000.fcl []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-05-06 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-05-06 100432]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-02-27 281760]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2010-02-27 25888]
R2 rspndr;Odpovídající zařízení zjišťování topologie linkové vrstvy; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2010-01-14 62848]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-05-06 23376]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2010-01-14 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-14 7741664]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2010-01-14 32384]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2010-01-14 30464]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2010-01-14 17152]
S1 DumpDrv;Crash Dump Driver; C:\WINDOWS\system32\drivers\DumpDrv.sys [2010-01-14 9472]
S3 aobmvudr;aobmvudr; C:\WINDOWS\system32\drivers\aobmvudr.sys []
S3 aypy85mi;aypy85mi; C:\WINDOWS\system32\drivers\aypy85mi.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\Bartman\LOCALS~1\Temp\catchme.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-21 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-21 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-06-21 21744]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2010-01-14 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2010-01-14 82944]
S4 exFat;exFat; C:\WINDOWS\system32\drivers\exFat.sys [2010-01-14 133632]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 SR;Ovladač filtru Obnovy systému; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73344]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-05-16 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-07-14 168004]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-03-06 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-05-15 214520]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
S2 pr2akrnb;Faces of War Drivers Auto Removal (pr2akrnb); C:\WINDOWS\system32\pr2akrnb.exe [2007-04-19 407168]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2010-01-14 913920]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 26 kvě 2010 13:07

Zdravím

Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.

Obrázek

Doporučuji odinstalovat:
C:\Program Files\uTorrent\uTorrent.exe

P2P sítě a jejich klienti jsou potenciálním bezpečnostním rizikem, prakticky neustále jsou zdrojem virů, zbytečně se vystavujete riziku.

Obrázek

Stáhněte T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
Po použití program vymažte. Pozor, antiviry ho mohou falešně označit za vir.

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

Spusťte.
Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít

V logu nevidím firewall, doinstalujte

Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

Obrázek

Jsou s PC nějaké problémy

srbino · #3 Příspěvek od **srbino** » 26 kvě 2010 14:21

ano, někdy ho musím restartovat protože se všechno seká a je zpomalený (Načítání stránek v exploreru atd...) Jinak c-cleaner mám, a čistím pořád. A firewall mám zapnutý ten klasický (windows) mimochodem mám i v avastu zaplé všechny štíty apod. Taky jsem teď čistil počítač hned po restartu avastem. Zkontroloval celí program files. Trvalo to asi dvě hodiny, potom ho začal kontrolovat zase od začátku. Vypl jsem ho, nechtěl jsem čekat.

#4 Příspěvek od **Caroprd111** » 26 kvě 2010 15:46

Firewall ve Windows je nedostatečný, doporučuji doinstalovat jiný.

Obrázek

Stáhněte OTL http://oldtimer.geekstogo.com/OTL.exe na plochu

Spusťte, poté do spodního políčka vložte následující skript.

Kód: Vybrat vše

 netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys 
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys 
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys 
cdrom.sys 
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav 
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

Označte položku Pro všechny uživatele.
Označte položky Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Klikněte na tlačítko Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

srbino · #5 Příspěvek od **srbino** » 26 kvě 2010 17:12

OTL logfile created on: 26.5.2010 17:55:17 - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\Bartman\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 25,60 Gb Free Space | 17,18% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SIMPSON-AMD3000
Current User Name: Bartman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.05.26 17:54:51 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bartman\Plocha\OTL.exe
PRC - [2010.05.06 22:59:42 | 002,815,192 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010.01.14 17:06:59 | 000,123,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe
PRC - [2010.01.14 17:00:04 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009.11.19 18:41:24 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files\CyberLink\Shared Files\brs.exe
PRC - [2008.04.10 22:12:00 | 001,907,712 | ---- | M] () -- C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe
PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2004.11.15 12:20:20 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

========== Modules (SafeList) ==========

MOD - [2010.05.26 17:54:51 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bartman\Plocha\OTL.exe
MOD - [2010.01.14 16:58:14 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5705_x-ww_36cfed49\comctl32.dll
MOD - [2008.04.14 13:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010.01.26 13:41:08 | 000,652,800 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2009.05.15 08:35:52 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008.07.29 20:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007.04.19 17:04:32 | 000,407,168 | ---- | M] (Cenega Czech) [Auto | Stopped] -- C:\WINDOWS\System32\pr2akrnb.exe -- (pr2akrnb) Faces of War Drivers Auto Removal (pr2akrnb)
SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2005.11.14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004.03.18 17:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - [2010.05.06 22:39:23 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010.05.06 22:39:00 | 000,164,048 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2010.05.06 22:34:27 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010.05.06 22:33:59 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010.05.06 22:33:47 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.05.06 22:33:29 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010.04.13 13:00:46 | 000,685,816 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.02.27 19:12:04 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.02.27 19:12:04 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.01.21 15:53:16 | 000,018,048 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010.01.14 17:04:10 | 000,009,472 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\dumpdrv.sys -- (DumpDrv)
DRV - [2009.12.30 12:30:56 | 000,007,936 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009.12.30 12:30:48 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009.12.30 12:30:48 | 000,007,936 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2009.07.14 20:54:00 | 007,741,664 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009.02.28 19:40:18 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/04/07 10:36:19] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD})
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.04.14 01:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.04.19 17:04:04 | 000,064,896 | ---- | M] (Cenega Czech) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\pe3akrnb.sys -- (pe3akrnb) Faces of War Environment Driver (pe3akrnb)
DRV - [2007.04.19 17:03:39 | 000,053,128 | ---- | M] (Cenega Czech) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\ps6akrnb.sys -- (ps6akrnb) Faces of War Synchronization Driver (ps6akrnb)
DRV - [2005.05.17 11:45:08 | 000,092,800 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005.04.05 21:22:30 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2005.04.05 21:22:28 | 000,033,536 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005.03.09 16:53:00 | 000,042,496 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004.11.17 13:05:38 | 002,297,664 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004.08.13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2001.08.17 23:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.cz/
IE - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 E5 54 FB 58 B5 CA 01 [binary data]
IE - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.03.12 19:02:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.03.12 19:02:29 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [NokiaMusic FastStart] C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe (Nokia)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Bartman\Nabídka Start\Programy\Po spuštění\GIGABYTE Gamer HUD.lnk = C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\HUD.exe1_1A3210EE749448799270A721ED7F9947.exe (Macrovision Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.47.0.254 10.0.0.3 10.0.0.2
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Bartman\Dokumenty\Obrázky\sacred 2 dryáda.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bartman\Dokumenty\Obrázky\sacred 2 dryáda.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010.02.24 15:11:28 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - C:\WINDOWS\System32\ffdshow.ax ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2010.05.26 17:54:51 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bartman\Plocha\OTL.exe
[2010.05.26 14:51:14 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Bartman\Recent
[2010.05.22 10:56:17 | 000,000,000 | ---D | C] -- C:\Program Files\Arkanoid 2
[2010.05.22 09:56:04 | 000,000,000 | ---D | C] -- C:\Program Files\City Life Deluxe
[2010.05.19 19:35:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\Boolat Games
[2010.05.19 19:34:31 | 000,000,000 | ---D | C] -- C:\Program Files\Restaurace U Amálky
[2010.05.19 13:20:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\IObit
[2010.05.18 20:05:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\FashionCrazeChech
[2010.05.18 20:04:03 | 000,000,000 | ---D | C] -- C:\Program Files\Módní salón
[2010.05.17 19:16:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Aliasworlds
[2010.05.17 19:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\Restaurace Medvěda Míši
[2010.05.16 21:37:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\Meridian93
[2010.05.16 21:37:12 | 000,000,000 | ---D | C] -- C:\Program Files\Kouzelná farma
[2010.05.16 18:37:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Sun
[2010.05.16 18:37:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.05.16 18:37:12 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010.05.16 18:37:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.05.16 18:37:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.05.16 18:37:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.05.16 18:37:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.05.16 18:36:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010.05.16 18:36:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\Sun
[2010.05.16 15:24:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Local Settings\Data aplikací\assembly
[2010.05.16 15:24:34 | 000,000,000 | ---D | C] -- C:\Program Files\NCSoft
[2010.05.16 15:13:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\GetRightToGo
[2010.05.16 12:48:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Dokumenty\Stronghold Crusader
[2010.05.16 09:35:18 | 000,000,000 | ---D | C] -- C:\Program Files\Firefly Studios
[2010.05.14 21:00:04 | 000,000,000 | ---D | C] -- C:\Temp
[2010.05.14 20:59:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Application Data
[2010.05.14 20:59:52 | 000,665,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmv8dmoe.dll
[2010.05.14 20:59:52 | 000,572,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmvdmoe.dll
[2010.05.14 20:59:52 | 000,438,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmv8dmod.dll
[2010.05.14 20:59:51 | 001,683,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmvcore2.dll
[2010.05.14 20:59:51 | 000,285,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmidx2.ocx
[2010.05.14 20:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\coolpro2
[2010.05.13 13:10:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Dokumenty\BlazingAngels2
[2010.05.13 12:51:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\InstallShield
[2010.05.12 10:58:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO
[2010.05.12 10:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\Webteh
[2010.05.01 20:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\GamePark
[2010.04.30 16:32:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Pro
[2010.04.30 16:32:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Pro
[2010.04.27 17:41:40 | 000,000,000 | ---D | C] -- C:\Program Files\RoboBlitz
[2010.04.26 21:19:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bartman\Dokumenty\Music
[2004.11.24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll

========== Files - Modified Within 30 Days ==========

[2010.05.26 17:54:51 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bartman\Plocha\OTL.exe
[2010.05.26 17:52:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.26 17:52:33 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.26 17:51:55 | 000,002,461 | ---- | M] () -- C:\Documents and Settings\Bartman\Nabídka Start\Programy\Po spuštění\GIGABYTE Gamer HUD.lnk
[2010.05.26 17:51:54 | 000,243,457 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.05.26 17:51:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.26 17:50:39 | 006,291,456 | -H-- | M] () -- C:\Documents and Settings\Bartman\NTUSER.DAT
[2010.05.26 17:50:39 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Bartman\ntuser.ini
[2010.05.26 17:50:27 | 007,538,834 | -H-- | M] () -- C:\Documents and Settings\Bartman\Local Settings\Data aplikací\IconCache.db
[2010.05.26 17:48:36 | 000,075,328 | ---- | M] () -- C:\Documents and Settings\Bartman\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.05.26 17:47:25 | 000,284,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.05.26 16:07:46 | 000,000,718 | ---- | M] () -- C:\Documents and Settings\Bartman\Plocha\Módní salón.lnk
[2010.05.26 14:35:51 | 000,000,470 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{C125B866-6152-48BB-9720-4C62DB57C12C}.job
[2010.05.26 11:09:50 | 000,001,819 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Divoké vlny.lnk
[2010.05.25 18:51:29 | 000,000,826 | ---- | M] () -- C:\Documents and Settings\Bartman\Plocha\Restaurace U Amálky.lnk
[2010.05.25 08:44:37 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\Bartman\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.24 16:15:07 | 000,000,873 | ---- | M] () -- C:\Documents and Settings\Bartman\Plocha\Wild West Ransom.lnk
[2010.05.23 20:30:31 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\aionmemo_f5cbd0b5.dat
[2010.05.23 19:57:03 | 000,001,612 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Gamez Aion Launcher.lnk
[2010.05.23 19:56:40 | 015,233,886 | ---- | M] () -- C:\Documents and Settings\Bartman\Plocha\Gamez Aion Installer.exe
[2010.05.23 15:50:27 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\aionmemo_ a122f39.dat
[2010.05.22 11:04:58 | 000,000,245 | ---- | M] () -- C:\WINDOWS\spidla.INI
[2010.05.21 16:40:11 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\default.rss
[2010.05.21 16:39:53 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.05.21 08:28:00 | 001,822,337 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\Pitbull Feat. Lil Jon, Sensato, Black Point El Cata Watagatapitusberry.mp3
[2010.05.16 18:37:00 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010.05.16 18:37:00 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.05.16 18:37:00 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.05.16 18:37:00 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.05.16 18:37:00 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.05.16 09:38:35 | 000,107,888 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2010.05.15 15:34:59 | 000,137,464 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.05.15 15:34:41 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2010.05.15 14:38:38 | 000,100,532 | -H-- | M] () -- C:\treeinfo.wc
[2010.05.14 21:00:04 | 000,000,667 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.14 21:00:04 | 000,000,255 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.05.14 20:59:53 | 000,156,910 | ---- | M] () -- C:\WINDOWS\WMSysPr8.prx
[2010.05.12 08:48:07 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2010.05.11 19:31:25 | 003,043,840 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\Klasicismus ...ppt
[2010.05.07 14:40:07 | 000,002,553 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010.05.06 22:59:36 | 000,165,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010.05.06 22:39:23 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010.05.06 22:39:00 | 000,164,048 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010.05.06 22:34:27 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010.05.06 22:33:59 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010.05.06 22:33:55 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010.05.06 22:33:47 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010.05.06 22:33:29 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010.05.03 21:43:31 | 011,274,897 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\39515263e52d625f73dce95b177ee352.flv
[2010.05.02 10:33:43 | 000,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Skype.lnk
[2010.04.28 22:35:02 | 000,015,961 | ---- | M] () -- C:\Documents and Settings\Bartman\Dokumenty\Počítačové viry jsou malé softwarové programy určené k.docx

========== Files Created - No Company Name ==========

[2010.05.26 16:07:46 | 000,000,718 | ---- | C] () -- C:\Documents and Settings\Bartman\Plocha\Módní salón.lnk
[2010.05.26 11:09:50 | 000,001,819 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Divoké vlny.lnk
[2010.05.25 18:51:29 | 000,000,826 | ---- | C] () -- C:\Documents and Settings\Bartman\Plocha\Restaurace U Amálky.lnk
[2010.05.24 16:15:07 | 000,000,873 | ---- | C] () -- C:\Documents and Settings\Bartman\Plocha\Wild West Ransom.lnk
[2010.05.23 19:57:03 | 000,001,612 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Gamez Aion Launcher.lnk
[2010.05.23 19:56:40 | 015,233,886 | ---- | C] () -- C:\Documents and Settings\Bartman\Plocha\Gamez Aion Installer.exe
[2010.05.23 15:42:21 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\aionmemo_ a122f39.dat
[2010.05.22 10:52:11 | 000,000,245 | ---- | C] () -- C:\WINDOWS\spidla.INI
[2010.05.21 08:27:42 | 001,822,337 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\Pitbull Feat. Lil Jon, Sensato, Black Point El Cata Watagatapitusberry.mp3
[2010.05.16 20:15:12 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\aionmemo_f5cbd0b5.dat
[2010.05.14 20:59:53 | 000,156,910 | ---- | C] () -- C:\WINDOWS\WMSysPr8.prx
[2010.05.11 19:31:16 | 003,043,840 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\Klasicismus ...ppt
[2010.05.03 21:43:30 | 011,274,897 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\39515263e52d625f73dce95b177ee352.flv
[2010.04.28 22:35:02 | 000,015,961 | ---- | C] () -- C:\Documents and Settings\Bartman\Dokumenty\Počítačové viry jsou malé softwarové programy určené k.docx
[2010.03.24 11:44:49 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2010.03.11 15:57:31 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.03.06 23:52:50 | 000,137,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.03.06 15:57:04 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.03.03 12:31:48 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2010.03.01 18:59:50 | 000,000,221 | ---- | C] () -- C:\WINDOWS\disney.ini
[2010.03.01 18:59:41 | 000,000,359 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2010.02.25 20:22:53 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010.02.25 20:22:52 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010.02.24 17:08:08 | 000,685,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.02.24 15:33:22 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2010.02.24 15:33:19 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2010.02.24 15:28:17 | 000,000,266 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2010.02.24 15:27:57 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2010.02.24 15:27:55 | 000,005,700 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010.02.24 15:27:53 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010.02.24 15:06:40 | 000,021,464 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2010.02.24 15:06:40 | 000,015,552 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2010.02.24 15:06:39 | 000,014,910 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2004.10.12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2004.10.12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2004.10.12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2004.10.09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2004.10.05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2004.10.03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll

========== LOP Check ==========

[2010.05.17 19:16:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Aliasworlds
[2010.04.08 21:24:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
[2010.02.24 20:50:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ashampoo
[2010.04.13 22:01:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Codemasters
[2010.02.27 19:17:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2010.04.30 16:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Pro
[2010.03.04 22:11:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Electronic Arts
[2010.05.19 13:20:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\IObit
[2010.03.04 21:08:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Nokia
[2010.03.01 22:03:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\NokiaMusic
[2010.03.12 19:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\OviInstallerCache
[2010.02.24 20:49:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\page
[2010.03.01 22:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Suite
[2010.04.12 15:36:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ScreenSeven
[2010.04.17 16:00:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Solidshield
[2010.02.26 16:21:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Sports Interactive
[2010.04.07 10:34:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Temp
[2010.02.27 13:32:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ace
[2010.02.24 20:51:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ashampoo
[2010.05.19 19:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Boolat Games
[2010.05.26 14:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO
[2010.02.27 19:21:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Lite
[2010.04.30 16:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Pro
[2010.03.23 22:26:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Desktopicon
[2010.03.17 14:18:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Disney Interactive Studios
[2010.05.18 20:05:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\FashionCrazeChech
[2010.03.23 20:15:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Friday's games
[2010.05.16 15:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\GetRightToGo
[2010.02.24 16:41:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\GHISLER
[2010.03.19 17:22:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Hardcore
[2010.03.28 09:22:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ice Age 2
[2010.03.02 15:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\InterVideo
[2010.03.23 14:22:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\IObit
[2010.03.19 17:20:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Juce VST Host
[2010.03.04 16:40:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Leadertech
[2010.03.30 15:28:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\LucasArts
[2010.05.16 21:37:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Meridian93
[2010.03.20 15:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Mount&Blade
[2010.03.31 22:33:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Mount&Blade Warband
[2010.03.01 22:06:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Nokia
[2010.03.19 09:19:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\OpenCandy
[2010.03.01 22:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\PC Suite
[2010.03.19 17:21:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Sawer
[2010.02.26 16:20:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Sports Interactive
[2010.03.09 20:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\The Creative Assembly
[2010.05.15 14:42:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Tropico 3
[2010.04.22 13:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ubisoft
[2010.05.26 12:25:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\uTorrent
[2010.02.24 15:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Windows Desktop Search
[2010.02.24 15:37:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Windows Search
[2010.05.26 14:35:51 | 000,000,470 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C125B866-6152-48BB-9720-4C62DB57C12C}.job

========== Purity Check ==========

========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"ctfmon.exe" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 13:00:00 | 000,015,360 | ---- | M] (Microsoft Corporation)

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.02.27 13:32:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ace
[2010.02.24 22:32:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Adobe
[2010.02.24 20:51:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ashampoo
[2010.05.19 19:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Boolat Games
[2010.05.26 14:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO
[2010.03.01 16:08:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Corel
[2010.04.07 10:43:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\CyberLink
[2010.02.27 19:21:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Lite
[2010.04.30 16:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\DAEMON Tools Pro
[2010.03.23 22:26:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Desktopicon
[2010.03.17 14:18:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Disney Interactive Studios
[2010.05.18 20:05:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\FashionCrazeChech
[2010.03.23 20:15:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Friday's games
[2010.05.16 15:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\GetRightToGo
[2010.02.24 16:41:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\GHISLER
[2010.03.19 17:22:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Hardcore
[2010.03.21 15:16:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Help
[2010.03.28 09:22:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ice Age 2
[2010.02.24 15:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Identities
[2010.05.13 12:51:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\InstallShield
[2010.03.02 15:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\InterVideo
[2010.03.23 14:22:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\IObit
[2010.03.19 17:20:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Juce VST Host
[2010.03.04 16:40:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Leadertech
[2010.03.30 15:28:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\LucasArts
[2010.02.24 15:40:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Macromedia
[2010.04.07 21:51:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Malwarebytes
[2010.05.16 21:37:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Meridian93
[2010.04.08 14:26:41 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft
[2010.03.20 15:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Mount&Blade
[2010.03.31 22:33:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Mount&Blade Warband
[2010.03.03 12:42:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Nero
[2010.03.01 22:06:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Nokia
[2010.03.19 09:19:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\OpenCandy
[2010.03.01 22:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\PC Suite
[2010.03.19 17:21:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Sawer
[2010.02.24 17:53:29 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\Bartman\Data aplikací\SecuROM
[2010.05.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Skype
[2010.05.22 15:40:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\skypePM
[2010.02.26 16:20:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Sports Interactive
[2010.05.16 18:36:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Sun
[2010.03.09 20:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\The Creative Assembly
[2010.05.15 14:42:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Tropico 3
[2010.04.22 13:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Ubisoft
[2010.05.26 12:25:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\uTorrent
[2010.02.24 15:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Windows Desktop Search
[2010.02.24 15:37:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\Windows Search
[2010.02.24 16:43:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bartman\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2009.08.11 21:21:26 | 000,087,552 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\AC3 Filter\ac3config.exe
[2009.08.11 21:21:30 | 000,090,112 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\AC3 Filter\spdif_test.exe
[2010.03.22 14:52:04 | 000,697,690 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\AC3 Filter\unins000.exe
[2010.02.23 17:01:52 | 001,185,871 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\FFDShow\unins000.exe
[2009.11.14 19:11:36 | 000,113,152 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\Haali media splitter\dsmux.exe
[2009.11.14 19:33:40 | 000,357,888 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\Haali media splitter\gdsmux.exe
[2009.11.14 19:11:36 | 000,136,704 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\Haali media splitter\mkv2vfr.exe
[2010.02.23 16:00:42 | 000,042,288 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\BSplayer PRO\Haali media splitter\uninstall.exe
[2010.03.23 22:26:45 | 000,031,836 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\Desktopicon\uninst.exe
[2010.02.24 16:04:12 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\ARPPRODUCTICON.exe
[2010.02.24 16:04:12 | 000,040,960 | R--- | M] (Macrovision Corporation) -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\HUD.exe1_1A3210EE749448799270A721ED7F9947.exe
[2010.02.24 16:04:12 | 000,040,960 | R--- | M] (Macrovision Corporation) -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\HUD.exe_1A3210EE749448799270A721ED7F9947.exe
[2010.02.24 16:04:12 | 000,065,536 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
[2010.02.24 16:04:12 | 000,008,854 | R--- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\UNINST_Uninstall_Gam_1A3210EE749448799270A721ED7F9947.exe
[2010.03.02 13:02:29 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\Bartman\Data aplikací\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
[2010.03.11 09:17:44 | 064,164,264 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
[2010.03.18 22:12:30 | 000,265,089 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\OpenCandy\DlMgrWrapper1.4.exe
[2009.12.08 20:15:40 | 005,320,016 | ---- | M] (Xobni) -- C:\Documents and Settings\Bartman\Data aplikací\OpenCandy\XobniOC9.exe
[2009.12.17 21:10:40 | 000,620,032 | ---- | M] () -- C:\Documents and Settings\Bartman\Data aplikací\OpenCandy\Xobni_Installed.exe

< MD5 for: AGP440.SYS >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: CDROM.SYS >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.05.02 11:49:40 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=4B0A100EAF5C49EF3CCA8C641431EACC -- C:\WINDOWS\system32\dllcache\cdrom.sys
[2010.01.14 16:59:53 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=4B0A100EAF5C49EF3CCA8C641431EACC -- C:\WINDOWS\system32\drivers\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 13:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll
[2008.04.14 13:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\dllcache\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2010.01.14 17:00:04 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=8AB626E4E4B289646E11311E66FB0B88 -- C:\WINDOWS\explorer.exe
[2010.01.14 17:00:04 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=8AB626E4E4B289646E11311E66FB0B88 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: HAL.DLL >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2010.01.14 17:00:10 | 000,131,968 | ---- | M] (Microsoft Corporation) MD5=429B2A7E9569C19BFE58F71FC02DE220 -- C:\WINDOWS\system32\hal.dll

< MD5 for: CHANGER.SYS >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys

< MD5 for: ISAPNP.SYS >
[2010.01.14 17:14:14 | 017,817,320 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2008.04.14 13:00:00 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2008.04.14 13:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\dllcache\lsass.exe
[2008.04.14 13:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2010.01.14 17:01:13 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=B5B1080D35974C0E718D64280761BCD5 -- C:\WINDOWS\system32\dllcache\ndis.sys
[2010.01.14 17:01:13 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=B5B1080D35974C0E718D64280761BCD5 -- C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: NETLOGON.DLL >
[2010.01.14 17:01:14 | 000,407,552 | ---- | M] (Microsoft Corporation) MD5=6A5A974D868AE2F9AC96DC14F221A5EF -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2010.01.14 17:01:14 | 000,407,552 | ---- | M] (Microsoft Corporation) MD5=6A5A974D868AE2F9AC96DC14F221A5EF -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: NVATA.SYS >
[2005.05.17 11:45:08 | 000,092,800 | R--- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\drivers\nvata.sys

< MD5 for: SCECLI.DLL >
[2008.04.14 13:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 13:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2004.08.17 15:49:28 | 000,164,864 | ---- | M] (Microsoft Corporation) MD5=3C100B7FDB179B63829103DF6541337F -- C:\cmdcons\SYSTEM32\SMSS.EXE
[2008.04.14 13:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\dllcache\smss.exe
[2008.04.14 13:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2010.01.14 17:01:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=67E38B4A549833E02D4D1617B5DBC318 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2010.01.14 17:01:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=67E38B4A549833E02D4D1617B5DBC318 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: TCPIP.SYS >
[2010.01.14 17:01:53 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=367DE8E5F638C091F49273144274F629 -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2010.01.14 17:01:53 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=367DE8E5F638C091F49273144274F629 -- C:\WINDOWS\system32\drivers\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 13:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 13:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010.01.14 17:02:09 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=4212BABCC4408B052193DABAD9A691AB -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2010.01.14 17:02:09 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=4212BABCC4408B052193DABAD9A691AB -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 13:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\dllcache\ws2_32.dll
[2008.04.14 13:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.04.13 13:00:46 | 000,685,816 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2010.02.24 15:47:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010.02.24 15:47:18 | 001,093,632 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010.02.24 15:47:18 | 000,491,520 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.05.26 17:47:25 | 000,284,520 | ---- | M] () -- C:\WINDOWS\system32\FNTCACHE.DAT
[2010.05.26 17:51:54 | 000,243,457 | ---- | M] () -- C:\WINDOWS\system32\NvApps.xml
[2010.05.26 08:20:01 | 000,003,968 | ---- | M] () -- C:\WINDOWS\system32\TZLog.log
[2010.05.26 17:52:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
< End of report >

srbino · #6 Příspěvek od **srbino** » 26 kvě 2010 17:14

OTL Extras logfile created on: 26.5.2010 17:55:17 - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\Bartman\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 25,60 Gb Free Space | 17,18% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SIMPSON-AMD3000
Current User Name: Bartman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe" = C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0 -- (CyberLink Corp.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe" = C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe:*:Enabled:Sacred 2 Game Server -- (Ascaron Entertainment GmbH)
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe" = C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2 -- (Ascaron Entertainment GmbH)
"C:\Program Files\InterVideo\DVD8\WinDVD.exe" = C:\Program Files\InterVideo\DVD8\WinDVD.exe:*:Disabled:WinDVD -- (InterVideo Inc.)
"C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" = C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe:*:Enabled:Nokia Ovi Suite 2 -- (Nokia)
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process -- (Nokia Corporation)
"C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\base\bin\Settlers6.exe" = C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\base\bin\Settlers6.exe:*:Enabled:THE SETTLERS - Vzestup říše -- (Blue Byte GmbH)
"C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\extra1\bin\Settlers6.exe" = C:\Program Files\Ubisoft\THE SETTLERS - Vzestup říše\extra1\bin\Settlers6.exe:*:Enabled:THE SETTLERS - Vzestup říše - Východní království -- (Blue Byte GmbH)
"C:\Program Files\Microsoft Games\Motocross Madness 2\MCM2.EXE" = C:\Program Files\Microsoft Games\Motocross Madness 2\MCM2.EXE:*:Disabled:Microsoft® Motocross Madness 2 -- (Rainbow Multimedia Group, Inc)
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe" = C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0 -- (CyberLink Corp.)
"C:\Program Files\Codemasters\GRID\GRID.exe" = C:\Program Files\Codemasters\GRID\GRID.exe:*:Disabled:GRID Executable -- File not found
"C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe" = C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe:*:Disabled:Anno4Web -- ()
"C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\AddonWeb.exe" = C:\Program Files\Ubisoft\Related Designs\ANNO 1404\tools\AddonWeb.exe:*:Disabled:AddonWeb -- ()
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe" = C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher -- (Ubisoft)
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe" = C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s -- ()
"C:\Program Files\Ubisoft\Divoké Vlny\System\surfsupgame.exe" = C:\Program Files\Ubisoft\Divoké Vlny\System\surfsupgame.exe:*:Enabled:Divoké vlny -- (UBISOFT)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{0EABFEF6-6D10-4C12-8667-3029C481D355}" = Nokia Photos
"{1023383E-D9F6-478C-A965-23A4657B3C9A}" = Sacred 2
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{176B7642-72A8-49D0-8EC4-26D59D8E21B2}" = Klient pro správu práv Microsoft Windows Rights Management Services s aktualizací Service Pack 2
"{1A3210EE-7494-4879-9270-A721ED7F9947}" = Gamer HUD
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{21E75254-410E-49C4-8981-2E1A2A2221F2}" = HP Diagnostic Assistant
"{2405665A-16C9-4D3A-B70E-F006220E1472}" = Overland
"{267868CE-6DFF-40F7-9C58-C01119B7B117}" = Fax
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{2BBC9458-07CA-4843-848B-5C8146E5EFA8}" = CreativeProjects
"{2d73bdfb-2e4d-4cb8-a875-cfbcd64f3309}" = Nero 9 Trial
"{2F71F2BA-B513-4113-969C-18A84D238E27}" = 1310
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{34A59AC3-6C5C-4A09-A7F5-369A37176C8A}" = AiOSoftware
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3762698E-E9DF-4DD8-99F1-8192D0F8EE06}" = Nokia_Multimedia_Common_Components_2_5
"{3AE681E0-4E8D-453F-950A-48534D3C0724}" = Copy
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{41254D7B-EADF-4078-AE4A-BD73B300EE86}" = Unload
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{457791C5-D702-4143-A7B2-2744BE9573F2}" = HP Software Update
"{46376BAF-996E-410E-82B2-5D9E61820E6D}" = Moorhuhn Kart 3
"{47F0F784-96DD-4213-A0AB-85AF5C4A2E60}" = Doba ledová 2 Obleva
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}" = OviMPlatform
"{4FFD1AB4-54F0-4069-88D9-3A55B38F874B}" = Nokia Ovi Suite Software Updater
"{518A54AE-002F-406F-BB48-620676AB9960}" = Anno 1404
"{546C143E-68DC-314D-97BC-1E454E3BA429}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - CSY
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{597D73A8-5FDB-4bc1-9893-40B54459F1BC}" = ProductContext
"{59DC43FF-8F26-40B2-A566-C69C9457BF7D}" = Moorhuhn Soccer
"{5E65E94D-69F2-4850-9E93-6459C53A0F50}" = Microsoft .NET Framework 1.1 Czech Language Pack
"{5F40279D-83BA-4E52-8A3B-2F9F2D66DD06}" = Divoké Vlny
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}" = Ovi Desktop Sync Engine
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7397EDED-F38A-4654-B669-BF61065803D0}" = PC Connectivity Solution
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7DB5E14F-9037-43A0-A138-5A0CCAD7D832}" = Sun-Aion launcher
"{80413011-029C-4D6B-B3AD-725DDE60B81C}" = 1310Trb
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{8714A232-DD3A-49EE-9E22-0E0C5667D593}_is1" = “1Ń Ěîáčëüíűĺ čăđű” (Ňîëüęî Óäŕëĺíčĺ)
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader Extreme
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0015-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}_ENTERPRISE_{294B4278-CF7B-40B9-86A1-2D3FF0C2C524}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-001F-041B-0000-0000000FF1CE}_ENTERPRISE_{10EC59E5-9BCE-4884-BB1A-E28627220232}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0405-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Czech) 2007
"{90120000-0044-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}_ENTERPRISE_{E12F9D31-4025-4BC6-B1B2-AB262C5580B0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0405-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Czech) 2007
"{90120000-00A1-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0405-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Czech) 2007
"{90120000-00BA-0405-0000-0000000FF1CE}_ENTERPRISE_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{94240445-6D61-4985-B240-9027DCA7193E}_is1" = ×ĺđíűĺ áóřëŕňű (Ňîëüęî Óäŕëĺíčĺ)
"{97F81AF1-0E47-DC99-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 ATL (x86) WinSXS MSM
"{981FB376-8418-4EA8-BBED-9DE5AA63E7D5}" = SkinsHP1
"{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 CRT (x86) WinSXS MSM
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CB2512B-3EC4-43DF-8002-46BDAB5EDD1B}" = QuickProjects
"{9e82b934-9a25-445b-b8df-8012808074ac}" = Nero PhotoSnap
"{9e9fdde6-2c26-492a-85a0-05646b3f2795}" = NeroLiveGadget
"{9EEBF8D5-8712-4D1D-88F4-4CDC2D270BC3}" = PrintScreen
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A1DCC235-DACC-4E1F-8D11-D630634B4AEF}" = PhotoGallery
"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor
"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme
"{A2C9CD1B-2551-3AED-B244-6698FB929FA6}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - CSY
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{A528306A-C5EC-481C-A619-6106334E6800}" = Nokia Ovi Player
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC76BA86-7AD7-1049-7B44-A93000000001}" = Adobe Reader 9.3.2 - Russian
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{b1adf008-e898-4fe2-8a1f-690d9a06acaf}" = DolbyFiles
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B32C75F2-7495-4D01-9431-C11E97D66F8C}" = DocProc
"{B3D5D4E0-E965-41C4-ABFD-A7B1AD0663C2}" = Director
"{B45D9FEE-1AF4-46F3-9A83-2545F81547F5}" = CreativeProjectsTemplates
"{B56D5B09-C4FB-4EA0-8EAD-7BC3E2715A2D}" = DocumentViewer
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}" = Nokia Connectivity Cable Driver
"{BCC992E5-5C81-4066-9B55-03DC10B24D21}" = InstantShare
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BF018D2F-C788-4AB1-AB95-1280EAB8F13E}" = TrayApp
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax
"{C69405BB-27AF-4940-B3DA-04910B4DFD23}_is1" = aTube Catcher 1.0
"{C79308BC-63CC-4A0F-A585-2E137EA42A1E}_is1" = Power MP4 iPod PSP 3GP AVI MPG WMV Video Converter 5.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = THE SETTLERS - Vzestup říše (všechny produkty)
"{D8768524-DE8D-40D3-904B-B1FCC31CF9F9}" = Blazing Angels 2 : Secret Missions of WWII
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DD73CA82-EA82-38AA-863D-9A24A018DC96}" = Microsoft .NET Framework 3.5 Language Pack SP1 - csy
"{DE60CAE2-4CA8-4A6A-A557-0668004FE889}" = Moorhuhn Kart Extra XXL
"{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}" = Nokia Ovi Suite
"{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live
"{E21658D0-8C83-4ADD-937B-6ED07F335ABA}" = 1310Tour
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{E90BEB5B-CFA0-418E-9ABB-4C4A7B0D9483}" = 1310_Help
"{EAA02F85-3DD4-4083-9AF6-7A2C13ACF1E5}" = Moorhuhn Piraten
"{EC8673DA-F96B-497E-B2DB-BC7B029FD680}" = BufferChm
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Klient Správy přístupových práv v systému Windows SP2, zpětná kompatibilita
"{EE91E474-9298-47B8-817F-8E0042408998}" = Risen Hotfix 1.01
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4F47155-5B4D-42AA-97F8-490BC52EA7F3}" = Destinations
"{F65787F3-B356-45EC-8DD0-0E6758EDBCEE}" = WebReg
"{F8B2F1B6-5EB5-489C-8DB3-155464925C4A}" = Faces of War
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF26F7EA-BCEE-478C-9A1B-6B4F88717D73}" = CueTour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{Kouzelná farma}_is1" = Kouzelná farma 1.0
"504244733D18C8F63FF584AEB290E3904E791693" = Balíček ovladače systému Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Arkanoid 2" = Arkanoid 2
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.21
"Ashampoo Movie Shrink & Burn 3_is1" = Ashampoo Movie Shrink & Burn 3 3.03
"avast5" = avast! Free Antivirus
"AviSynth" = AviSynth 2.5
"BSPlayerp" = BS.Player PRO
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"CCleaner" = CCleaner
"CyberLink PowerDVD 9.0.2227" = CyberLink PowerDVD 9.0.2227 - Český překlad
"čeština do hry Blazing Angels 2 Secret Missions of WWII" = čeština do hry Blazing Angels 2 Secret Missions of WWII
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"eBay Icon" = eBay Icon
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FL Studio 9" = FL Studio 9
"GameParkClient_is1" = GamePark
"HighGrow Freeware Version 4.20" = HighGrow Freeware Version 4.20
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Image Zone 4.2
"IL Download Manager" = IL Download Manager
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.0 (Basic)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft Silverlight" = Microsoft Silverlight
"Módní salón" = Módní salón
"Moje farma" = Moje farma
"Moorhuhn - Im Anflug" = Moorhuhn - Im Anflug (remove only)
"Moorhuhn Invasion Vollversion" = Moorhuhn Invasion Vollversion
"Motocross Madness 2" = Microsoft Motocross Madness 2
"Nokia Ovi Suite" = Nokia Ovi Suite
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PoiZone" = PoiZone
"PowerISO" = PowerISO
"PunkBusterSvc" = PunkBuster Services
"Restaurace Medvěda Míši" = Restaurace Medvěda Míši
"Restaurace U Amálky" = Restaurace U Amálky
"Sawer" = Sawer
"Snoopy vs. The Red Baron(TM)" = Snoopy vs. The Red Baron(TM)
"Sudden Strike 3" = Sudden Strike 3
"The KMPlayer" = The KMPlayer (remove only)
"Totalcmd" = Total Commander (Remove or Repair)
"Toxic Biohazard" = Toxic Biohazard
"Traktor Simulátor_is1" = Traktor Simulátor
"uTorrent" = µTorrent
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wild West Ransom" = Wild West Ransom
"WinRAR archiver" = WinRAR
"XP Codec Pack" = XP Codec Pack
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1409082233-1532298954-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FIFA 10 Grafický patch " = FIFA 10 Grafický patch
"NCsoft-AionEU" = Aion

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21.5.2010 1:58:09 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2005
Description = Nelze číst data o výkonu ze služby serveru. V tomto vzorku nebudou
vrácena žádná data o výkonu serveru. Vrácený chybový kód je v datech DWORD 0, IOSB.Status
je DWORD 1 a IOSB.Information je DWORD 2.

Error - 21.5.2010 1:58:09 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2006
Description = Nelze číst data o výkonu fronty ze služby serveru. V tomto vzorku nebudou
vrácena žádná data o výkonu fronty serveru. Vrácený chybový kód je v datech DWORD
0, IOSB.Status je DWORD 1 a IOSB.Information je DWORD 2.

Error - 22.5.2010 3:41:47 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 22.5.2010 4:19:18 | Computer Name = SIMPSON-AMD3000 | Source = Application Error | ID = 1000
Description = Chybující aplikace cld.exe, verze 1.2.0.0, chybující modul cld.exe,
verze 1.2.0.0, adresa chyby 0x001186dc.

Error - 22.5.2010 11:17:16 | Computer Name = SIMPSON-AMD3000 | Source = Application Error | ID = 1000
Description = Chybující aplikace moje farma.exe, verze 0.0.0.0, chybující modul
gfx.dll, verze 0.0.0.0, adresa chyby 0x0006b28e.

Error - 23.5.2010 5:56:05 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 24.5.2010 10:11:39 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 25.5.2010 11:45:36 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2005
Description = Nelze číst data o výkonu ze služby serveru. V tomto vzorku nebudou
vrácena žádná data o výkonu serveru. Vrácený chybový kód je v datech DWORD 0, IOSB.Status
je DWORD 1 a IOSB.Information je DWORD 2.

Error - 25.5.2010 11:45:36 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2006
Description = Nelze číst data o výkonu fronty ze služby serveru. V tomto vzorku nebudou
vrácena žádná data o výkonu fronty serveru. Vrácený chybový kód je v datech DWORD
0, IOSB.Status je DWORD 1 a IOSB.Information je DWORD 2.

Error - 26.5.2010 2:02:19 | Computer Name = SIMPSON-AMD3000 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

[ System Events ]
Error - 26.5.2010 11:47:51 | Computer Name = SIMPSON-AMD3000 | Source = SRService | ID = 104
Description = Proces inicializace nástroje Obnovení systému se nezdařil.

Error - 26.5.2010 11:47:57 | Computer Name = SIMPSON-AMD3000 | Source = adioiq1v | ID = 262148
Description =

Error - 26.5.2010 11:47:57 | Computer Name = SIMPSON-AMD3000 | Source = adioiq1v | ID = 262148
Description =

Error - 26.5.2010 11:48:20 | Computer Name = SIMPSON-AMD3000 | Source = Service Control Manager | ID = 7023
Description = Služba Služba obnovení systému byla ukončena s následující chybou:
%%2

Error - 26.5.2010 11:52:04 | Computer Name = SIMPSON-AMD3000 | Source = ak46t3ht | ID = 262148
Description =

Error - 26.5.2010 11:52:04 | Computer Name = SIMPSON-AMD3000 | Source = ak46t3ht | ID = 262148
Description =

Error - 26.5.2010 11:52:44 | Computer Name = SIMPSON-AMD3000 | Source = SRService | ID = 104
Description = Proces inicializace nástroje Obnovení systému se nezdařil.

Error - 26.5.2010 11:52:51 | Computer Name = SIMPSON-AMD3000 | Source = Service Control Manager | ID = 7023
Description = Služba Služba obnovení systému byla ukončena s následující chybou:
%%2

Error - 26.5.2010 11:55:37 | Computer Name = SIMPSON-AMD3000 | Source = SRService | ID = 104
Description = Proces inicializace nástroje Obnovení systému se nezdařil.

Error - 26.5.2010 11:55:37 | Computer Name = SIMPSON-AMD3000 | Source = Service Control Manager | ID = 7023
Description = Služba Služba obnovení systému byla ukončena s následující chybou:
%%2

< End of report >

#7 Příspěvek od **Caroprd111** » 26 kvě 2010 19:24

Doporučuji odinstalovat Advanced SystemCare 3.

Obrázek

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
Vložte do PC všechny flash disky, které používáte.
Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
Během skenování může být počítač restartován.

srbino · #8 Příspěvek od **srbino** » 27 kvě 2010 13:35

ComboFix 10-05-26.03 - Bartman 27.05.2010 14:23:14.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2559.2201 [GMT 2:00]
Spuštěný z: c:\documents and settings\Bartman\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-04-27 do 2010-05-27 )))))))))))))))))))))))))))))))
.

2010-05-22 08:56 . 2010-05-22 09:01 -------- d-----w- c:\program files\Arkanoid 2
2010-05-22 07:56 . 2010-05-24 17:07 -------- d-----w- c:\program files\City Life Deluxe
2010-05-19 17:34 . 2010-05-19 17:34 -------- d-----w- c:\program files\Restaurace U Amálky
2010-05-18 18:04 . 2010-05-18 18:05 -------- d-----w- c:\program files\Módní salón
2010-05-17 17:15 . 2010-05-17 17:16 -------- d-----w- c:\program files\Restaurace Medvěda Míši
2010-05-16 19:37 . 2010-05-16 19:37 -------- d-----w- c:\program files\Kouzelná farma
2010-05-16 16:37 . 2010-05-16 16:37 -------- d-----w- c:\program files\Common Files\Java
2010-05-16 16:37 . 2010-05-16 16:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-05-16 16:36 . 2010-05-16 16:36 -------- d-----w- c:\program files\Java
2010-05-16 13:24 . 2010-05-23 08:36 -------- d-----w- c:\program files\NCSoft
2010-05-16 07:35 . 2010-05-16 07:35 -------- d-----w- c:\program files\Firefly Studios
2010-05-14 19:00 . 2010-05-14 19:52 -------- d-----w- C:\Temp
2010-05-14 18:59 . 2001-10-19 12:40 438608 ----a-w- c:\windows\system32\wmv8dmod.dll
2010-05-14 18:59 . 2001-10-19 12:40 665424 ----a-w- c:\windows\system32\wmv8dmoe.dll
2010-05-14 18:59 . 2001-10-19 12:39 572752 ----a-w- c:\windows\system32\wmvdmoe.dll
2010-05-14 18:59 . 2001-10-19 12:40 1683792 ----a-w- c:\windows\system32\wmvcore2.dll
2010-05-14 18:58 . 2010-05-14 19:53 -------- d-----w- c:\program files\coolpro2
2010-05-12 08:58 . 2010-05-12 08:58 -------- d-----w- c:\program files\Webteh
2010-05-01 18:45 . 2010-05-01 18:45 -------- d-----w- c:\program files\GamePark
2010-04-27 15:41 . 2010-04-27 17:26 -------- d-----w- c:\program files\RoboBlitz

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 13:18 . 2010-04-07 15:32 -------- d-----w- c:\program files\trend micro
2010-05-26 08:57 . 2010-03-15 15:34 -------- d-----w- c:\program files\Ubisoft
2010-05-26 08:57 . 2010-02-24 13:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-16 19:50 . 2010-02-26 15:08 -------- d-----w- c:\program files\Kalypso
2010-05-16 07:38 . 2010-03-27 16:37 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-15 13:34 . 2010-03-06 21:52 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-05-15 13:34 . 2010-03-06 21:52 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-05-15 09:33 . 2010-02-24 14:02 -------- d-----w- c:\program files\uTorrent
2010-05-14 12:09 . 2010-03-13 21:12 -------- d-----w- c:\program files\Activision
2010-05-12 07:29 . 2010-02-24 14:48 -------- d-----w- c:\program files\The KMPlayer
2010-05-06 20:59 . 2010-04-08 19:25 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2010-04-08 19:27 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2010-04-08 19:27 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2010-04-08 19:27 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2010-04-08 19:27 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2010-04-08 19:27 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2010-04-08 19:27 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-05-06 20:33 . 2010-04-08 19:27 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-21 14:10 . 2010-04-21 14:10 -------- d-----w- c:\program files\Alawar
2010-04-20 11:36 . 2010-02-24 15:28 -------- d-----w- c:\program files\Deep Silver
2010-04-19 15:42 . 2010-04-19 15:42 -------- d-----w- c:\program files\THQ
2010-04-14 16:54 . 2010-04-14 16:53 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-14 16:47 . 2010-04-08 19:25 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-13 13:43 . 2010-03-08 17:03 -------- d-----w- c:\program files\phenomedia
2010-04-13 11:00 . 2010-02-24 15:08 685816 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-08 20:41 . 2010-03-09 10:04 -------- d-----w- c:\program files\Lavasoft
2010-04-08 19:24 . 2010-04-08 19:24 -------- d-----w- c:\program files\Alwil Software
2010-04-07 19:51 . 2010-04-07 19:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-07 19:47 . 2010-04-07 19:47 -------- d-----w- c:\program files\CCleaner
2010-04-07 12:04 . 2010-03-02 13:47 -------- d-----w- c:\program files\InterVideo Information Service
2010-04-07 12:03 . 2010-04-07 12:03 -------- d-----w- c:\program files\Common Files\InterVideo
2010-04-07 12:03 . 2010-04-07 12:03 -------- d-----w- c:\program files\InterVideo
2010-04-07 11:23 . 2010-04-07 08:34 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-04-07 08:36 . 2010-04-07 08:35 -------- d-----w- c:\program files\CyberLink
2010-04-07 08:36 . 2010-04-07 08:36 -------- d-----w- c:\program files\Common Files\CyberLink
2010-04-06 15:43 . 2010-04-06 15:43 -------- d-----w- c:\program files\LEGO Media
2010-04-05 06:38 . 2010-03-02 16:27 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-04-04 16:58 . 2010-04-04 16:58 -------- d-----w- c:\program files\Cenega Czech
2010-04-03 10:19 . 2010-03-11 13:57 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-04-03 10:19 . 2010-03-07 14:41 -------- d-----w- c:\program files\HighGrow
2010-04-03 10:19 . 2010-03-02 10:46 -------- d-----w- c:\program files\HP
2010-04-02 17:06 . 2010-04-02 17:06 -------- d-----w- c:\program files\Moje farma
2010-03-29 22:46 . 2010-04-07 19:51 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2010-04-07 19:51 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-28 18:54 . 2008-04-14 11:00 95306 ----a-w- c:\windows\system32\perfc005.dat
2010-03-28 18:54 . 2008-04-14 11:00 470224 ----a-w- c:\windows\system32\perfh005.dat
2010-03-10 06:17 . 2010-01-14 15:02 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 10:06 . 2010-03-09 10:06 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-07 14:47 . 2010-03-07 14:47 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-06 21:52 . 2010-03-06 21:52 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-06 21:52 . 2010-03-06 21:52 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-03-02 11:06 . 2010-03-02 10:45 104257 ----a-w- c:\windows\hpoins04.dat
2010-02-27 17:12 . 2010-02-25 18:22 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-02-27 17:12 . 2010-02-25 18:22 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-02-27 16:38 . 2010-02-27 16:38 60416 ----a-w- c:\windows\ALCFDRTM.EXE
.

------- Sigcheck -------

[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2009-11-06 2090272]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2009-11-19 75048]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\Bartman\Nabˇdka Start\Programy\Po spuçtŘnˇ\
GIGABYTE Gamer HUD.lnk - c:\documents and settings\Bartman\Data aplikacˇ\Microsoft\Installer\{1A3210EE-7494-4879-9270-A721ED7F9947}\HUD.exe1_1A3210EE749448799270A721ED7F9947.exe [2010-2-24 40960]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
Rychl‚ spuçtŘnˇ aplikace HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-29 53248]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2010-2-24 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2010-01-14 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Ubisoft\\THE SETTLERS - Vzestup říše\\base\\bin\\Settlers6.exe"=
"c:\\Program Files\\Ubisoft\\THE SETTLERS - Vzestup říše\\extra1\\bin\\Settlers6.exe"=
"c:\\Program Files\\Microsoft Games\\Motocross Madness 2\\MCM2.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Program Files\\Ubisoft\\Related Designs\\ANNO 1404\\tools\\Anno4Web.exe"=
"c:\\Program Files\\Ubisoft\\Related Designs\\ANNO 1404\\tools\\AddonWeb.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Ubisoft\\Divoké Vlny\\System\\surfsupgame.exe"=

R0 pe3akrnb;Faces of War Environment Driver (pe3akrnb);c:\windows\system32\drivers\pe3akrnb.sys [19.4.2007 17:04 64896]
R0 ps6akrnb;Faces of War Synchronization Driver (ps6akrnb);c:\windows\system32\drivers\ps6akrnb.sys [19.4.2007 17:03 53128]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8.4.2010 21:27 164048]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/04/07 10:36];c:\program files\CyberLink\PowerDVD9\000.fcl [28.2.2009 19:40 87536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8.4.2010 21:27 19024]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.2.2010 17:08 685816]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14.1.2010 17:04 9472]
S2 pr2akrnb;Faces of War Drivers Auto Removal (pr2akrnb);c:\windows\system32\pr2akrnb.exe svc --> c:\windows\system32\pr2akrnb.exe svc [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14.1.2010 17:01 14848]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2010-05-27 c:\windows\Tasks\User_Feed_Synchronization-{C125B866-6152-48BB-9720-4C62DB57C12C}.job
- c:\windows\system32\msfeedssync.exe [2010-01-14 15:05]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.tiscali.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-27 14:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
Celkový čas: 2010-05-27 14:30:25
ComboFix-quarantined-files.txt 2010-05-27 12:30

Před spuštěním: Volných bajtů: 13 802 627 072
Po spuštění: Volných bajtů: 13 825 482 752

- - End Of File - - EC0C9957698EF27A3C4EBC1964037E98

#9 Příspěvek od **Caroprd111** » 27 kvě 2010 14:02

Odinstalujte všechny emulátory virtuálních mechanik.

Obrázek

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
zvolte možnost Uninstall a restartujte PC.

Stáhněte a spusťte http://www.jpshortstuff.247fixes.com/Defogger.exe

Klikněte na "Disable" a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Obrázek

Start > Spustit (Win + R)

Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

Klikněte na OK

Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

srbino · #10 Příspěvek od **srbino** » 27 kvě 2010 17:15

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-27 18:12:48
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Bartman\LOCALS~1\Temp\fglirpod.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA6004C7A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA6004B36]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xA60050EA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA6005014]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA600470C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA6004C10]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA600464C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA60046B0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA6004D30]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xA60051B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA6004CF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA6004E70]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xA6011AC6]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xA60118EA]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xA6011A24]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2468 80501CA0 4 Bytes JMP 0AA60050
PAGE ntkrnlpa.exe!ZwLoadDriver 805795FA 7 Bytes JMP A6011A28 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!NtCreateSection 805A0788 7 Bytes JMP A60118EE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805B1D0C 5 Bytes JMP A600D536 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805B8B84 5 Bytes JMP A600EEC2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805C741A 7 Bytes JMP A6011ACA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.xreloc C:\WINDOWS\system32\drivers\ps6akrnb.sys unknown last section [0xB7F67000, 0x8F0, 0x40000040]
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB63B0380, 0x3DEB95, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0x9DEF5300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xB83A0300, 0x1BEE, 0xE8000020]
.text C:\Program Files\CyberLink\PowerDVD9\000.fcl section is writeable [0x9DC21000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\CyberLink\PowerDVD9\000.fcl entry point in ".vmp2" section [0x9DC44050]
? C:\DOCUME~1\Bartman\LOCALS~1\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 414E54E5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 415BDB6C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 416B4A47 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 416B4979 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 416B49E4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 416B484A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 416B48AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 416B4AAA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1200] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 416B490E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 414E54E5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 415B9B11 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 415AD131 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 415BDB6C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 41524686 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 416B4A47 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 416B4979 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 416B49E4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 416B484A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 416B48AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 416B4AAA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 416B490E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] ole32.dll!CoCreateInstance 774EF1C4 1 Byte [E9]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] ole32.dll!CoCreateInstance 774EF1C4 5 Bytes JMP 415BDBC8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] ole32.dll!OleLoadFromStream 775197FD 5 Bytes JMP 416B4DC8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[888] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT C:\WINDOWS\system32\services.exe[888] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[3720] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x44 0x74 0x7C 0x09 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x96 0x77 0xAA 0xE0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xB3 0x37 0xA7 0x88 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFE 0xF8 0x9E 0xD4 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x44 0x74 0x7C 0x09 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x96 0x77 0xAA 0xE0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xB3 0x37 0xA7 0x88 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFE 0xF8 0x9E 0xD4 ...

---- EOF - GMER 1.0.15 ----

srbino · #11 Příspěvek od **srbino** » 27 kvě 2010 17:16

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-05-27 17:24:04
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Bartman\LOCALS~1\Temp\fglirpod.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xA6011AC6]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xA60118EA]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xA6011A24]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

#12 Příspěvek od **Caroprd111** » 27 kvě 2010 18:29

Jak to vypadá s PC

srbino · #13 Příspěvek od **srbino** » 27 kvě 2010 18:53

uvidím, zatím to vypadá v pohodě, během zítřka se ozvu jestli budu mít pochybnosti

#14 Příspěvek od **Caroprd111** » 27 kvě 2010 18:55

OK, potom ještě dočistíme.

srbino · #15 Příspěvek od **srbino** » 28 kvě 2010 19:11

Tak během dne se mi nestalo nic zvláštního. Řekl bych že je to Ok. Mám tu hodit ještě nějáký log?

VIRY.CZ

Kontrola logu

Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu