VIRY.CZ

Dobrý deň.

Mam pravdepodobne v PC virus na kolko avira hlasi neziadane programy.

vkladam log RSIT

log

Logfile of random's system information tool 1.08 (written by random/random)
Run by janik at 2010-11-10 23:29:36
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 139 GB (45%) free of 305 GB
Total RAM: 3327 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:29:45, on 10.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOOWS\System32\smss.exe
C:\WINDOOWS\system32\winlogon.exe
C:\WINDOOWS\system32\services.exe
C:\WINDOOWS\system32\lsass.exe
C:\WINDOOWS\system32\Ati2evxx.exe
C:\WINDOOWS\system32\svchost.exe
C:\WINDOOWS\System32\svchost.exe
C:\WINDOOWS\system32\Ati2evxx.exe
C:\WINDOOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\WINDOOWS\RTHDCPL.EXE
C:\WINDOOWS\system32\ctfmon.exe
C:\Program Files\OSCAR Editor\OscarEditor.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\janik\Plocha\RSIT.exe
C:\Program Files\trend micro\janik.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICustomerCare] "c:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files\OSCAR Editor\OscarEditor.exe" Minimum
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [NVIDIA driver monitor] C:\WINDOOWS\nvsvc32.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\janik\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 0kkfwwr.exe
O4 - Startup: 6ss6ee6.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: g6ss6ee6.exe
O4 - Startup: k1gccxoo.exe
O4 - Startup: k9g1cyytkk.exe
O4 - Startup: kfwwriiduu.exe
O4 - Startup: kvglwhy1o.exe
O4 - Startup: lgg6ss6ee.exe
O4 - Startup: lhxxtjjf.exe
O4 - Startup: mmhyytkkfw.exe
O4 - Startup: o9k1gccxoo.exe
O4 - Startup: za70bxss6e.exe
O4 - Startup: zvllhxxt.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8293 bytes

======Scheduled tasks folder======

C:\WINDOOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003Core.job
C:\WINDOOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
ToggleEN Toolbar - C:\Program Files\ToggleEN\tbTog1.dll [2010-10-30 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]
AC-Pro - C:\Program Files\AutocompletePro\AutocompletePro.dll [2010-07-14 97760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngin0.dll [2010-10-30 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-09-19 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{038cb5c7-48ea-4af9-94e0-a1646542e62b} - ToggleEN Toolbar - C:\Program Files\ToggleEN\tbTog1.dll [2010-10-30 3908192]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngin0.dll [2010-10-30 3908192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=C:\WINDOOWS\ALCMTR.EXE [2008-06-19 57344]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-11-10 281768]
"ATICustomerCare"=c:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe [2010-03-04 311296]
"MAAgent"=C:\Program Files\MarkAny\ContentSafer\MAAgent.exe [2007-01-30 57344]
"RTHDCPL"=C:\WINDOOWS\RTHDCPL.EXE [2008-12-09 18063872]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"KernelFaultCheck"=C:\WINDOOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOOWS\system32\ctfmon.exe [2008-04-14 15360]
"OscarEditor"=C:\Program Files\OSCAR Editor\OscarEditor.exe [2009-06-16 3331584]
"Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2010-09-14 2969496]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"NVIDIA driver monitor"=C:\WINDOOWS\nvsvc32.exe []
"Google Update"=C:\Documents and Settings\janik\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-11-08 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-05-11 40048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [2007-02-23 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\steam\steam.exe [2010-09-24 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění
0kkfwwr.exe
6ss6ee6.exe
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
g6ss6ee6.exe
k1gccxoo.exe
k9g1cyytkk.exe
kfwwriiduu.exe
kvglwhy1o.exe
lgg6ss6ee.exe
lhxxtjjf.exe
mmhyytkkfw.exe
o9k1gccxoo.exe
za70bxss6e.exe
zvllhxxt.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOOWS\system32\Ati2evxx.dll [2010-09-18 159744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"=C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 192512]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\HLSW\hlsw.exe"="C:\Program Files\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Steam\steamapps\common\trackmania nations forever\TmForever.exe"="C:\Program Files\Steam\steamapps\common\trackmania nations forever\TmForever.exe:*:Disabled:TmForever"
"C:\Program Files\Steam\steamapps\tomx1\dedicated server\hlds.exe"="C:\Program Files\Steam\steamapps\tomx1\dedicated server\hlds.exe:*:Enabled:Dedicated Server"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOOWS\system32\muzapp.exe"="C:\WINDOOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\Program Files\Steam\steamapps\common\alien swarm\srcds.exe"="C:\Program Files\Steam\steamapps\common\alien swarm\srcds.exe:*:Enabled:Alien Swarm Dedicated Server"
"C:\Program Files\Steam\steamapps\tomx1\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\tomx1\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source"
"C:\Program Files\Counter-Strike Source\hl2.exe"="C:\Program Files\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steamapps\common\alien swarm\swarm.exe"="C:\Program Files\Steam\steamapps\common\alien swarm\swarm.exe:*:Enabled:Alien Swarm"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Steam\steamapps\tomx1\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\tomx1\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\Program Files\Steam\steamapps\tomx1\counterstrike source beta\hl2.exe"="C:\Program Files\Steam\steamapps\tomx1\counterstrike source beta\hl2.exe:*:Enabled:Counter-Strike: Source Beta"
"C:\Program Files\Traffic Giant\trafficgiant.exe"="C:\Program Files\Traffic Giant\trafficgiant.exe:*:Enabled:MFC-Anwendung default"
"C:\WINDOOWS\system32\dplaysvr.exe"="C:\WINDOOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe"="C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe:*:Enabled:FIFA 11"
"C:\Program Files\Steam\steamapps\common\amd driver updater, xp, 32 bit\Setup.exe"="C:\Program Files\Steam\steamapps\common\amd driver updater, xp, 32 bit\Setup.exe:*:Enabled:AMD Driver Updater, XP, 32 bit"
"C:\Program Files\EA Sports\NHL 09\nhl2009.exe"="C:\Program Files\EA Sports\NHL 09\nhl2009.exe:*:Enabled:nhl2009"
"C:\Documents and Settings\janik\Local Settings\Data aplikací\Opera\Opera\temporary_downloads\P17535732.JPG-www.facebook.exe"="C:\WINDOOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Documents and Settings\janik\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\janik\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

======List of files/folders created in the last 1 months======

2010-11-10 23:29:36 ----D---- C:\rsit
2010-11-10 16:27:04 ----A---- C:\27.exe
2010-11-10 06:00:42 ----RSH---- C:\Documents and Settings\janik\Data aplikací\juzjf.exe
2010-11-07 12:23:50 ----D---- C:\Program Files\QCad20
2010-11-05 16:11:03 ----D---- C:\Documents and Settings\janik\Data aplikací\Softland
2010-11-05 16:10:47 ----A---- C:\WINDOOWS\system32\GdiPlus.dll
2010-10-25 20:41:03 ----D---- C:\Program Files\Common Files\Borland Shared
2010-10-25 20:41:03 ----D---- C:\Program Files\Borland
2010-10-25 20:35:48 ----D---- C:\Program Files\Borland CBuilder6 Evaluation
2010-10-23 13:50:13 ----D---- C:\WINDOOWS\system32\XPSViewer
2010-10-23 13:50:09 ----D---- C:\WINDOOWS\system32\en-us
2010-10-23 13:49:39 ----N---- C:\WINDOOWS\system32\spmsg2.dll
2010-10-21 22:29:59 ----D---- C:\WINDOOWS\Minidump
2010-10-21 18:19:05 ----D---- C:\WINDOOWS\system32\ar-sa
2010-10-21 18:19:03 ----D---- C:\WINDOOWS\system32\pt-br
2010-10-21 18:19:03 ----D---- C:\WINDOOWS\system32\bg-bg
2010-10-21 18:19:02 ----D---- C:\WINDOOWS\system32\zh-cn
2010-10-21 18:19:00 ----D---- C:\WINDOOWS\system32\zh-tw
2010-10-21 18:18:56 ----D---- C:\WINDOOWS\system32\da-dk
2010-10-21 18:18:54 ----D---- C:\WINDOOWS\system32\el-gr
2010-10-21 18:18:52 ----D---- C:\WINDOOWS\system32\es-es
2010-10-21 18:18:50 ----D---- C:\WINDOOWS\system32\fi-fi
2010-10-21 18:18:50 ----D---- C:\WINDOOWS\system32\et-ee
2010-10-21 18:18:48 ----D---- C:\WINDOOWS\system32\fr-fr
2010-10-21 18:18:46 ----D---- C:\WINDOOWS\system32\de-de
2010-10-21 18:18:44 ----D---- C:\WINDOOWS\system32\he-il
2010-10-21 18:18:42 ----D---- C:\WINDOOWS\system32\hu-hu
2010-10-21 18:18:42 ----D---- C:\WINDOOWS\system32\hr-hr
2010-10-21 18:18:40 ----D---- C:\WINDOOWS\system32\it-it
2010-10-21 18:18:38 ----D---- C:\WINDOOWS\system32\ja-jp
2010-10-21 18:18:37 ----D---- C:\WINDOOWS\system32\ko-kr
2010-10-21 18:18:35 ----D---- C:\WINDOOWS\system32\nl-nl
2010-10-21 18:18:35 ----D---- C:\WINDOOWS\system32\lv-lv
2010-10-21 18:18:35 ----D---- C:\WINDOOWS\system32\lt-lt
2010-10-21 18:18:33 ----D---- C:\WINDOOWS\system32\nb-no
2010-10-21 18:18:31 ----D---- C:\WINDOOWS\system32\pl-pl
2010-10-21 18:18:29 ----D---- C:\WINDOOWS\system32\pt-pt
2010-10-21 18:18:27 ----D---- C:\WINDOOWS\system32\ru-ru
2010-10-21 18:18:27 ----D---- C:\WINDOOWS\system32\ro-ro
2010-10-21 18:18:26 ----D---- C:\WINDOOWS\system32\sk-sk
2010-10-21 18:18:25 ----D---- C:\WINDOOWS\system32\sl-si
2010-10-21 18:18:24 ----D---- C:\WINDOOWS\system32\sv-se
2010-10-21 18:18:23 ----D---- C:\WINDOOWS\system32\th-th
2010-10-21 18:18:22 ----D---- C:\WINDOOWS\system32\tr-tr
2010-10-21 18:18:06 ----HDC---- C:\WINDOOWS\$NtUninstallKB942766-v6$
2010-10-18 19:47:43 ----D---- C:\Documents and Settings\janik\Data aplikací\Leadertech
2010-10-18 19:37:16 ----D---- C:\Program Files\EA Sports
2010-10-18 19:10:16 ----D---- C:\Program Files\LogMeIn Hamachi
2010-10-18 19:07:20 ----D---- C:\Program Files\ConduitEngine
2010-10-18 19:07:18 ----D---- C:\Program Files\ToggleEN
2010-10-18 18:48:40 ----D---- C:\Program Files\Traffic Giant
2010-10-15 15:08:49 ----D---- C:\Program Files\TrafficCity
2010-10-14 21:24:52 ----D---- C:\Program Files\MHDsim2009
2010-10-14 17:56:19 ----D---- C:\Program Files\Traffic City 2
2010-10-12 18:10:26 ----D---- C:\Documents and Settings\janik\Data aplikací\ICQ
2010-10-12 18:10:01 ----D---- C:\Program Files\ICQ6.5
2010-10-11 17:52:00 ----D---- C:\Program Files\Counter-Strike Source
2010-10-11 16:28:09 ----D---- C:\Documents and Settings\All Users.WINDOOWS\Data aplikací\Windows Genuine Advantage

======List of files/folders modified in the last 1 months======

2010-11-10 23:29:43 ----D---- C:\WINDOOWS\Prefetch
2010-11-10 23:29:40 ----D---- C:\Program Files\trend micro
2010-11-10 23:29:28 ----D---- C:\WINDOOWS\system32
2010-11-10 23:29:28 ----A---- C:\WINDOOWS\system32\PerfStringBackup.INI
2010-11-10 23:25:43 ----D---- C:\WINDOOWS\Temp
2010-11-10 23:25:40 ----D---- C:\WINDOOWS\system32\CatRoot2
2010-11-10 23:24:09 ----A---- C:\WINDOOWS\SchedLgU.Txt
2010-11-10 23:04:52 ----D---- C:\WINDOOWS
2010-11-10 21:13:44 ----A---- C:\WINDOOWS\NeroDigital.ini
2010-11-10 19:09:25 ----D---- C:\WINDOOWS\system32\NtmsData
2010-11-10 19:08:50 ----SHD---- C:\System Volume Information
2010-11-10 19:08:23 ----D---- C:\WINDOOWS\Registration
2010-11-10 17:26:06 ----RSHD---- C:\RECYCLER
2010-11-10 16:19:25 ----D---- C:\Program Files\Steam
2010-11-08 23:29:17 ----D---- C:\WINDOOWS\system32\config
2010-11-08 21:22:52 ----SHD---- C:\WINDOOWS\Installer
2010-11-08 21:22:52 ----D---- C:\Config.Msi
2010-11-08 21:22:51 ----D---- C:\Documents and Settings\janik\Data aplikací\Mozilla
2010-11-08 21:22:26 ----SD---- C:\WINDOOWS\Tasks
2010-11-07 13:51:06 ----D---- C:\Documents and Settings\janik\Data aplikací\Skype
2010-11-07 12:28:29 ----D---- C:\Documents and Settings\janik\Data aplikací\skypePM
2010-11-07 12:23:50 ----D---- C:\Program Files
2010-10-27 20:34:48 ----D---- C:\WINDOOWS\system32\wbem
2010-10-27 20:34:47 ----SD---- C:\Documents and Settings\janik\Data aplikací\Microsoft
2010-10-27 18:15:02 ----D---- C:\WINDOOWS\system32\DirectX
2010-10-27 18:15:01 ----HD---- C:\WINDOOWS\inf
2010-10-27 18:14:48 ----RSD---- C:\WINDOOWS\assembly
2010-10-25 20:41:03 ----D---- C:\Program Files\Common Files
2010-10-23 13:59:50 ----D---- C:\WINDOOWS\Microsoft.NET
2010-10-23 13:50:56 ----D---- C:\WINDOOWS\WinSxS
2010-10-23 13:50:15 ----RSD---- C:\WINDOOWS\Fonts
2010-10-23 13:49:48 ----D---- C:\WINDOOWS\system32\spool
2010-10-23 13:49:40 ----RSHDC---- C:\WINDOOWS\system32\dllcache
2010-10-21 19:13:26 ----D---- C:\Documents and Settings\All Users.WINDOOWS\Data aplikací\Microsoft Help
2010-10-21 19:09:54 ----A---- C:\WINDOOWS\win.ini
2010-10-21 18:18:22 ----D---- C:\WINDOOWS\Help
2010-10-21 18:18:21 ----D---- C:\WINDOOWS\mui
2010-10-19 21:23:03 ----D---- C:\Program Files\Winamp
2010-10-18 19:47:19 ----SD---- C:\Documents and Settings\All Users.WINDOOWS\Data aplikací\Microsoft
2010-10-18 19:10:22 ----D---- C:\WINDOOWS\system32\drivers
2010-10-18 18:26:34 ----D---- C:\Program Files\Common Files\Adobe
2010-10-14 16:02:33 ----D---- C:\Program Files\Opera
2010-10-12 16:00:10 ----D---- C:\Program Files\TeamSpeak 3 Client

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdide;amdide; C:\WINDOOWS\system32\DRIVERS\amdide.sys [2007-10-12 9096]
R0 PxHelp20;PxHelp20; C:\WINDOOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOOWS\system32\DRIVERS\avipbb.sys [2010-11-10 126856]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 ssmdrv;ssmdrv; C:\WINDOOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOOWS\system32\DRIVERS\avgntflt.sys [2010-11-10 60936]
R3 ati2mtag;ati2mtag; C:\WINDOOWS\system32\DRIVERS\ati2mtag.sys [2010-09-18 5386752]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOOWS\system32\drivers\AtiHdmi.sys [2008-05-20 93696]
R3 hamachi;Hamachi Network Interface; C:\WINDOOWS\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOOWS\system32\drivers\RtkHDAud.sys [2008-12-11 4959232]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbser;USB Modem Driver; C:\WINDOOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WpdUsb;WpdUsb; C:\WINDOOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 XDva344;XDva344; \??\C:\WINDOOWS\system32\XDva344.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-11-10 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-11-10 135336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOOWS\system32\Ati2evxx.exe [2010-09-18 606208]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-19 153376]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-07-28 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-08-25 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:\WINDOOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------


info

info.txt logfile of random's system information tool 1.08 2010-11-10 23:29:46

======Uninstall list======

-->C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0405-0000-0000000FF1CE} /uninstall {3C3813E1-C370-4F32-9639-8B43C7C780CD}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040E-0000-0000000FF1CE} /uninstall {685D17E5-D868-4A77-B58E-255DEBA78262}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-041B-0000-0000000FF1CE} /uninstall {F67648A4-713E-4298-BBAD-A83D8283B0F3}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-041B-0000-0000000FF1CE} /uninstall {FE295FA2-72FC-4859-85B3-0E6685DB13A4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00BA-041B-0000-0000000FF1CE} /uninstall {B1A00287-698E-48D0-8C8F-A3387C2B8C45}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Adobe Asset Services CS3-->MsiExec.exe /I{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player 10 Plugin-->C:\WINDOOWS\system32\Macromed\Flash\FlashUtil10k_Plugin.exe -maintain plugin
Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\4977c84bcdc298c444ccfbdcccb660d\Setup.exe
Adobe Reader 8.1.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Setup-->MsiExec.exe /I{0901FCE8-5415-4499-BBC8-1AA106DD66E2}
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Alien Swarm-->"C:\Program Files\Steam\steam.exe" steam://uninstall/630
AMD Processor Driver-->C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x0005 -removeonly
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Catalyst Registration-->MsiExec.exe /X{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}
ATI Parental Control & Encoder-->MsiExec.exe /I{9862B19F-4CAD-4EED-920F-2F378D84393F}
AutocompletePro-->"C:\Program Files\AutocompletePro\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Balíček ovladače systému Windows - Nokia Modem (06/09/2010 4.5)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOOWS\system32\DRVSTORE\nokia_blue_D745A35E775153D4241BCAFD53B508006B129D5F\nokia_bluetooth.inf
Balíček ovladače systému Windows - Nokia Modem (06/09/2010 7.01.0.7)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOOWS\system32\DRVSTORE\nokbtmdm_303CF1FED5DA0A0063DA86B4F733C34AA8C8B2C1\nokbtmdm.inf
Balíček ovladače systému Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\B4723E9A0713E5B1\dpinst.exe /u C:\WINDOOWS\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
Borland C++Builder 6-->MsiExec.exe /I{2864C41B-EF2D-4640-95A2-526276524519}
Catalyst Control Center - Branding-->MsiExec.exe /I{4893A35F-0A23-48EC-8E74-24969244D6F2}
Catalyst Control Center - Branding-->MsiExec.exe /I{DDA34038-89BD-4804-B0B8-DC48D5DFB463}
Conduit Engine-->C:\Program Files\ConduitEngine\ConduitEngineUninstall.exe
Counter-Strike: Source Beta-->"C:\program files\steam\steam.exe" steam://uninstall/260
Counter-Strike: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/240
Counter-Strike: Source-->C:\Program Files\Counter-Strike Source\Uninst.exe
Counter-Strike-->"C:\program files\steam\steam.exe" steam://uninstall/10
Dedicated Server-->"C:\Program Files\Steam\steam.exe" steam://uninstall/5
Fiesta-->"C:\Program Files\InstallShield Installation Information\{E127B28D-1A2A-45C4-A74E-C817E0A74E3E}\setup.exe" -runfromtemp -l0x0009 -removeonly
FIFA 11-->MsiExec.exe /X{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}
Fraps-->"C:\Fraps\uninstall.exe"
Google Talk Plugin-->MsiExec.exe /I{58F58158-8DFE-31DA-AC1F-7E5D89A0F74F}
High Definition Audio Driver Package - KB888111-->"C:\WINDOOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HLSW v1.3.3.7b-->"C:\Program Files\HLSW\unins000.exe"
Hotfix for Windows XP (KB942766-v6)-->"C:\WINDOOWS\$NtUninstallKB942766-v6$\spuninst\spuninst.exe"
ICQ6.5-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 21-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216021FF}
Lame ACM MP3 Codec-->"C:\WINDOOWS\IFinst26.exe" -UC:\Program Files\Lame MP3 Codec\IFU381.inf
LogMeIn Hamachi-->C:\WINDOOWS\system32\\msiexec.exe /i {8A74DEFD-A224-49CC-AB80-4E88BC730125} REMOVE=ALL
LogMeIn Hamachi-->MsiExec.exe /I{8A74DEFD-A224-49CC-AB80-4E88BC730125}
MHD Simulator 2009 - FULL VERSION 1.00-->C:\Program Files\MHDsim2009\Uninstal.exe
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->C:\WINDOOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9-->"C:\WINDOOWS\$NtUninstallWdf01009$\spuninst\spuninst.exe"
Microsoft Office Access MUI (Slovak) 2007-->MsiExec.exe /X{90120000-0015-041B-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISER /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{91120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Slovak) 2007-->MsiExec.exe /X{90120000-0016-041B-0000-0000000FF1CE}
Microsoft Office Groove MUI (Slovak) 2007-->MsiExec.exe /X{90120000-00BA-041B-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Slovak) 2007-->MsiExec.exe /X{90120000-0044-041B-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Slovak) 2007-->MsiExec.exe /X{90120000-00A1-041B-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Slovak) 2007-->MsiExec.exe /X{90120000-001A-041B-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Slovak) 2007-->MsiExec.exe /X{90120000-0018-041B-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Hungarian) 2007-->MsiExec.exe /X{90120000-001F-040E-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Slovak) 2007-->MsiExec.exe /X{90120000-002C-041B-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Slovak) 2007-->MsiExec.exe /X{90120000-0019-041B-0000-0000000FF1CE}
Microsoft Office Shared MUI (Slovak) 2007-->MsiExec.exe /X{90120000-006E-041B-0000-0000000FF1CE}
Microsoft Office Word MUI (Slovak) 2007-->MsiExec.exe /X{90120000-001B-041B-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mp3 Knife 3.2-->"C:\Program Files\Mp3 Knife\unins000.exe"
MSVC80_x86_v2-->MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}
Mumble and Murmur-->C:\Program Files\Mumble\Uninstall.exe
Nero 7 Ultra Edition-->MsiExec.exe /X{91C0B95B-B83A-4828-A775-BBE2DD421029}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NHL® 09-->MsiExec.exe /X{F2B5A2A7-2DF9-4361-8BD5-362714528B51}
Nokia Connectivity Cable Driver-->MsiExec.exe /I{1B9B5B3B-28E7-4E59-A80D-D670AA984514}
Nokia PC Suite-->C:\Documents and Settings\All Users.WINDOOWS\Data aplikací\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_eng_web.exe
Nokia PC Suite-->MsiExec.exe /I{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}
Opera 10.63-->MsiExec.exe /X{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}
OSCAR Editor-->C:\Program Files\InstallShield Installation Information\{21FFDD40-F6B9-4609-B1C9-514E0A342BFA}\setup.exe -runfromtemp -l0x0409
Pando Media Booster-->C:\Program Files\Pando Networks\Media Booster\uninst.exe
PC Connectivity Solution-->MsiExec.exe /I{089DD780-DB3F-4CDB-A0C2-111360247298}
QCad-->C:\Program Files\QCad20\Uninstal.exe
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x5 -removeonly
Samsung Media Studio-->C:\Program Files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\Setup.exe -runfromtemp -l0x0009 -removeonly
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Source Dedicated Server-->"C:\program files\steam\steam.exe" steam://uninstall/205
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 3 Client-->"C:\Program Files\TeamSpeak 3 Client\uninstall.exe"
The KMPlayer (remove only)-->"C:\Program Files\The KMPlayer\uninstall.exe"
ToggleEN Toolbar-->C:\PROGRA~1\ToggleEN\UNWISE.EXE /U C:\PROGRA~1\ToggleEN\INSTALL.LOG
Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe
Traffic City 2.00-->"C:\Program Files\Traffic City 2\unins000.exe"
Traffic City: Eco City-->C:\Program Files\TrafficCity\Uninstal.exe
Traffic Giant-->C:\Program Files\Traffic Giant\Uninstal.exe
VentriloMIX-->C:\Program Files\VentriloMIX\Uninstal.exe
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP Service Pack 3-->"C:\WINDOOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
X-ray Anti-Cheat-->C:\Program Files\X-ray Anti-Cheat\uninstaller.exe
XviD MPEG-4 Video Codec-->"C:\Program Files\XviD\unins000.exe"

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: JJ-7C18951D562A
Event Code: 62464
Message: UVD Information

Record Number: 15256
Source Name: ati2mtag
Time Written: 20101103212347.000000+060
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 62464
Message: UVD Information

Record Number: 15255
Source Name: ati2mtag
Time Written: 20101103212347.000000+060
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 62464
Message: UVD Information

Record Number: 15254
Source Name: ati2mtag
Time Written: 20101103212347.000000+060
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 62464
Message: UVD Information

Record Number: 15253
Source Name: ati2mtag
Time Written: 20101103212347.000000+060
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 62464
Message: UVD Information

Record Number: 15252
Source Name: ati2mtag
Time Written: 20101103212347.000000+060
Event Type: Informace
User:

=====Application event log=====

Computer Name: JJ-7C18951D562A
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 1039
Source Name: SecurityCenter
Time Written: 20100929160647.000000+120
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 1517
Message: Systém Windows uložil registr uživatele JJ-7C18951D562A\janik, ale některá z aplikací nebo služeb během odhlášení registr nadále používala. Paměť používaná registrem uživatele nebyla uvolněna. Registr bude uvolněn, jakmile již nebude používán.


To je často způsobeno tím, že jsou služby spuštěny pomocí uživatelského účtu. Zkuste služby konfigurovat pro spuštění pomocí účtu místní nebo síťové služby.

Record Number: 1038
Source Name: Userenv
Time Written: 20100928234344.000000+120
Event Type: Upozornění
User: NT AUTHORITY\SYSTEM

Computer Name: JJ-7C18951D562A
Event Code: 1000
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 1037
Source Name: LoadPerf
Time Written: 20100928192128.000000+120
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 1001
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně odstraněny.
Data záznamu obsahují nové hodnoty položek Last Counter a
Last Help systémového registru.

Record Number: 1036
Source Name: LoadPerf
Time Written: 20100928192128.000000+120
Event Type: Informace
User:

Computer Name: JJ-7C18951D562A
Event Code: 0
Message:
Record Number: 1035
Source Name: ServiceLayer
Time Written: 20100928192050.000000+120
Event Type: Informace
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\PROGRA~1\Borland\CBUILD~1\Bin;C:\PROGRA~1\Borland\CBUILD~1\Projects\Bpl;C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\WINDOOWS\Microsoft.NET\Framework\v2.0.50727;C:\Program Files\Common Files\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 2 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=0203
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Zdravim a pekny den preji

Uprimne, zaliskane to mate jak jetel

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  motji píše: Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• V zadnem pripade ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

ComboFix 10-11-10.04 - janik 11.11.2010 17:55:40.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2803 [GMT 1:00]
Spuštěný z: c:\documents and settings\janik\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\27.exe
c:\documents and settings\janik\iidryhw.exe
c:\documents and settings\janik\secupdat.dat
c:\documents and settings\jj\Data aplikací\facemoods.com
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\248d6576afce4ee94af42d7350131106.gif
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\24a70fb875fab686b6b3c217612bc07c.gif
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\2afcf6f3f2e19cc42d7f72f3b18b26ef.gif
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\50bffa6936b3e661971a58e3c8bdf4cb.gif
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\default1.dat
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\loading.dat
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Cache\loading.gif
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Cursor.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_DailyVideo.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Game.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Glitter.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Logo.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Option.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Recipe.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Ringtone.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Screensaver.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Search.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Smiley.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Smiley_Config.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Smiley_TellAFriend.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Wallpaper.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_Web.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_01.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_02.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_03.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_04.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_05.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_06.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\Module_WebDropdown_07.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\pixel.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\ProductInfo.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\profile.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\SearchEngineList.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\tbcore.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\ToolbarLayout.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\UpdateCentre.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\UpdateCentreBk.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\URLDynamic.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Data\URLStatic.mx
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\About.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Component_ComboBox.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Cursor.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Cursor.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_DailyVideo.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Game.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Glitter.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Glitter.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Logo.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Option.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Recipe.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Ringtone.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Screensaver.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Search.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Smiley.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Smiley.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Wallpaper.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_Web.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_01.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_01.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_02.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_02.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_03.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_03.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_04.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_04.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_05.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_05.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_06.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_06.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_07.mg
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\Module_WebDropdown_07.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnDefault.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnDisplay.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnDisplay.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnDisplay18.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnDisplay20.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnGlitters.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnGlitters.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnGlitters18.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnGlitters20.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnOption.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnSmiley.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnSmiley.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnSmiley18.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnSmiley20.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnTellFd.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnTellFd.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnTellFd18.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnTellFd20.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnWink.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnWink.png
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnWink18.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Icons\TBBtnWink20.bmp
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\myskin1.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\myskin2.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\myskin3.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\myskin4.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\TellafriendSkin.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\TellafriendSkin_s.skf
c:\documents and settings\jj\Local Settings\Data aplikací\DoubleD\GamingHarbor Toolbar\4.1.2.19770\Skins\ToastSkin.skf
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\components\FFHst.dll
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\components\FFHst.xpt
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.css
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.xul
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\fcmdDef.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\facemoods.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\fb.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\help_16.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\home.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\logo.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\moodsIcon.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\pref.jpg
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\privecy_16_hot.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\stripicons.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\tellafriend.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\Thumbs.db
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\instlgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\Loader.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\mtrprt.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\newTabLgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.xul
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\prefman.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\script-compiler.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\Thumbs.db
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\utils.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\xmlhttprequester.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\defaults\preferences\instlPref.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\defaults\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\chrome.manifest
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\install.rdf
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\vssver.scc
c:\program files\RelevantKnowledge
c:\program files\RelevantKnowledge\MSVCP71.DLL
c:\program files\RelevantKnowledge\MSVCR71.DLL
c:\windoows\system32\muzapp.exe
c:\windoows\system32\secupdat.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-11 do 2010-11-11 )))))))))))))))))))))))))))))))
.

2010-11-11 16:40 . 2010-11-11 16:40 40128 ----a-w- c:\windoows\system32\drivers\zwqjenkx.sys
2010-11-11 16:39 . 2010-11-11 16:39 201216 ----a-w- c:\windoows\system32\jegewib.exe
2010-11-11 16:39 . 2010-11-11 16:39 201216 ----a-w- c:\windoows\system32\dytennouluqu.exe
2010-11-10 22:29 . 2010-11-10 22:29 -------- d-----w- C:\rsit
2010-11-10 17:51 . 2010-11-10 17:51 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Nabídka Start
2010-11-10 05:00 . 2010-11-10 05:00 77824 --sh--r- c:\documents and settings\janik\Data aplikací\juzjf.exe
2010-11-07 11:23 . 2010-11-07 11:23 -------- d-----w- c:\program files\QCad20
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Data aplikací\Softland
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\janik\Data aplikací\Softland
2010-11-05 15:10 . 2010-02-05 14:00 1700352 ----a-w- c:\windoows\system32\GdiPlus.dll
2010-10-25 19:41 . 2010-10-25 19:42 -------- d-----w- c:\program files\Common Files\Borland Shared
2010-10-25 19:41 . 2010-10-25 19:41 -------- d-----w- c:\program files\Borland
2010-10-25 19:35 . 2010-10-25 19:37 -------- d-----w- c:\program files\Borland CBuilder6 Evaluation
2010-10-23 12:50 . 2010-10-23 12:50 -------- d-----w- c:\windoows\system32\XPSViewer
2010-10-23 12:49 . 2007-03-22 18:24 28160 ----a-w- c:\windoows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-23 12:49 . 2006-06-29 11:07 14048 ------w- c:\windoows\system32\spmsg2.dll
2010-10-23 12:48 . 2010-10-25 16:23 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Deployment
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\ar-sa
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\pt-br
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\bg-bg
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-cn
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-tw
2010-10-18 18:47 . 2010-10-18 18:47 -------- d-----w- c:\documents and settings\janik\Data aplikací\Leadertech
2010-10-18 18:37 . 2010-10-27 21:45 -------- d-----w- c:\program files\EA Sports
2010-10-18 18:10 . 2010-11-10 23:24 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-11-11 17:03 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-10-18 18:10 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\ToggleEN
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Conduit
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ConduitEngine
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ToggleEN
2010-10-18 17:48 . 2010-10-18 18:17 -------- d-----w- c:\program files\Traffic Giant
2010-10-15 14:08 . 2010-10-15 14:08 -------- d-----w- c:\program files\TrafficCity
2010-10-14 20:24 . 2010-10-14 20:25 -------- d-----w- c:\program files\MHDsim2009
2010-10-14 16:56 . 2010-10-14 16:56 -------- d-----w- c:\program files\Traffic City 2
2010-10-12 17:10 . 2010-10-12 17:14 -------- d-----w- c:\documents and settings\janik\Data aplikací\ICQ
2010-10-12 17:10 . 2010-10-12 17:14 -------- d-----w- c:\program files\ICQ6.5

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-10 17:50 . 2010-08-15 09:36 60936 ----a-w- c:\windoows\system32\drivers\avgntflt.sys
2010-11-10 17:50 . 2010-08-15 09:36 126856 ----a-w- c:\windoows\system32\drivers\avipbb.sys
2010-09-20 20:32 . 2010-09-20 20:32 65024 ----a-w- c:\windoows\IFinst26.exe
2010-09-19 17:28 . 2010-09-19 17:28 73728 ----a-w- c:\windoows\system32\javacpl.cpl
2010-09-19 17:28 . 2010-09-19 17:28 423656 ----a-w- c:\windoows\system32\deployJava1.dll
2010-09-18 20:23 . 2008-10-25 05:14 5386752 ----a-w- c:\windoows\system32\drivers\ati2mtag.sys
2010-09-18 20:23 . 2008-10-25 02:11 26112 ----a-w- c:\windoows\system32\Ati2mdxx.exe
2010-09-18 20:23 . 2008-10-25 01:20 188416 ----a-w- c:\windoows\system32\atiadlxx.dll
2010-09-18 20:23 . 2008-10-21 16:40 294912 ----a-w- c:\windoows\system32\ATIODE.exe
2010-09-18 20:23 . 2008-10-25 02:08 53248 ----a-w- c:\windoows\system32\ATIDDC.DLL
2010-09-18 20:23 . 2008-10-25 01:18 53248 ----a-w- c:\windoows\system32\drivers\ati2erec.dll
2010-09-18 20:23 . 2008-10-25 01:12 688128 ----a-w- c:\windoows\system32\ati2cqag.dll
2010-09-18 20:23 . 2008-10-25 01:21 626688 ----a-w- c:\windoows\system32\atikvmag.dll
2010-09-18 20:23 . 2010-09-18 20:46 53248 ----a-w- c:\windoows\system32\aticalcl.dll
2010-09-18 20:23 . 2008-10-25 01:58 3927936 ----a-w- c:\windoows\system32\ati3duag.dll
2010-09-18 20:23 . 2008-10-25 02:11 43520 ----a-w- c:\windoows\system32\ati2edxx.dll
2010-09-18 20:23 . 2001-11-09 15:01 24064 ----a-w- c:\windoows\system32\ativcoxx.dll
2010-09-18 20:23 . 2008-10-25 02:10 15876096 ----a-w- c:\windoows\system32\atioglxx.dll
2010-09-18 20:22 . 2010-08-10 21:27 450560 ----a-w- c:\windoows\system32\ATIDEMGX.dll
2010-09-18 20:22 . 2010-09-18 20:46 143360 ----a-w- c:\windoows\system32\atiapfxx.exe
2010-09-18 20:22 . 2010-09-18 20:46 4390912 ----a-w- c:\windoows\system32\aticaldd.dll
2010-09-18 20:22 . 2008-10-21 16:40 45056 ----a-w- c:\windoows\system32\ATIODCLI.exe
2010-09-18 20:22 . 2008-10-25 01:19 17408 ----a-w- c:\windoows\system32\atitvo32.dll
2010-09-18 20:21 . 2010-09-18 20:46 64512 ----a-w- c:\windoows\system32\atimpc32.dll
2010-09-18 20:21 . 2008-10-25 01:25 64512 ----a-w- c:\windoows\system32\amdpcom32.dll
2010-09-18 20:21 . 2008-10-25 01:18 393216 ----a-w- c:\windoows\system32\atiok3x2.dll
2010-09-18 20:21 . 2010-09-18 20:46 57344 ----a-w- c:\windoows\system32\aticalrt.dll
2010-09-18 20:21 . 2008-10-25 02:11 208896 ----a-w- c:\windoows\system32\atipdlxx.dll
2010-09-18 20:21 . 2008-10-25 01:41 2603520 ----a-w- c:\windoows\system32\ativvaxx.dll
2010-09-18 20:21 . 2008-10-25 02:09 606208 ----a-w- c:\windoows\system32\ati2evxx.exe
2010-09-18 20:21 . 2010-08-10 21:27 311296 ----a-w- c:\windoows\system32\atiiiexx.dll
2010-09-18 20:20 . 2008-10-25 02:11 155648 ----a-w- c:\windoows\system32\Oemdspif.dll
2010-09-18 20:20 . 2008-10-25 02:11 159744 ----a-w- c:\windoows\system32\ati2evxx.dll
2010-09-18 20:20 . 2010-09-18 20:46 118784 ----a-w- c:\windoows\system32\atibtmon.exe
2010-09-18 20:20 . 2008-10-25 02:22 300544 ----a-w- c:\windoows\system32\ati2dvag.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OscarEditor"="c:\program files\OSCAR Editor\OscarEditor.exe" [2009-06-16 3331584]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-09-14 2969496]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"Google Update"="c:\documents and settings\janik\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-11-08 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-10 281768]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"MAAgent"="c:\program files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 57344]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"serou"="c:\windoows\system32\dytennouluqu.exe" [2010-11-11 201216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windoows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\jj\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\janik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0kkfwwr.exe [2010-11-10 60416]
0rnii6u.exe [2010-11-11 60416]
60jefk8.exe [2010-11-11 60416]
6ss6ee6.exe [2010-11-10 60416]
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
dtz66q81.exe [2010-11-11 60416]
fbww6ii6.exe [2010-11-11 60416]
fwwriidu.exe [2010-11-11 60416]
g6ss6ee6.exe [2010-11-10 60416]
k1gccxoo.exe [2010-11-10 60416]
k9g1cyytkk.exe [2010-11-10 60416]
kfwwriiduu.exe [2010-11-10 60416]
kvglwhy1o.exe [2010-11-10 60416]
l0rnii6uu.exe [2010-11-11 60416]
lgg6ss6ee.exe [2010-11-10 60416]
lhxxtjjf.exe [2010-11-10 60416]
mmhyytkkfw.exe [2010-11-10 60416]
o9k1gccxoo.exe [2010-11-10 60416]
sty81kvm1c.exe [2010-11-11 60416]
x08708708.exe [2010-11-11 60416]
za70bxss6e.exe [2010-11-10 60416]
zvllhxxt.exe [2010-11-10 60416]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\zwqjenkx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 01:06 40048 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
2007-02-23 14:32 126976 ----a-w- c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-09-24 18:54 1242448 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\steamapps\\tomx1\\counter-strike\\hl.exe"=
"c:\\Program Files\\Traffic Giant\\trafficgiant.exe"=
"c:\\WINDOOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\EA Sports\\NHL 09\\nhl2009.exe"=
"c:\\Documents and Settings\\janik\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57891:TCP"= 57891:TCP:Pando Media Booster
"57891:UDP"= 57891:UDP:Pando Media Booster

R0 zwqjenkx;zwqjenkx;c:\windoows\system32\drivers\zwqjenkx.sys [11.11.2010 17:40 40128]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19.9.2009 21:13 135336]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 10:16 1107336]
S2 oooe4heaqeidyej;BCL easyPDF SDK Loader;c:\windoows\system32\jegewib.exe [11.11.2010 17:39 201216]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windoows\system32\drivers\nmwcdnsu.sys [20.8.2010 0:55 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windoows\system32\drivers\nmwcdnsuc.sys [20.8.2010 0:55 8320]
S3 XDva344;XDva344;\??\c:\windoows\system32\XDva344.sys --> c:\windoows\system32\XDva344.sys [?]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - OOOE4HEAQEIDYEJ
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://fullarticles.net
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{038cb5c7-48ea-4af9-94e0-a1646542e62b} - (no file)
Toolbar-{038cb5c7-48ea-4af9-94e0-a1646542e62b} - (no file)
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{038CB5C7-48EA-4AF9-94E0-A1646542E62B} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-11 18:03
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\windoows\system32\Ati2evxx.dll
c:\windoows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(4004)
c:\program files\MarkAny\ContentSafer\MaCSProHook.DLL
c:\program files\OSCAR Editor\Win32Share.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windoows\system32\Ati2evxx.exe
c:\windoows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windoows\RTHDCPL.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windoows\system32\wdfmgr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windoows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-11-11 18:17:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-11 17:17
ComboFix2.txt 2010-03-07 20:49
ComboFix3.txt 2010-03-07 19:37

Před spuštěním: Volných bajtů: 145 418 452 992
Po spuštění: Volných bajtů: 146 591 748 096

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 1DEF2176C36B8876A6944502A71F8355

V nasledujicim kroku bude ComboFix posilat vzorky haveti na server k sUBSovi - autorovi CFka - slouzi to pro dalsi vyvoj utility, tak jen abyste vedel co se kam posila

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Collect::
  c:\windoows\system32\drivers\zwqjenkx.sys
  c:\windoows\system32\jegewib.exe
  c:\windoows\system32\dytennouluqu.exe
  c:\documents and settings\janik\Data aplikací\juzjf.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0kkfwwr.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0rnii6u.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\60jefk8.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\6ss6ee6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\dtz66q81.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fbww6ii6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fwwriidu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\g6ss6ee6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k1gccxoo.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k9g1cyytkk.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kfwwriiduu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kvglwhy1o.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\l0rnii6uu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lgg6ss6ee.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lhxxtjjf.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\mmhyytkkfw.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\o9k1gccxoo.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\sty81kvm1c.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\x08708708.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\za70bxss6e.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\zvllhxxt.exe
  
  File::
  C:\WINDOOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003Core.job
  C:\WINDOOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003UA.job
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\Adobe Gamma.lnk
  
  Driver::
  zwqjenkx
  oooe4heaqeidyej
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "OscarEditor"=-
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
  "Google Update"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NeroFilterCheck"=-
  "serou"=-
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\zwqjenkx.sys]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  
  DDS::
  uStart Page = hxxp://fullarticles.net
  

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

ComboFix 10-11-10.04 - janik 12.11.2010 10:44:56.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2819 [GMT 1:00]
Spuštěný z: c:\documents and settings\janik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\janik\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\Adobe Gamma.lnk"
"c:\windoows\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003Core.job"
"c:\windoows\tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1202660629-839522115-1003UA.job"

file zipped: c:\documents and settings\janik\Data aplikací\juzjf.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\0kkfwwr.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\0rnii6u.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\60jefk8.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\6ss6ee6.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\dtz66q81.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\fbww6ii6.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\fwwriidu.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\g6ss6ee6.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\k1gccxoo.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\k9g1cyytkk.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\kfwwriiduu.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\kvglwhy1o.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\l0rnii6uu.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\lgg6ss6ee.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\lhxxtjjf.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\mmhyytkkfw.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\o9k1gccxoo.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\sty81kvm1c.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\x08708708.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\za70bxss6e.exe
file zipped: c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\zvllhxxt.exe
file zipped: c:\windoows\system32\drivers\zwqjenkx.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windoows\system32\drivers\zwqjenkx.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OOOE4HEAQEIDYEJ
-------\Legacy_ZWQJENKX
-------\Service_oooe4heaqeidyej
-------\Service_zwqjenkx


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-12 do 2010-11-12 )))))))))))))))))))))))))))))))
.

2010-11-10 22:29 . 2010-11-10 22:29 -------- d-----w- C:\rsit
2010-11-10 17:51 . 2010-11-10 17:51 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Nabídka Start
2010-11-10 05:00 . 2010-11-10 05:00 77824 --sha-r- c:\documents and settings\janik\Data aplikací\juzjf.exe
2010-11-07 11:23 . 2010-11-07 11:23 -------- d-----w- c:\program files\QCad20
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Data aplikací\Softland
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\janik\Data aplikací\Softland
2010-11-05 15:10 . 2010-02-05 14:00 1700352 ----a-w- c:\windoows\system32\GdiPlus.dll
2010-10-25 19:41 . 2010-10-25 19:42 -------- d-----w- c:\program files\Common Files\Borland Shared
2010-10-25 19:41 . 2010-10-25 19:41 -------- d-----w- c:\program files\Borland
2010-10-25 19:35 . 2010-10-25 19:37 -------- d-----w- c:\program files\Borland CBuilder6 Evaluation
2010-10-23 12:50 . 2010-10-23 12:50 -------- d-----w- c:\windoows\system32\XPSViewer
2010-10-23 12:49 . 2007-03-22 18:24 28160 ----a-w- c:\windoows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-23 12:49 . 2006-06-29 11:07 14048 ------w- c:\windoows\system32\spmsg2.dll
2010-10-23 12:48 . 2010-10-25 16:23 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Deployment
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\ar-sa
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\pt-br
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\bg-bg
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-cn
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-tw
2010-10-18 18:47 . 2010-10-18 18:47 -------- d-----w- c:\documents and settings\janik\Data aplikací\Leadertech
2010-10-18 18:37 . 2010-10-27 21:45 -------- d-----w- c:\program files\EA Sports
2010-10-18 18:10 . 2010-11-10 23:24 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-11-12 09:50 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-10-18 18:10 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\ToggleEN
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Conduit
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ConduitEngine
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ToggleEN
2010-10-18 17:48 . 2010-10-18 18:17 -------- d-----w- c:\program files\Traffic Giant
2010-10-15 14:08 . 2010-10-15 14:08 -------- d-----w- c:\program files\TrafficCity
2010-10-14 20:24 . 2010-10-14 20:25 -------- d-----w- c:\program files\MHDsim2009
2010-10-14 16:56 . 2010-10-14 16:56 -------- d-----w- c:\program files\Traffic City 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-10 17:50 . 2010-08-15 09:36 60936 ----a-w- c:\windoows\system32\drivers\avgntflt.sys
2010-11-10 17:50 . 2010-08-15 09:36 126856 ----a-w- c:\windoows\system32\drivers\avipbb.sys
2010-09-20 20:32 . 2010-09-20 20:32 65024 ----a-w- c:\windoows\IFinst26.exe
2010-09-19 17:28 . 2010-09-19 17:28 73728 ----a-w- c:\windoows\system32\javacpl.cpl
2010-09-19 17:28 . 2010-09-19 17:28 423656 ----a-w- c:\windoows\system32\deployJava1.dll
2010-09-18 20:23 . 2008-10-25 05:14 5386752 ----a-w- c:\windoows\system32\drivers\ati2mtag.sys
2010-09-18 20:23 . 2008-10-25 02:11 26112 ----a-w- c:\windoows\system32\Ati2mdxx.exe
2010-09-18 20:23 . 2008-10-25 01:20 188416 ----a-w- c:\windoows\system32\atiadlxx.dll
2010-09-18 20:23 . 2008-10-21 16:40 294912 ----a-w- c:\windoows\system32\ATIODE.exe
2010-09-18 20:23 . 2008-10-25 02:08 53248 ----a-w- c:\windoows\system32\ATIDDC.DLL
2010-09-18 20:23 . 2008-10-25 01:18 53248 ----a-w- c:\windoows\system32\drivers\ati2erec.dll
2010-09-18 20:23 . 2008-10-25 01:12 688128 ----a-w- c:\windoows\system32\ati2cqag.dll
2010-09-18 20:23 . 2008-10-25 01:21 626688 ----a-w- c:\windoows\system32\atikvmag.dll
2010-09-18 20:23 . 2010-09-18 20:46 53248 ----a-w- c:\windoows\system32\aticalcl.dll
2010-09-18 20:23 . 2008-10-25 01:58 3927936 ----a-w- c:\windoows\system32\ati3duag.dll
2010-09-18 20:23 . 2008-10-25 02:11 43520 ----a-w- c:\windoows\system32\ati2edxx.dll
2010-09-18 20:23 . 2001-11-09 15:01 24064 ----a-w- c:\windoows\system32\ativcoxx.dll
2010-09-18 20:23 . 2008-10-25 02:10 15876096 ----a-w- c:\windoows\system32\atioglxx.dll
2010-09-18 20:22 . 2010-08-10 21:27 450560 ----a-w- c:\windoows\system32\ATIDEMGX.dll
2010-09-18 20:22 . 2010-09-18 20:46 143360 ----a-w- c:\windoows\system32\atiapfxx.exe
2010-09-18 20:22 . 2010-09-18 20:46 4390912 ----a-w- c:\windoows\system32\aticaldd.dll
2010-09-18 20:22 . 2008-10-21 16:40 45056 ----a-w- c:\windoows\system32\ATIODCLI.exe
2010-09-18 20:22 . 2008-10-25 01:19 17408 ----a-w- c:\windoows\system32\atitvo32.dll
2010-09-18 20:21 . 2010-09-18 20:46 64512 ----a-w- c:\windoows\system32\atimpc32.dll
2010-09-18 20:21 . 2008-10-25 01:25 64512 ----a-w- c:\windoows\system32\amdpcom32.dll
2010-09-18 20:21 . 2008-10-25 01:18 393216 ----a-w- c:\windoows\system32\atiok3x2.dll
2010-09-18 20:21 . 2010-09-18 20:46 57344 ----a-w- c:\windoows\system32\aticalrt.dll
2010-09-18 20:21 . 2008-10-25 02:11 208896 ----a-w- c:\windoows\system32\atipdlxx.dll
2010-09-18 20:21 . 2008-10-25 01:41 2603520 ----a-w- c:\windoows\system32\ativvaxx.dll
2010-09-18 20:21 . 2008-10-25 02:09 606208 ----a-w- c:\windoows\system32\ati2evxx.exe
2010-09-18 20:21 . 2010-08-10 21:27 311296 ----a-w- c:\windoows\system32\atiiiexx.dll
2010-09-18 20:20 . 2008-10-25 02:11 155648 ----a-w- c:\windoows\system32\Oemdspif.dll
2010-09-18 20:20 . 2008-10-25 02:11 159744 ----a-w- c:\windoows\system32\ati2evxx.dll
2010-09-18 20:20 . 2010-09-18 20:46 118784 ----a-w- c:\windoows\system32\atibtmon.exe
2010-09-18 20:20 . 2008-10-25 02:22 300544 ----a-w- c:\windoows\system32\ati2dvag.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-11_17.01.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-12 09:50 . 2010-11-12 09:50 16384 c:\windoows\Temp\Perflib_Perfdata_4b0.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 68404 c:\windoows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-11-12 08:59 68404 c:\windoows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 79000 c:\windoows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2010-11-12 08:59 79000 c:\windoows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2010-11-12 08:59 435760 c:\windoows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 435760 c:\windoows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 432110 c:\windoows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2010-11-12 08:59 432110 c:\windoows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-09-14 2969496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-10 281768]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"MAAgent"="c:\program files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 57344]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windoows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\jj\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\janik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0kkfwwr.exe [2010-11-10 60416]
0rnii6u.exe [2010-11-11 60416]
60jefk8.exe [2010-11-11 60416]
6ss6ee6.exe [2010-11-10 60416]
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
dtz66q81.exe [2010-11-11 60416]
fbww6ii6.exe [2010-11-11 60416]
fwwriidu.exe [2010-11-11 60416]
g6ss6ee6.exe [2010-11-10 60416]
k1gccxoo.exe [2010-11-10 60416]
k9g1cyytkk.exe [2010-11-10 60416]
kfwwriiduu.exe [2010-11-10 60416]
kvglwhy1o.exe [2010-11-10 60416]
l0rnii6uu.exe [2010-11-11 60416]
lgg6ss6ee.exe [2010-11-10 60416]
lhxxtjjf.exe [2010-11-10 60416]
mmhyytkkfw.exe [2010-11-10 60416]
o9k1gccxoo.exe [2010-11-10 60416]
sty81kvm1c.exe [2010-11-11 60416]
x08708708.exe [2010-11-11 60416]
za70bxss6e.exe [2010-11-10 60416]
zvllhxxt.exe [2010-11-10 60416]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\steamapps\\tomx1\\counter-strike\\hl.exe"=
"c:\\Program Files\\Traffic Giant\\trafficgiant.exe"=
"c:\\WINDOOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\EA Sports\\NHL 09\\nhl2009.exe"=
"c:\\Documents and Settings\\janik\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57891:TCP"= 57891:TCP:Pando Media Booster
"57891:UDP"= 57891:UDP:Pando Media Booster

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19.9.2009 21:13 135336]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 10:16 1107336]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windoows\system32\drivers\nmwcdnsu.sys [20.8.2010 0:55 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windoows\system32\drivers\nmwcdnsuc.sys [20.8.2010 0:55 8320]
S3 XDva344;XDva344;\??\c:\windoows\system32\XDva344.sys --> c:\windoows\system32\XDva344.sys [?]
.
.
------- Doplňkový sken -------
.
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-12 10:51
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windoows\system32\Ati2evxx.dll
c:\windoows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(3068)
c:\program files\MarkAny\ContentSafer\MaCSProHook.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windoows\system32\Ati2evxx.exe
c:\windoows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windoows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windoows\system32\wdfmgr.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windoows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-11-12 10:56:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-12 09:56
ComboFix2.txt 2010-11-11 17:17
ComboFix3.txt 2010-03-07 20:49
ComboFix4.txt 2010-03-07 19:37

Před spuštěním: Volných bajtů: 146 729 762 816
Po spuštění: Volných bajtů: 146 631 598 080

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - B9548A29383A7971A2E0933EDE8ED870
Nahr nˇ probŘhlo ŁspŘçnŘ

Skript nejak nepromazal co mel

Takze jeste jeden skript pro CF - postup opet stejny: vytvorit skript, pretahnout nad CF, log nasypat pak sem

ComboFix 10-11-10.04 - janik 12.11.2010 13:27:53.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2741 [GMT 1:00]
Spuštěný z: c:\documents and settings\janik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\janik\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\janik\Data aplikací\juzjf.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\0kkfwwr.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\0rnii6u.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\60jefk8.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\6ss6ee6.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\dtz66q81.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\fbww6ii6.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\fwwriidu.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\g6ss6ee6.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\k1gccxoo.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\k9g1cyytkk.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\kfwwriiduu.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\kvglwhy1o.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\l0rnii6uu.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\lgg6ss6ee.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\lhxxtjjf.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\mmhyytkkfw.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\o9k1gccxoo.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\sty81kvm1c.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\x08708708.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\za70bxss6e.exe"
"c:\documents and settings\janik\Nabídka Start\Programy\Po spuštění\zvllhxxt.exe"
"c:\windoows\system32\drivers\zwqjenkx.sys"
"c:\windoows\system32\dytennouluqu.exe"
"c:\windoows\system32\jegewib.exe"
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-12 do 2010-11-12 )))))))))))))))))))))))))))))))
.

2010-11-10 22:29 . 2010-11-10 22:29 -------- d-----w- C:\rsit
2010-11-10 17:51 . 2010-11-10 17:51 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Nabídka Start
2010-11-10 05:00 . 2010-11-10 05:00 77824 --sha-r- c:\documents and settings\janik\Data aplikací\juzjf.exe
2010-11-07 11:23 . 2010-11-07 11:23 -------- d-----w- c:\program files\QCad20
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Data aplikací\Softland
2010-11-05 15:11 . 2010-11-05 15:11 -------- d-----w- c:\documents and settings\janik\Data aplikací\Softland
2010-11-05 15:10 . 2010-02-05 14:00 1700352 ----a-w- c:\windoows\system32\GdiPlus.dll
2010-10-25 19:41 . 2010-10-25 19:42 -------- d-----w- c:\program files\Common Files\Borland Shared
2010-10-25 19:41 . 2010-10-25 19:41 -------- d-----w- c:\program files\Borland
2010-10-25 19:35 . 2010-10-25 19:37 -------- d-----w- c:\program files\Borland CBuilder6 Evaluation
2010-10-23 12:50 . 2010-10-23 12:50 -------- d-----w- c:\windoows\system32\XPSViewer
2010-10-23 12:49 . 2007-03-22 18:24 28160 ----a-w- c:\windoows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-23 12:49 . 2006-06-29 11:07 14048 ------w- c:\windoows\system32\spmsg2.dll
2010-10-23 12:48 . 2010-10-25 16:23 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Deployment
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\ar-sa
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\pt-br
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\bg-bg
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-cn
2010-10-21 17:19 . 2010-10-21 17:19 -------- d-----w- c:\windoows\system32\zh-tw
2010-10-18 18:47 . 2010-10-18 18:47 -------- d-----w- c:\documents and settings\janik\Data aplikací\Leadertech
2010-10-18 18:37 . 2010-10-27 21:45 -------- d-----w- c:\program files\EA Sports
2010-10-18 18:10 . 2010-11-12 12:20 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-11-12 12:33 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Data aplikací\LogMeIn Hamachi
2010-10-18 18:10 . 2010-10-18 18:10 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\ToggleEN
2010-10-18 18:07 . 2010-10-30 15:11 -------- d-----w- c:\documents and settings\janik\Local Settings\Data aplikací\Conduit
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ConduitEngine
2010-10-18 18:07 . 2010-11-11 16:40 -------- d-----w- c:\program files\ToggleEN
2010-10-18 17:48 . 2010-10-18 18:17 -------- d-----w- c:\program files\Traffic Giant
2010-10-15 14:08 . 2010-10-15 14:08 -------- d-----w- c:\program files\TrafficCity
2010-10-14 20:24 . 2010-10-14 20:25 -------- d-----w- c:\program files\MHDsim2009
2010-10-14 16:56 . 2010-10-14 16:56 -------- d-----w- c:\program files\Traffic City 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-10 17:50 . 2010-08-15 09:36 60936 ----a-w- c:\windoows\system32\drivers\avgntflt.sys
2010-11-10 17:50 . 2010-08-15 09:36 126856 ----a-w- c:\windoows\system32\drivers\avipbb.sys
2010-09-20 20:32 . 2010-09-20 20:32 65024 ----a-w- c:\windoows\IFinst26.exe
2010-09-19 17:28 . 2010-09-19 17:28 73728 ----a-w- c:\windoows\system32\javacpl.cpl
2010-09-19 17:28 . 2010-09-19 17:28 423656 ----a-w- c:\windoows\system32\deployJava1.dll
2010-09-18 20:23 . 2008-10-25 05:14 5386752 ----a-w- c:\windoows\system32\drivers\ati2mtag.sys
2010-09-18 20:23 . 2008-10-25 02:11 26112 ----a-w- c:\windoows\system32\Ati2mdxx.exe
2010-09-18 20:23 . 2008-10-25 01:20 188416 ----a-w- c:\windoows\system32\atiadlxx.dll
2010-09-18 20:23 . 2008-10-21 16:40 294912 ----a-w- c:\windoows\system32\ATIODE.exe
2010-09-18 20:23 . 2008-10-25 02:08 53248 ----a-w- c:\windoows\system32\ATIDDC.DLL
2010-09-18 20:23 . 2008-10-25 01:18 53248 ----a-w- c:\windoows\system32\drivers\ati2erec.dll
2010-09-18 20:23 . 2008-10-25 01:12 688128 ----a-w- c:\windoows\system32\ati2cqag.dll
2010-09-18 20:23 . 2008-10-25 01:21 626688 ----a-w- c:\windoows\system32\atikvmag.dll
2010-09-18 20:23 . 2010-09-18 20:46 53248 ----a-w- c:\windoows\system32\aticalcl.dll
2010-09-18 20:23 . 2008-10-25 01:58 3927936 ----a-w- c:\windoows\system32\ati3duag.dll
2010-09-18 20:23 . 2008-10-25 02:11 43520 ----a-w- c:\windoows\system32\ati2edxx.dll
2010-09-18 20:23 . 2001-11-09 15:01 24064 ----a-w- c:\windoows\system32\ativcoxx.dll
2010-09-18 20:23 . 2008-10-25 02:10 15876096 ----a-w- c:\windoows\system32\atioglxx.dll
2010-09-18 20:22 . 2010-08-10 21:27 450560 ----a-w- c:\windoows\system32\ATIDEMGX.dll
2010-09-18 20:22 . 2010-09-18 20:46 143360 ----a-w- c:\windoows\system32\atiapfxx.exe
2010-09-18 20:22 . 2010-09-18 20:46 4390912 ----a-w- c:\windoows\system32\aticaldd.dll
2010-09-18 20:22 . 2008-10-21 16:40 45056 ----a-w- c:\windoows\system32\ATIODCLI.exe
2010-09-18 20:22 . 2008-10-25 01:19 17408 ----a-w- c:\windoows\system32\atitvo32.dll
2010-09-18 20:21 . 2010-09-18 20:46 64512 ----a-w- c:\windoows\system32\atimpc32.dll
2010-09-18 20:21 . 2008-10-25 01:25 64512 ----a-w- c:\windoows\system32\amdpcom32.dll
2010-09-18 20:21 . 2008-10-25 01:18 393216 ----a-w- c:\windoows\system32\atiok3x2.dll
2010-09-18 20:21 . 2010-09-18 20:46 57344 ----a-w- c:\windoows\system32\aticalrt.dll
2010-09-18 20:21 . 2008-10-25 02:11 208896 ----a-w- c:\windoows\system32\atipdlxx.dll
2010-09-18 20:21 . 2008-10-25 01:41 2603520 ----a-w- c:\windoows\system32\ativvaxx.dll
2010-09-18 20:21 . 2008-10-25 02:09 606208 ----a-w- c:\windoows\system32\ati2evxx.exe
2010-09-18 20:21 . 2010-08-10 21:27 311296 ----a-w- c:\windoows\system32\atiiiexx.dll
2010-09-18 20:20 . 2008-10-25 02:11 155648 ----a-w- c:\windoows\system32\Oemdspif.dll
2010-09-18 20:20 . 2008-10-25 02:11 159744 ----a-w- c:\windoows\system32\ati2evxx.dll
2010-09-18 20:20 . 2010-09-18 20:46 118784 ----a-w- c:\windoows\system32\atibtmon.exe
2010-09-18 20:20 . 2008-10-25 02:22 300544 ----a-w- c:\windoows\system32\ati2dvag.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-11_17.01.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-12 12:33 . 2010-11-12 12:33 16384 c:\windoows\temp\Perflib_Perfdata_1b0.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 68404 c:\windoows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-11-12 09:54 68404 c:\windoows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 79000 c:\windoows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2010-11-12 09:54 79000 c:\windoows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2010-11-12 09:54 435760 c:\windoows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 435760 c:\windoows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-11-11 15:59 432110 c:\windoows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2010-11-12 09:54 432110 c:\windoows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-09-14 2969496]
"OscarEditor"="c:\program files\OSCAR Editor\OscarEditor.exe" [2009-06-16 3331584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-10 281768]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"MAAgent"="c:\program files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 57344]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windoows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\jj\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\janik\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0kkfwwr.exe [2010-11-10 60416]
0rnii6u.exe [2010-11-11 60416]
60jefk8.exe [2010-11-11 60416]
6ss6ee6.exe [2010-11-10 60416]
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
dtz66q81.exe [2010-11-11 60416]
fbww6ii6.exe [2010-11-11 60416]
fwwriidu.exe [2010-11-11 60416]
g6ss6ee6.exe [2010-11-10 60416]
k1gccxoo.exe [2010-11-10 60416]
k9g1cyytkk.exe [2010-11-10 60416]
kfwwriiduu.exe [2010-11-10 60416]
kvglwhy1o.exe [2010-11-10 60416]
l0rnii6uu.exe [2010-11-11 60416]
lgg6ss6ee.exe [2010-11-10 60416]
lhxxtjjf.exe [2010-11-10 60416]
mmhyytkkfw.exe [2010-11-10 60416]
o9k1gccxoo.exe [2010-11-10 60416]
sty81kvm1c.exe [2010-11-11 60416]
x08708708.exe [2010-11-11 60416]
za70bxss6e.exe [2010-11-10 60416]
zvllhxxt.exe [2010-11-10 60416]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\steamapps\\tomx1\\counter-strike\\hl.exe"=
"c:\\Program Files\\Traffic Giant\\trafficgiant.exe"=
"c:\\WINDOOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\EA Sports\\NHL 09\\nhl2009.exe"=
"c:\\Documents and Settings\\janik\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57891:TCP"= 57891:TCP:Pando Media Booster
"57891:UDP"= 57891:UDP:Pando Media Booster

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19.9.2009 21:13 135336]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 10:16 1107336]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windoows\system32\drivers\nmwcdnsu.sys [20.8.2010 0:55 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windoows\system32\drivers\nmwcdnsuc.sys [20.8.2010 0:55 8320]
S3 XDva344;XDva344;\??\c:\windoows\system32\XDva344.sys --> c:\windoows\system32\XDva344.sys [?]
.
.
------- Doplňkový sken -------
.
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-12 13:33
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(768)
c:\windoows\system32\Ati2evxx.dll
c:\windoows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(2940)
c:\program files\MarkAny\ContentSafer\MaCSProHook.DLL
c:\program files\OSCAR Editor\Win32Share.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windoows\system32\Ati2evxx.exe
c:\windoows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windoows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windoows\system32\wdfmgr.exe
c:\windoows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-11-12 13:38:30 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-12 12:38
ComboFix2.txt 2010-11-12 09:57
ComboFix3.txt 2010-11-11 17:17
ComboFix4.txt 2010-03-07 20:49
ComboFix5.txt 2010-11-12 12:21

Před spuštěním: Volných bajtů: 146 621 468 672
Po spuštění: Volných bajtů: 146 607 747 072

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 7B87398B8A79CE18579F35B706212746

Mrcha se nechce smazat

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :files
  c:\windoows\system32\drivers\zwqjenkx.sys
  c:\windoows\system32\jegewib.exe
  c:\windoows\system32\dytennouluqu.exe
  c:\documents and settings\janik\Data aplikací\juzjf.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0kkfwwr.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0rnii6u.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\60jefk8.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\6ss6ee6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\dtz66q81.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fbww6ii6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fwwriidu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\g6ss6ee6.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k1gccxoo.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k9g1cyytkk.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kfwwriiduu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kvglwhy1o.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\l0rnii6uu.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lgg6ss6ee.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lhxxtjjf.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\mmhyytkkfw.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\o9k1gccxoo.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\sty81kvm1c.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\x08708708.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\za70bxss6e.exe
  C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\zvllhxxt.exe
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp /s
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

All processes killed
========== FILES ==========
File/Folder c:\windoows\system32\drivers\zwqjenkx.sys not found.
File/Folder c:\windoows\system32\jegewib.exe not found.
File/Folder c:\windoows\system32\dytennouluqu.exe not found.
c:\documents and settings\janik\Data aplikací\juzjf.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0kkfwwr.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\0rnii6u.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\60jefk8.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\6ss6ee6.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\dtz66q81.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fbww6ii6.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\fwwriidu.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\g6ss6ee6.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k1gccxoo.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\k9g1cyytkk.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kfwwriiduu.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\kvglwhy1o.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\l0rnii6uu.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lgg6ss6ee.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\lhxxtjjf.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\mmhyytkkfw.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\o9k1gccxoo.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\sty81kvm1c.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\x08708708.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\za70bxss6e.exe moved successfully.
C:\Documents and Settings\janik\Nabídka Start\Programy\Po spuštění\zvllhxxt.exe moved successfully.
File/Folder C:\WINDOOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOOWS\system32\SET*.tmp not found.
C:\WINDOOWS\002695_.tmp moved successfully.
C:\WINDOOWS\msdownld.tmp folder moved successfully.
C:\WINDOOWS\SET3.tmp moved successfully.
C:\WINDOOWS\SET4.tmp moved successfully.
C:\WINDOOWS\SET8.tmp moved successfully.
C:\WINDOOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP67D.tmp folder moved successfully.
C:\WINDOOWS\system32\CONFIG.TMP moved successfully.
========== COMMANDS ==========
C:\WINDOOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: All Users.WINDOOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: janik
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49219 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 38507583 bytes
->Opera cache emptied: 27799612 bytes
->Flash cache emptied: 4840 bytes

User: jj
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 37362 bytes
->FireFox cache emptied: 40458938 bytes
->Google Chrome cache emptied: 31767482 bytes
->Apple Safari cache emptied: 1437696 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 19489 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 134,00 mb


OTM by OldTimer - Version 3.1.17.2 log created on 11122010_141227

Konecne to zabralo...

Jak se chova PC

zatial mi avira ten malware nevypisala takže v pohode...

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u google toolbaru
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Dejte novy log z RSIT

včera večer http://2i.sk/9a39e3c91a

vyosek píše::
Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

Tenhle krok jste provedl

Pokud ne, tak na to pujdem jinak...

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :files
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp /s
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

All processes killed
========== FILES ==========
File/Folder C:\WINDOOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOOWS\*.tmp not found.
========== COMMANDS ==========
C:\WINDOOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: All Users.WINDOOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: janik
->Temp folder emptied: 661249002 bytes
->Temporary Internet Files folder emptied: 43969 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 79607901 bytes
->Flash cache emptied: 2714 bytes

User: jj
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 707,00 mb


Restore points cleared and new OTM Restore Point set!

OTM by OldTimer - Version 3.1.17.2 log created on 11132010_123751