VIRY.CZ

Dobry den,

mam problem s internetom. Oddnes mi zacalo pisat: server proxy not found, pri kazdom prehliadaci. NB nie je moj,, tak neviem co sa tam dialo Prikladam log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by wes at 2011-02-01 09:47:16
Microsoft® Windows Vista™ Home Basic
System drive C: has 103 GB (71%) free of 145 GB
Total RAM: 503 MB (20% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2007-06-20 2193280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-18 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2007-06-20 2193280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-06-20 1006264]
"hpsysdrv"=c:\hp\support\hpsysdrv.exe [2006-09-28 65536]
"KBD"=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
"OsdMaestro"=C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2007-02-15 118784]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-05-10 105240]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-05-10 113432]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-05-10 88856]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-01 4390912]
"HP Software Update"=c:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-02-17 49152]
""= []
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-12-18 149280]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2007-03-07 44168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"wputpsrb"=C:\Users\wes\AppData\Local\Temp\wjysadxnw\lxracohsjmo.exe [2011-01-29 337920]
"SpyEmergency"=C:\Program Files\NETGATE\Spy Emergency\SpyEmergency.exe [2011-01-26 2394752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2006-11-28 212992]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2011-02-01 09:47:20 ----D---- C:\Program Files\trend micro
2011-02-01 09:47:16 ----D---- C:\rsit
2011-02-01 09:36:54 ----D---- C:\Program Files\TeamViewer
2011-02-01 08:48:49 ----D---- C:\Users\wes\AppData\Roaming\Spy Emergency
2011-02-01 08:48:35 ----A---- C:\Windows\system32\drivers\spyemrg_guard.sys
2011-02-01 08:48:35 ----A---- C:\Windows\system32\drivers\spyemrg_access.sys
2011-02-01 08:48:35 ----A---- C:\Windows\system32\drivers\spyemrg.sys
2011-02-01 08:48:34 ----D---- C:\ProgramData\NETGATE
2011-02-01 08:48:32 ----D---- C:\Program Files\NETGATE
2011-01-29 12:18:03 ----D---- C:\ProgramData\nNmAoIg05200
2011-01-28 15:43:24 ----D---- C:\Poker
2011-01-25 18:39:54 ----D---- C:\Program Files\PokerStars
2011-01-16 23:22:44 ----D---- C:\Microgaming

======List of files/folders modified in the last 1 months======

2011-02-01 09:47:20 ----RD---- C:\Program Files
2011-02-01 09:47:11 ----D---- C:\Windows\Temp
2011-02-01 09:45:48 ----D---- C:\Users\wes\AppData\Roaming\Skype
2011-02-01 08:50:44 ----D---- C:\Windows\Prefetch
2011-02-01 08:48:50 ----SD---- C:\ProgramData\Microsoft
2011-02-01 08:48:35 ----D---- C:\Windows\system32\drivers
2011-02-01 08:48:34 ----HD---- C:\ProgramData
2011-02-01 08:44:57 ----D---- C:\Windows\SMINST
2011-01-31 15:52:53 ----D---- C:\Windows\system32\catroot2
2011-01-30 21:08:58 ----D---- C:\Windows\system32\NDF
2011-01-30 01:41:43 ----SHD---- C:\System Volume Information
2011-01-29 10:52:01 ----D---- C:\Users\wes\AppData\Roaming\Microgaming
2011-01-28 15:07:13 ----D---- C:\Filmy
2011-01-07 21:03:14 ----D---- C:\Windows\System32
2011-01-07 21:03:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-01-07 21:03:13 ----D---- C:\Windows\inf

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2007-02-02 43528]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-28 1476096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-01 1744928]
R3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-01-15 70144]
R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver; C:\Windows\System32\Drivers\spyemrg_guard.sys [2009-09-17 14392]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S1 SpyEmrg;Spy Emergency Driver; C:\Windows\System32\Drivers\spyemrg.sys [2009-09-17 12344]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-28 1476096]
S3 massfilter;ZTE Mass Storage Filter Driver; C:\Windows\system32\drivers\massfilter.sys [2010-01-19 9216]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 SpyEmrgAccess;Spy Emergency OnAccess Driver; C:\Windows\System32\Drivers\spyemrg_access.sys [2009-09-17 18232]
S3 USB_RNDIS;Belkin High-Speed Mode Wireless G USB Network Adapter Driver; C:\Windows\system32\DRIVERS\usb8023.sys [2006-11-02 14848]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys [2010-01-19 105088]
S3 ZTEusbnmea;ZTE NMEA Port; C:\Windows\system32\DRIVERS\ZTEusbnmea.sys [2010-01-19 105088]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\Windows\system32\DRIVERS\ZTEusbser6k.sys [2010-01-19 105088]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 BecHelperService;BecHelperService; C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 SpyEmrgSrv;Spy Emergency Engine Service; C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe [2010-09-30 2230912]
R2 TeamViewer6;TeamViewer 6; C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-08 136176]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-27 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-03-26 887544]
S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-03-09 74656]

-----------------EOF-----------------


dakujem,

Tomas

Zdravim a pekny den preji

Stahnete OTL (viz muj podpis) a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
• Zaskrtnete okenko Pro vsechny uzivatele
• Zaskrtnete okenko Kontrola na havet "LOP"
• Zaskrtnete okenko Kontrola na havet "Purity"
• Stari souboru zmente z 30 dnu na 7 dnu
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  netsvcs
  drivers32
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
  c:\windows\*.* /U
  %SYSTEMDRIVE%\*.exe
  %ALLUSERSPROFILE%\Application Data\*.
  %ALLUSERSPROFILE%\Application Data\*.exe /s
  %APPDATA%\*.
  %APPDATA%\*.exe /s
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  nvraid.sys
  ndis.sys
  winlogon.exe
  explorer.exe
  userinit.exe
  lsass.exe
  svchost.exe
  smss.exe
  hal.dll
  ws2_32.dll
  tcpip.sys
  cryptsvc.dll
  Changer.sys
  JakNDis.sys
  isapnp.sys
  cdrom.sys
  autochk.exe
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.dll /lockedfiles
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
  %systemroot%\system32\drivers\*.sys /3
  %systemroot%\system32\*.* /3
  CREATERESTOREPOINT

• Kliknete na tlacitko Prohledat
• Po dokonceni skenu (cca 5 az 10 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

Prikladam

edit: Oba txt v prilohe,.

EXTRA

Nedavejte prosim logy do code - spatne se to lusti a boli z toho oci

Ja si sem OTL pro prehlednost vlozim

OTL logfile created on: 01/02/2011 10:41:32 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\wes\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

503.00 Mb Total Physical Memory | 88.00 Mb Available Physical Memory | 17.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 43.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.79 Gb Total Space | 100.73 Gb Free Space | 71.05% Space Free | Partition Type: NTFS
Drive D: | 7.26 Gb Total Space | 1.01 Gb Free Space | 13.93% Space Free | Partition Type: NTFS

Computer Name: WES-PC | User Name: wes | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2011/02/01 10:37:39 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\wes\Desktop\OTL.exe
PRC - [2011/01/27 15:51:06 | 002,008,952 | ---- | M] (TeamViewer GmbH) -- c:\Program Files\TeamViewer\Version6\TeamViewer_Desktop.exe
PRC - [2011/01/27 15:51:05 | 007,626,104 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer.exe
PRC - [2011/01/27 15:51:05 | 002,253,688 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011/01/27 15:28:38 | 000,108,408 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\tv_w32.exe
PRC - [2010/12/08 23:27:21 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/12/08 23:27:19 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/11/27 15:15:31 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/03/01 15:38:48 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe
PRC - [2007/02/15 10:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
PRC - [2006/09/28 13:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe


========== Modules (SafeList) ==========

MOD - [2011/02/01 10:37:39 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\wes\Desktop\OTL.exe
MOD - [2011/01/27 15:28:38 | 000,050,552 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\tv_w32.dll
MOD - [2006/11/02 09:46:03 | 000,149,019 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\crtdll.dll
MOD - [2006/11/02 09:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/01/27 15:51:05 | 002,253,688 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2007/06/20 13:54:48 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Disabled | Running] -- -- (SpyEmrgGuard)
DRV - [2007/03/01 16:21:10 | 001,744,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/15 22:28:20 | 000,070,144 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006/11/28 22:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/28 22:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/02 09:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 09:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 09:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 09:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 09:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 09:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 09:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 09:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 09:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 09:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 09:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 09:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 09:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 09:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 09:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 09:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 09:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 09:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 09:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 09:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 09:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 09:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 09:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 09:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 09:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 09:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 09:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 09:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 09:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 09:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 09:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 09:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 09:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 08:57:48 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2006/11/02 08:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 08:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 08:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 08:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 08:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 08:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 07:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 07:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2005/12/12 17:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\PS2.sys -- (Ps2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8992

========== FireFox ==========

FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/08 23:27:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/01 10:09:24 | 000,000,000 | ---D | M]

[2010/08/21 11:47:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\wes\AppData\Roaming\Mozilla\Extensions
[2011/02/01 09:26:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\wes\AppData\Roaming\Mozilla\Firefox\Profiles\thro45si.default\extensions
[2010/08/23 19:03:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\wes\AppData\Roaming\Mozilla\Firefox\Profiles\thro45si.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/21 11:47:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2006/09/18 21:41:30 | 000,000,761 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000..\Run: [wputpsrb] C:\Users\wes\AppData\Local\Temp\wjysadxnw\lxracohsjmo.exe ()
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000 Winlogon: Shell - (C:\Users\wes\vpyu.exe) - File not found
O20 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000 Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000 Winlogon: Shell - (\Users\wes\vpyu.exe) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\splash_1280x1024.jpg
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\splash_1280x1024.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/06/20 14:20:09 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{22d10b4d-47e3-11df-bbbc-001c25032614}\Shell\AutoRun\command - "" = L:\SADBIJA\\\ljubila.exe
O33 - MountPoints2\{22d10b4d-47e3-11df-bbbc-001c25032614}\Shell\explore\command - "" = L:\SADBIJA\\\\ljubila.exe
O33 - MountPoints2\{22d10b4d-47e3-11df-bbbc-001c25032614}\Shell\open\command - "" = L:\SADBIJA\\\\ljubila.exe
O33 - MountPoints2\{551afd57-d88a-11de-806d-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{551afd57-d88a-11de-806d-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe
O33 - MountPoints2\{880876d7-5698-11df-a096-001c25032614}\Shell - "" = AutoRun
O33 - MountPoints2\{880876d7-5698-11df-a096-001c25032614}\Shell\AutoRun\command - "" = J:\AutoRun.exe
O33 - MountPoints2\{f639870d-90d6-11df-a1fe-885c53c9b00f}\Shell\AutoRun\command - "" = L:\zgodna\\tina.exe
O33 - MountPoints2\{f639870d-90d6-11df-a1fe-885c53c9b00f}\Shell\explore\command - "" = L:\zgodna\\\tina.exe
O33 - MountPoints2\{f639870d-90d6-11df-a1fe-885c53c9b00f}\Shell\open\command - "" = L:\zgodna\\\tina.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 7 Days ==========

[2011/02/01 10:37:30 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\wes\Desktop\OTL.exe
[2011/02/01 10:16:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/02/01 09:53:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/02/01 09:53:00 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/02/01 09:51:29 | 001,445,888 | ---- | C] (Option^Explicit Software Solutions) -- C:\Users\wes\Desktop\winsockxpfix.exe
[2011/02/01 09:49:31 | 000,000,000 | ---D | C] -- C:\Install
[2011/02/01 09:47:20 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011/02/01 09:47:16 | 000,000,000 | ---D | C] -- C:\rsit
[2011/02/01 09:36:54 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2011/01/29 12:42:13 | 004,738,880 | ---- | C] (AVG Technologies) -- C:\Users\wes\Documents\avg_isct_stb_all_2011_1204_ppc2.exe
[2011/01/29 12:18:03 | 000,000,000 | ---D | C] -- C:\ProgramData\nNmAoIg05200
[2011/01/28 15:43:24 | 000,000,000 | ---D | C] -- C:\Poker
[2011/01/25 18:40:17 | 000,000,000 | ---D | C] -- C:\Users\wes\AppData\Local\PokerStars
[2011/01/25 18:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\PokerStars

========== Files - Modified Within 7 Days ==========

[2011/02/01 10:44:45 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/01 10:44:45 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/01 10:38:25 | 000,000,000 | ---- | M] () -- C:\Users\wes\Desktop\eav_nt32_enu.msi
[2011/02/01 10:38:12 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/01 10:37:39 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\wes\Desktop\OTL.exe
[2011/02/01 09:53:07 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/02/01 09:52:19 | 001,445,888 | ---- | M] (Option^Explicit Software Solutions) -- C:\Users\wes\Desktop\winsockxpfix.exe
[2011/02/01 09:46:19 | 000,339,991 | ---- | M] () -- C:\Users\wes\Desktop\RSIT.exe
[2011/02/01 09:37:16 | 000,000,957 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011/02/01 09:30:32 | 000,158,876 | ---- | M] () -- C:\Users\wes\Desktop\obr.jpg
[2011/02/01 08:44:41 | 000,000,874 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/01 08:44:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/01 08:44:31 | 527,818,752 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/29 18:22:58 | 000,000,134 | ---- | M] () -- C:\Users\wes\Desktop\Windows Firewall - Shortcut.lnk
[2011/01/29 12:43:27 | 004,738,880 | ---- | M] (AVG Technologies) -- C:\Users\wes\Documents\avg_isct_stb_all_2011_1204_ppc2.exe
[2011/01/27 20:18:38 | 000,023,040 | ---- | M] () -- C:\Users\wes\Desktop\Španělsko.doc

========== Files Created - No Company Name ==========

[2011/02/01 10:38:24 | 000,000,000 | ---- | C] () -- C:\Users\wes\Desktop\eav_nt32_enu.msi
[2011/02/01 09:53:07 | 000,000,806 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/02/01 09:46:13 | 000,339,991 | ---- | C] () -- C:\Users\wes\Desktop\RSIT.exe
[2011/02/01 09:37:16 | 000,000,969 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011/02/01 09:37:16 | 000,000,957 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011/02/01 09:30:28 | 000,158,876 | ---- | C] () -- C:\Users\wes\Desktop\obr.jpg
[2011/01/29 18:22:58 | 000,000,134 | ---- | C] () -- C:\Users\wes\Desktop\Windows Firewall - Shortcut.lnk
[2011/01/28 15:43:36 | 000,000,710 | ---- | C] () -- C:\Users\wes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Expekt Poker.lnk
[2011/01/27 20:18:36 | 000,023,040 | ---- | C] () -- C:\Users\wes\Desktop\Španělsko.doc
[2010/07/28 11:19:41 | 000,000,050 | ---- | C] () -- C:\Windows\MegaManager.INI
[2010/01/19 11:49:54 | 000,466,944 | ---- | C] () -- C:\Windows\System32\RemoveDevice.dll
[2010/01/19 11:49:54 | 000,466,944 | ---- | C] () -- C:\Windows\RemoveDevice.dll
[2009/12/14 21:19:44 | 000,005,120 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/12/05 00:57:48 | 000,012,288 | ---- | C] () -- C:\Users\wes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/20 14:05:30 | 000,000,311 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/06/20 13:58:21 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1132.dll
[2007/06/20 13:58:21 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2007/06/20 13:58:20 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2007/06/20 13:44:40 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007/06/20 13:44:40 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007/03/06 08:47:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2007/01/12 14:07:48 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2007/01/12 14:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 10:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2011/01/29 10:52:01 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Microgaming
[2009/11/28 14:55:42 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Opera
[2010/06/23 11:44:32 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\TS3Client
[2011/01/31 22:25:33 | 000,032,594 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"WindowsWelcomeCenter" = rundll32.exe oobefldr.dll,ShowWelcomeCenter
"Skype" = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized -- [2009/10/09 16:47:24 | 025,623,336 | R--- | M] (Skype Technologies S.A.)
"wputpsrb" = C:\Users\wes\AppData\Local\Temp\wjysadxnw\lxracohsjmo.exe -- [2011/01/29 12:17:21 | 000,337,920 | ---- | M] ()
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OsdMaestro]
"ModelName" = 5189URF
"Version" = 1.00.007
"Language" = 0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OsdMaestro\Config]
"DisplayLabel" = 0
"TaskbarIcon" = 1
"ShowLockOSD" = 1

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >
[2010/07/12 09:02:47 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Adobe
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Application Data
[2011/02/01 10:06:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Birdstep Technology
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Desktop
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Documents
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Favorites
[2011/02/01 10:11:05 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Google
[2007/06/20 14:51:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Hewlett-Packard
[2007/06/20 14:05:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\HP
[2010/06/20 21:41:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\McAfee
[2011/02/01 10:25:21 | 000,000,000 | --SD | M] -- C:\ProgramData\Application Data\Microsoft
[2007/06/20 14:26:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Microsoft Help
[2007/06/20 14:19:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\muvee Technologies
[2011/01/29 12:18:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\nNmAoIg05200
[2010/06/21 03:32:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\NOS
[2007/06/20 14:29:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\PC-Doctor
[2007/06/20 14:13:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Roxio
[2009/11/27 11:34:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Skype
[2010/02/03 09:55:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Sonic
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Start Menu
[2011/02/01 10:16:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\Symantec
[2009/11/23 23:56:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data\Templates
[2007/06/20 14:27:05 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\{623D32E9-0C62-4453-AD44-98B31F52A5E1}

< %APPDATA%\*. >
[2009/12/02 06:42:36 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Adobe
[2009/11/24 05:48:20 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\CyberLink
[2009/11/27 10:12:23 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Google
[2009/11/24 00:04:08 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Hewlett-Packard
[2009/11/24 00:08:26 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Identities
[2009/11/24 00:06:11 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Macromedia
[2011/01/29 10:52:01 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Microgaming
[2010/06/20 21:58:10 | 000,000,000 | --SD | M] -- C:\Users\wes\AppData\Roaming\Microsoft
[2010/08/21 11:47:57 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Mozilla
[2009/11/28 14:55:42 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Opera
[2010/08/21 11:38:26 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Real
[2010/02/03 09:55:01 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Roxio
[2011/02/01 10:45:48 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\Skype
[2010/07/28 11:31:10 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\teamspeak2
[2010/06/23 11:44:32 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\TS3Client
[2009/12/14 20:05:29 | 000,000,000 | ---D | M] -- C:\Users\wes\AppData\Roaming\WinRAR

< %APPDATA%\*.exe /s >


< MD5 for: AGP440.SYS >
[2008/01/19 07:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 09:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\drivers\AGP440.sys
[2006/11/02 09:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 07:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 09:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2009/11/27 15:16:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\System32\drivers\atapi.sys
[2009/11/27 15:16:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009/11/27 15:16:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2009/11/27 15:16:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008/01/19 07:33:01 | 000,642,560 | ---- | M] (Microsoft Corporation) MD5=2FC5BE79B51714B479809358E4908FC3 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe
[2006/11/02 09:44:50 | 000,640,000 | ---- | M] (Microsoft Corporation) MD5=C08D1FE284C3330934E45D6E5F5B768B -- C:\WINDOWS\System32\autochk.exe
[2006/11/02 09:44:50 | 000,640,000 | ---- | M] (Microsoft Corporation) MD5=C08D1FE284C3330934E45D6E5F5B768B -- C:\WINDOWS\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6000.16386_none_dfbd2b4dc4d6121b\autochk.exe

< MD5 for: CDROM.SYS >
[2008/01/19 05:49:51 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=1EC25CEA0DE6AC4718BF89F9E1778B57 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_cdrom.inf_31bf3856ad364e35_6.0.6001.18000_none_5fa95be2a3c76a4a\cdrom.sys
[2006/11/02 08:51:44 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=8D1866E61AF096AE8B582454F5E4D303 -- C:\WINDOWS\System32\drivers\cdrom.sys
[2006/11/02 08:51:44 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=8D1866E61AF096AE8B582454F5E4D303 -- C:\WINDOWS\System32\DriverStore\FileRepository\cdrom.inf_e487f727\cdrom.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 09:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\System32\cngaudit.dll
[2006/11/02 09:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: CRYPTSVC.DLL >
[2006/11/02 09:46:03 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=1C26FB097170A2A91066D1E3A24366E3 -- C:\WINDOWS\System32\cryptsvc.dll
[2006/11/02 09:46:03 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=1C26FB097170A2A91066D1E3A24366E3 -- C:\WINDOWS\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6000.16386_none_73c8d7689de43d15\cryptsvc.dll
[2008/01/19 07:34:00 | 000,128,000 | ---- | M] (Microsoft Corporation) MD5=6DE363F9F99334514C46AEC02D3E3678 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6001.18000_none_75ff99649acf4de9\cryptsvc.dll

< MD5 for: EXPLORER.EXE >
[2009/11/27 15:15:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\WINDOWS\explorer.exe
[2009/11/27 15:15:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009/11/27 15:15:30 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009/11/27 15:15:30 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/11/27 16:03:27 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2009/11/27 16:03:27 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/11/27 15:15:30 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 09:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 07:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: HAL.DLL >
[2007/06/20 13:50:14 | 000,160,872 | ---- | M] (Microsoft Corporation) MD5=779D32272A54384807A4424D90293378 -- C:\WINDOWS\System32\hal.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 07:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 09:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\drivers\iaStorV.sys
[2006/11/02 09:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: ISAPNP.SYS >
[2006/11/02 09:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) MD5=350FCA7E73CF65BCEF43FAE1E4E91293 -- C:\WINDOWS\System32\drivers\isapnp.sys
[2006/11/02 09:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) MD5=350FCA7E73CF65BCEF43FAE1E4E91293 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_920a2c1f\isapnp.sys
[2008/01/19 07:42:15 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\isapnp.sys

< MD5 for: LSASS.EXE >
[2009/06/15 12:51:56 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=203D86EBD6D8E4C8501B222421E81506 -- C:\WINDOWS\SoftwareDistribution\Download\f0e7510dbdd98e00504ebcf9a6bc42ad\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22152_none_a886901f7335e2fc\lsass.exe
[2009/11/27 15:54:31 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2D3AC5E7AC01E905F3ABD2D745FE3A9B -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22223_none_a8a80213731ca5a7\lsass.exe
[2009/11/27 15:54:31 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18051_none_a7fbf30a5a1929db\lsass.exe
[2009/11/27 14:57:21 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=59DE082968FDD257FFF0D209B9A5B460 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16820_none_a44eb0105fb4d975\lsass.exe
[2006/11/02 09:45:21 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=6A0E382E74280E4CC0DF17FE2661D003 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16386_none_a413c8c65fe02762\lsass.exe
[2009/06/15 13:03:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=6F1F23D3599EAE17734451936B7F17C6 -- C:\WINDOWS\SoftwareDistribution\Download\f0e7510dbdd98e00504ebcf9a6bc42ad\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22450_none_a69e1da376115b2a\lsass.exe
[2009/11/27 15:54:30 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A911ECAC81F94ADEAFBE8E3F7873EDB0 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18272_none_a600dfae5d0228c9\lsass.exe
[2009/11/27 14:57:21 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=AFF8A58280863629CA4FFA9E0B259F1E -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21010_none_a4e2f4e978ca9090\lsass.exe
[2009/06/15 12:59:08 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=BA9A67672E025078C77967731BCFC560 -- C:\WINDOWS\SoftwareDistribution\Download\f0e7510dbdd98e00504ebcf9a6bc42ad\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21067_none_a4b3e75378eccda6\lsass.exe
[2009/11/27 15:54:33 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\WINDOWS\System32\lsass.exe
[2009/11/27 15:54:33 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16870_none_a418a0745fdd652a\lsass.exe
[2009/11/27 15:54:29 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=CB7E838C140B4087B2DA323F2D4523C5 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22518_none_a6d1618975e9b345\lsass.exe
[2009/11/27 15:54:32 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=D09A5DA84B7C9CA9B02EBCD7FAE41C8D -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21125_none_a4dd285578ce285b\lsass.exe
[2009/11/27 14:57:19 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe
[2009/11/27 14:57:19 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18215_none_a644c0145ccecd28\lsass.exe
[2009/11/27 14:57:19 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=F4C62B07E5BF96F1FDCA9DB393ECED22 -- C:\WINDOWS\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22376_none_a68e7da1761c2def\lsass.exe

< MD5 for: NDIS.SYS >
[2006/11/02 09:51:42 | 000,500,840 | ---- | M] (Microsoft Corporation) MD5=227C11E1E7CF6EF8AFB2A238D209760C -- C:\WINDOWS\System32\drivers\ndis.sys
[2006/11/02 09:51:42 | 000,500,840 | ---- | M] (Microsoft Corporation) MD5=227C11E1E7CF6EF8AFB2A238D209760C -- C:\WINDOWS\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6000.16386_none_a59069cb1f23fc44\ndis.sys
[2008/01/19 07:43:31 | 000,529,464 | ---- | M] (Microsoft Corporation) MD5=9BDC71790FA08F0A0B5F10462B1BD0B1 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6001.18000_none_a7c72bc71c0f0d18\ndis.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 09:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\System32\netlogon.dll
[2006/11/02 09:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 07:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVRAID.SYS >
[2008/01/19 07:43:01 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvraid.sys
[2006/11/02 09:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) MD5=E69E946F80C1C31C53003BFBF50CBB7C -- C:\WINDOWS\System32\drivers\nvraid.sys
[2006/11/02 09:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) MD5=E69E946F80C1C31C53003BFBF50CBB7C -- C:\WINDOWS\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvraid.sys

< MD5 for: NVSTOR.SYS >
[2006/11/02 09:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\drivers\nvstor.sys
[2006/11/02 09:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 07:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 07:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 09:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\System32\scecli.dll
[2006/11/02 09:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: SMSS.EXE >
[2008/01/19 07:33:31 | 000,064,000 | ---- | M] (Microsoft Corporation) MD5=6701DDAF68BEDE6BBEEA9D514D73A35B -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6001.18000_none_ac3aa7fd19319fba\smss.exe
[2006/11/02 09:45:45 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=CAA75757BB3695478C23CB0624342A61 -- C:\WINDOWS\System32\smss.exe
[2006/11/02 09:45:45 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=CAA75757BB3695478C23CB0624342A61 -- C:\WINDOWS\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6000.16386_none_aa03e6011c468ee6\smss.exe

< MD5 for: SVCHOST.EXE >
[2006/11/02 09:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\WINDOWS\System32\svchost.exe
[2006/11/02 09:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\WINDOWS\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 07:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: TCPIP.SYS >
[2009/12/08 20:52:30 | 000,897,624 | ---- | M] (Microsoft Corporation) MD5=1ACBB7A47E78F4CC82D2EFFB72901528 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys
[2009/11/27 16:05:43 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=2512B4D1353370D6688B1AF1F5AFA1CF -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys
[2009/11/27 16:05:37 | 000,900,168 | ---- | M] (Microsoft Corporation) MD5=2608E71AAD54564647D4BB984E1925AA -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys
[2010/02/18 11:51:51 | 000,818,688 | ---- | M] (Microsoft Corporation) MD5=2C1F7005AA3B62721BFDB307BD5F5010 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21226_none_6019359fab5bb15b\tcpip.sys
[2010/02/18 14:49:38 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=2EAE4500984C2F8DACFB977060300A15 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18427_none_b30f7c1866701ed5\tcpip.sys
[2009/11/27 16:05:43 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=300208927321066EA53761FDC98747C6 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys
[2009/12/08 20:15:00 | 000,907,832 | ---- | M] (Microsoft Corporation) MD5=46E6685F3E92AEC743773ADD4CD54F57 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22283_none_b53aaa1b7ce8560d\tcpip.sys
[2010/02/18 14:07:16 | 000,904,576 | ---- | M] (Microsoft Corporation) MD5=48CBE6D53632D0067C2D6B20F90D84CA -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18209_none_b50d905263846bec\tcpip.sys
[2010/02/18 12:05:37 | 000,815,104 | ---- | M] (Microsoft Corporation) MD5=4A82FA8F0DF67AA354580C3FAAF8BDE3 -- C:\WINDOWS\System32\drivers\tcpip.sys
[2010/02/18 12:05:37 | 000,815,104 | ---- | M] (Microsoft Corporation) MD5=4A82FA8F0DF67AA354580C3FAAF8BDE3 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.17021_none_5f8a957c924295b7\tcpip.sys
[2009/11/27 15:12:54 | 000,806,400 | ---- | M] (Microsoft Corporation) MD5=52A8BD6294F7D1443C6184C67AE13AF4 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.20752_none_5ff4e4f9ab7777f4\tcpip.sys
[2009/12/08 20:37:09 | 000,900,696 | ---- | M] (Microsoft Corporation) MD5=5653230D480A9C54D169E1B080B72CF5 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22577_none_b36309477fb64a54\tcpip.sys
[2009/11/27 15:12:55 | 000,803,328 | ---- | M] (Microsoft Corporation) MD5=5DF77458AA92FDB36FCE79C60F74AB5D -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a\tcpip.sys
[2009/11/27 16:05:40 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys
[2009/12/08 17:58:13 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=8734BD051FFDCBF8425CF222141C3741 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16973_none_5f56ae52926920d8\tcpip.sys
[2009/11/27 16:05:37 | 000,897,608 | ---- | M] (Microsoft Corporation) MD5=8A7AD2A214233F684242F289ED83EBC3 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys
[2010/02/18 17:36:50 | 000,902,024 | ---- | M] (Microsoft Corporation) MD5=93A5655CD9CD2F080EF1CB71A3666215 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys
[2009/12/08 17:45:32 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=CA3A5756672013A66BB9D547A5A62DCA -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21175_none_5fe223d3ab852692\tcpip.sys
[2006/11/02 08:58:38 | 000,802,816 | ---- | M] (Microsoft Corporation) MD5=D944522B048A5FEB7700B5170D3D9423 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16386_none_5f4ed3e0926e99e4\tcpip.sys
[2010/02/18 14:22:11 | 000,910,216 | ---- | M] (Microsoft Corporation) MD5=D9F5DD5BBC8348E8F8220CCBF14C022E -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22341_none_b563eb1d7cc9b0c2\tcpip.sys
[2009/12/08 20:01:08 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=DA467E7619AE5F4588E6262C13C8940A -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18160_none_b4c3ac4a63bd325c\tcpip.sys
[2008/01/19 07:43:39 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=FC6E2835D667774D409C7C7021EAF9C4 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
[2009/11/27 16:05:40 | 000,905,784 | ---- | M] (Microsoft Corporation) MD5=FF71856BD4CD6D4367F9FD84BE79A874 -- C:\WINDOWS\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008/01/19 07:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 09:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\WINDOWS\System32\userinit.exe
[2006/11/02 09:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\WINDOWS\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006/11/02 09:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\WINDOWS\System32\winlogon.exe
[2006/11/02 09:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008/01/19 07:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008/01/19 07:37:09 | 000,179,200 | ---- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B -- C:\WINDOWS\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.0.6001.18000_none_f2b7b0c2ce5605c4\ws2_32.dll
[2006/11/02 09:46:14 | 000,178,688 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\ws2_32.dll
[2006/11/02 09:46:14 | 000,178,688 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\winsxs\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.0.6000.16386_none_f080eec6d16af4f0\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 09:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\rsaenh.dll
[2009/11/27 14:55:50 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 10:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 10:34:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 10:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 10:34:08 | 010,133,504 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 10:34:08 | 001,826,816 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 09:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\rsaenh.dll
[2009/11/27 14:55:50 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\SLC.dll

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2011/02/01 10:44:45 | 000,003,456 | -H-- | M] () -- C:\WINDOWS\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/01 10:44:45 | 000,003,456 | -H-- | M] () -- C:\WINDOWS\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

< End of report >

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

• Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
• Spustte a kliknete na Deletion
• Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

Spustte znovu OTL

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  :otl
  DRV - File not found [Kernel | Disabled | Running] -- -- (SpyEmrgGuard)
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
  IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
  IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
  IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
  IE - HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8992
  FF - prefs.js..network.proxy.type: 4
  O4 - HKLM..\Run: [] File not found
  O4 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000..\Run: [wputpsrb] C:\Users\wes\AppData\Local\Temp\wjysadxnw\lxracohsjmo.exe ()
  O13 - gopher Prefix: missing
  O20 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000 Winlogon: Shell - (C:\Users\wes\vpyu.exe) - File not found
  O20 - HKU\S-1-5-21-3261887026-3727753357-205471928-1000 Winlogon: Shell - (\Users\wes\vpyu.exe) - File not found
  
  :reg
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"=-
  ""=-
  "SunJavaUpdateSched"=-
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "Skype"=-
  "SpyEmergency"=-
   
  :files
  C:\Users\wes\AppData\Local\Temp\wjysadxnw
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp /s
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Nasledne kliknete na Opravit
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Za code a prilohu sa omluvam. Prikladam log:

All processes killed
========== OTL ==========
Error: No service named SpyEmrgGuard was found to stop!
Service\Driver key SpyEmrgGuard not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: 4 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3261887026-3727753357-205471928-1000\Software\Microsoft\Windows\CurrentVersion\Run\\wputpsrb not found.
File C:\Users\wes\AppData\Local\Temp\wjysadxnw\lxracohsjmo.exe not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\wes\vpyu.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3261887026-3727753357-205471928-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:\Users\wes\vpyu.exe deleted successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Skype deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpyEmergency not found.
========== FILES ==========
C:\Users\wes\AppData\Local\Temp\wjysadxnw folder moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP17D7.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2EBD.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3ED7.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP77AF.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8D32.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9AF7.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA5B0.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAB2C.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAF51.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB0D7.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD558.tmp folder moved successfully.
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\RAC5466.tmp moved successfully.
C:\Windows\Temp\CR_13CF.tmp folder moved successfully.
C:\Windows\Temp\CR_25E7.tmp folder moved successfully.
C:\Windows\Temp\CR_36C8.tmp folder moved successfully.
C:\Windows\Temp\CR_3D6C.tmp folder moved successfully.
C:\Windows\Temp\CR_507F.tmp folder moved successfully.
C:\Windows\Temp\CR_5372.tmp folder moved successfully.
C:\Windows\Temp\CR_68E6.tmp folder moved successfully.
C:\Windows\Temp\CR_6D62.tmp folder moved successfully.
C:\Windows\Temp\CR_8180.tmp folder moved successfully.
C:\Windows\Temp\CR_AC2.tmp folder moved successfully.
C:\Windows\Temp\CR_B079.tmp folder moved successfully.
C:\Windows\Temp\CR_BC5C.tmp folder moved successfully.
C:\Windows\Temp\CR_D9BB.tmp folder moved successfully.
C:\Windows\Temp\DMI3552.tmp moved successfully.
C:\Windows\Temp\NCO8B5D.tmp moved successfully.
C:\Windows\Temp\NCO929E.tmp moved successfully.
C:\Windows\Temp\NCO95B9.tmp moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: wes
->Temp folder emptied: 300420810 bytes
->Temporary Internet Files folder emptied: 279379749 bytes
->Java cache emptied: 37748479 bytes
->FireFox cache emptied: 65319226 bytes
->Google Chrome cache emptied: 6509471 bytes
->Opera cache emptied: 20217494 bytes
->Flash cache emptied: 67589 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 254274107 bytes
RecycleBin emptied: 4097 bytes

Total Files Cleaned = 919.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: wes
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.20.6 log created on 02012011_130557

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Jeste provedte ten USBFix jak jsem psal...

Ospravedlnujem sa, len to riesim na dialku a dako to vzdy trva. Prikladam log:

############################## | UsbFix 7.014 | [Deletion]

User: wes (Administrator) # WES-PC [HP-Pavilion GG644AA-ABU a6101.uk]
Updated 24/06/10 by El Desaparecido / C_XX
Started at 08:35:42 | 02/02/2011
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Celeron(R) CPU 420 @ 1.60GHz
Microsoft® Windows Vista™ Home Basic (6.0.6000 32-Bit) #
Internet Explorer 7.0.6000.17037

Windows Firewall: Enabled
Antivirus: ESET NOD32 Antivirus 4.2 4.2 [Enabled | Updated]
Antivirus: Spy Emergency 7 [Enabled | Updated]
RAM -> 503 Mb
C:\ (%systemdrive%) -> Fixed drive # 142 Gb (101 Mb free - 71%) [HP] # NTFS
D:\ -> Fixed drive # 7 Gb (1 Mb free - 14%) [Recovery] # NTFS
E:\ -> CD-ROM
L:\ -> Removable drive # 465 Mb (231 Mb free - 50%) [Philips] # FAT

################## | Files # Infected Folders |


################## | Registry |

Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{551afd57-d88a-11de-806d-806e6f6e6963}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{880876d7-5698-11df-a096-001c25032614}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{f639870d-90d6-11df-a1fe-885c53c9b00f}

################## | Listing |

[02/02/2011 - 08:40:54 | SHD ] C:\$Recycle.Bin
[20/08/2010 - 00:59:45 | D ] C:\a83f98847417397eb5
[20/06/2007 - 14:20:09 | A | 74] C:\autoexec.bat
[20/06/2007 - 14:33:01 | SHD ] C:\Boot
[02/11/2006 - 09:53:57 | RASH | 438840] C:\bootmgr
[20/06/2007 - 14:33:01 | RAS | 8192] C:\BOOTSECT.BAK
[18/09/2006 - 21:43:37 | A | 10] C:\config.sys
[03/05/2010 - 09:50:35 | A | 6151] C:\debug.txt
[23/11/2009 - 23:56:35 | SHD ] C:\Documents and Settings
[28/01/2011 - 15:07:13 | D ] C:\Filmy
[02/02/2011 - 08:17:49 | ASH | 527818752] C:\hiberfil.sys
[24/11/2009 - 05:43:41 | HD ] C:\hp
[01/02/2011 - 12:48:10 | D ] C:\Install
[20/06/2007 - 13:58:22 | D ] C:\Intel
[04/12/2009 - 22:59:34 | AH | 652] C:\IPH.PH
[16/01/2011 - 23:22:44 | D ] C:\Microgaming
[20/06/2007 - 14:23:20 | RHD ] C:\MSOCache
[02/02/2011 - 08:17:47 | ASH | 1073741824] C:\pagefile.sys
[28/01/2011 - 15:43:24 | D ] C:\Poker
[01/02/2011 - 13:33:49 | RD ] C:\Program Files
[01/02/2011 - 13:33:49 | HD ] C:\ProgramData
[20/06/2007 - 14:00:32 | A | 471] C:\RHDSetup.log
[01/02/2011 - 17:47:43 | SHD ] C:\System Volume Information
[04/12/2009 - 22:58:38 | HD ] C:\TEMP
[02/02/2011 - 08:40:54 | D ] C:\UsbFix
[02/02/2011 - 08:35:44 | A | 2535] C:\UsbFix.txt
[24/11/2009 - 00:01:47 | RD ] C:\Users
[02/02/2011 - 08:19:11 | D ] C:\WINDOWS
[01/02/2011 - 13:05:57 | D ] C:\_OTL
[02/02/2011 - 08:40:54 | SHD ] D:\$RECYCLE.BIN
[03/10/2006 - 23:02:44 | SH | 438328] D:\boo.mgr
[24/11/2009 - 07:45:19 | SHD ] D:\boot
[01/11/2006 - 23:53:58 | SH | 438840] D:\bootmgr
[13/10/2006 - 14:00:52 | SH | 1322] D:\Desktop.ini
[06/08/2008 - 22:16:40 | SH | 0] D:\DRECOVERY
[24/11/2009 - 07:45:19 | SHD ] D:\hp
[20/06/2007 - 16:27:54 | SH | 107] D:\MASTER.LOG
[24/11/2009 - 00:08:08 | SHD ] D:\PC-Doctor 5 for Win PE
[24/11/2009 - 00:08:08 | SH | 429] D:\pcdr.ini
[24/11/2009 - 07:45:19 | SHD ] D:\PRELOAD
[22/11/2004 - 14:28:30 | SH | 181648] D:\Protect.ed
[24/11/2009 - 07:45:19 | RD ] D:\RECOVERY
[20/06/2007 - 16:27:54 | SH | 45] D:\RESTORE.INI
[24/11/2009 - 07:45:19 | SHD ] D:\SOURCES
[24/11/2009 - 07:45:19 | SHD ] D:\System Volume Information
[07/02/2007 - 13:56:24 | SH | 34] D:\SystemRecovery.txt
[24/11/2009 - 07:45:19 | SHD ] D:\Windows
[27/12/2002 - 18:44:58 | RASH | 372] L:\SETTINGS.DAT
[10/08/2010 - 16:05:12 | RSHD ] L:\DIJAMANTE
[07/09/2010 - 15:33:38 | RSHD ] L:\SADBIJA
[18/04/2010 - 22:08:56 | A | 4126343] L:\03 Iveta Bartosova - Leto.mp3
[18/04/2010 - 22:08:56 | A | 4013680] L:\04 Hana Zagorova a Karel Vagner - Hej, mistre basu.mp3
[16/04/2010 - 19:23:02 | A | 3184002] L:\04 Martin Maxa - Rano v ulicich.mp3
[15/04/2010 - 19:34:14 | A | 3677549] L:\04 Michal David - Kazdy mi te lasko zavidi.mp3
[16/07/2008 - 17:32:28 | A | 6409855] L:\05 Jiri Korn - Miss Moskva.mp3
[29/05/2010 - 23:48:16 | A | 2230760] L:\05 Petr Fiala - Mesic.mp3
[18/04/2010 - 19:54:40 | A | 2914261] L:\06 Olympic - Snad jsem to zavinil já.mp3
[16/07/2008 - 17:46:44 | A | 3903577] L:\07 Ales Brichta - Vylet do baji.mp3
[08/06/2010 - 10:12:12 | A | 5270757] L:\07 Hana Zagorova - Maluj zase obrazky.mp3
[18/04/2010 - 19:16:50 | A | 3946032] L:\07 Pavel Bobek - Lasko, me ubyva sil.mp3
[29/05/2010 - 23:48:18 | A | 3746675] L:\07 Petr Hapka a Hana Hegerova - Levandulova.mp3
[29/05/2010 - 22:38:12 | A | 4547228] L:\08 BSP - Zeme vzdalena.mp3
[29/05/2010 - 23:48:18 | A | 3604654] L:\08 Hana Zagorova - To by nebylo fer.mp3
[29/05/2010 - 23:48:18 | A | 3223758] L:\08 Jakub Smolik - Az se ti jednou bude zdat.mp3
[10/08/2010 - 17:26:48 | A | 3937830] L:\08 Karel Kopecky - Schody do nebe.mp3
[08/06/2010 - 19:10:36 | A | 4539809] L:\08 Vera Spinarova - Tata Jan.mp3
[12/07/2010 - 09:22:28 | A | 5949256] L:\08 Waldemar Matuska - Ruze z Texasu.mp3
[29/05/2010 - 23:48:22 | A | 2450295] L:\09 Hana Zagorova - Zustan tady leto.mp3
[10/08/2010 - 17:27:08 | A | 5057019] L:\09 Vaclav Neckar a Helena Vondrackova - Stin katedral.mp3
[19/04/2010 - 19:32:30 | A | 4783803] L:\09 Zluty pes - Sametova.mp3
[07/09/2010 - 17:58:34 | A | 3516123] L:\10 Ales Brichta - Spravedlnost byva slepa.mp3
[02/06/2010 - 20:09:48 | A | 3079388] L:\10 Dalibor Janda - Zít jako kaskader.mp3
[08/06/2010 - 19:10:36 | A | 5483926] L:\10 Marta Kubisova - Nechte zvony znit.mp3
[08/06/2010 - 10:12:12 | A | 5788797] L:\11 Ales Brichta - Divka s perlami ve vlasech.mp3
[02/06/2010 - 20:09:48 | A | 3839996] L:\11 Jiri Schellinger - Holubi dum.mp3
[02/06/2010 - 20:09:48 | A | 6018042] L:\11 Petr Muk a Iveta Bartosova - Znam jednu starou zahradu.mp3
[02/06/2010 - 20:09:58 | A | 4817937] L:\12 Buty - Mam jednu ruku dlouhou.mp3
[10/08/2010 - 17:26:54 | A | 3805540] L:\12 Helena Vondrackova - Leto je leto.mp3
[12/07/2010 - 10:21:40 | A | 3043412] L:\12 Lenka Filipova - Castecne zatmeni srdce.mp3
[07/09/2010 - 17:58:36 | A | 1854110] L:\13 Jiri Schmitzer - Kdyz se neboji.mp3
[08/06/2010 - 19:10:36 | A | 4429245] L:\13 Lenka Filipova - Zamilovana.mp3
[15/04/2010 - 19:49:32 | A | 4126761] L:\13 Olympic - Slzy tvy mamy sedivy.mp3
[10/08/2010 - 17:26:48 | A | 3023829] L:\14 Jaroslav Uhlir - Severni vitr.mp3
[19/04/2010 - 20:00:32 | A | 4208494] L:\14 Ladislav Krizek - Vzdalena.mp3
[08/06/2010 - 10:12:12 | A | 3425342] L:\14 Olympic - Je to tva vina.mp3
[29/05/2010 - 23:16:08 | A | 4411391] L:\14 Pavel Bobek - Muj rodny dum.mp3
[30/05/2010 - 21:22:18 | A | 5827646] L:\14 Petr Muk - Bon Soir, Mademoiselle Paris.mp3
[02/06/2010 - 20:10:04 | A | 7341460] L:\15 Jitka Zelenkova - Bez lasky laska neni.mp3
[13/07/2010 - 21:47:22 | A | 6392167] L:\15 Lenka Filipova - Za vsechno muze cas.mp3
[25/11/2010 - 18:29:10 | A | 3740985] L:\15 Petr Novak - Nahrobni kamen.mp3
[25/11/2010 - 18:29:12 | A | 5339678] L:\16 Dalibor Janda - Kde jsi.mp3
[25/11/2010 - 18:29:12 | A | 3881062] L:\16 Helena Vondrackova - Cas je proti nam.mp3
[02/06/2010 - 20:10:04 | A | 2766978] L:\16 Iveta Bartosová - Dva roky prazdnin.mp3
[19/04/2010 - 19:48:18 | A | 6018952] L:\16 Petr Kotvald - Je v tahu.mp3
[31/07/2005 - 16:26:52 | A | 5211816] L:\18 Karel Zich - Parada.mp3
[13/07/2010 - 21:47:30 | A | 4391329] L:\18 Olympic - Co vsechno se tu muze stat.MP3
[07/09/2010 - 17:58:34 | A | 4813468] L:\19 Dalibor Janda - Hurikan.mp3
[19/04/2010 - 20:54:24 | A | 4801128] L:\19 Karel Zich - Alenka v risi divu.mp3
[10/08/2010 - 17:26:44 | A | 3620114] L:\19 Petr Novak - Ja budu chodit po spickach.mp3
[02/06/2010 - 20:10:10 | A | 3465132] L:\20 Helena Vondrackova - A ty se ptas, co ja.mp3
[07/09/2010 - 17:58:38 | A | 2176187] L:\20 Helena Vondrackova - Lasko ma, ja stunu.mp3
[13/07/2010 - 21:47:22 | A | 2605926] L:\20 Pavel Bobek - Ved me dal cesto ma.mp3
[14/04/2010 - 20:03:28 | A | 3479599] L:\20 Petr Muk - Neusinej.mp3
[18/04/2010 - 22:08:52 | A | 5998686] L:\01 Olympic - Jasna zprava.mp3
[18/04/2010 - 22:08:56 | A | 2092217] L:\01 Pavel Bobek - Ma divka Anne.mp3
[18/04/2010 - 22:08:56 | A | 3710725] L:\02 Javory - Mela baba trnku.mp3
[18/04/2010 - 22:08:56 | A | 6343091] L:\02 Michal Tucny - Bajecna zenska.mp3
[16/07/2008 - 17:44:44 | A | 4389332] L:\03 Helena Vondrackova - Dve mala kridla tu nejsou.mp3

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
L:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | E.O.F |

Zlepsilo se chovani PC

Hej, net uz funguje normalne a ani ziadne ine podozrive chovanie to uz nevykazuje. Vyzera to, ze problem/y boli odstranene.

dakujem za pomoc,

s pozdravom,

Tomas

Tak jeste uklidime

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

A pokud nejsou problemy ci dotazy, je to z me strany vse

Dakujem za pomoc

Nemate zac, rad jsem pomohl Zase nekdy