VIRY.CZ

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  motji píše: Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Ted nerestartujte PC - prisli byste o ucinek RKillu

Logfile of random's system information tool 1.08 (written by random/random)
Run by Radon at 2011-03-02 15:13:05
Systém Microsoft Windows XP Professional Service Pack 2
System drive D: has 21 GB (17%) free of 128 GB
Total RAM: 4028 MB (96% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:13:07, on 2.3.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Opera\opera.exe
D:\Program Files\Opera\RSIT.exe
D:\Program Files\trend micro\Radon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "D:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] D:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "D:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.2.lnk = D:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMSAccess - Unknown owner - D:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - D:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 3402 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15 62376]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"=D:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]
"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2010-11-15 35736]
"Adobe ARM"=D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"AdobeAAMUpdater-1.0"=D:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-02-26 500208]
"SwitchBoard"=D:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=D:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=D:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"AdobeBridge"= []
"SpybotSD TeaTimer"=D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

D:\Documents and Settings\Radon\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.2.lnk - D:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
D:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\Opera\opera.exe"="D:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"D:\Program Files\Unity\Editor\Unity.exe"="D:\Program Files\Unity\Editor\Unity.exe:*:Enabled:Unity Editor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-03-02 14:57:09 ----D---- D:\Program Files\trend micro
2011-03-02 14:57:08 ----D---- D:\rsit
2011-03-02 14:54:10 ----D---- D:\WINDOWS\CSC
2011-03-02 14:54:04 ----A---- D:\WINDOWS\ntbtlog.txt
2011-03-02 14:52:52 ----D---- D:\WINDOWS\LastGood
2011-03-01 22:45:46 ----D---- D:\Documents and Settings\Radon\Data aplikací\GetRightToGo
2011-03-01 22:32:39 ----D---- D:\Program Files\Spybot - Search & Destroy
2011-03-01 22:32:39 ----D---- D:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-03-01 22:24:49 ----A---- D:\WINDOWS\UPGRADE.TXT
2011-03-01 15:43:24 ----D---- D:\Documents and Settings\All Users\Data aplikací\FLEXnet
2011-03-01 15:05:30 ----D---- D:\Program Files\Common Files\Macrovision Shared
2011-03-01 14:48:20 ----HDC---- D:\WINDOWS\$MSI31Uninstall_KB893803v2$
2011-02-27 15:25:03 ----A---- D:\WINDOWS\system32\CmdLineExt.dll
2011-02-26 17:37:15 ----D---- D:\Documents and Settings\Radon\Data aplikací\Adobe Mini Bridge CS5
2011-02-26 17:37:14 ----D---- D:\Documents and Settings\Radon\Data aplikací\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-02-26 14:30:59 ----D---- D:\Documents and Settings\All Users\Data aplikací\regid.1986-12.com.adobe
2011-02-26 14:26:15 ----D---- D:\Program Files\Adobe Media Player
2011-02-26 14:24:03 ----D---- D:\Program Files\Common Files\Adobe AIR
2011-02-24 18:09:40 ----D---- D:\Documents and Settings\Radon\Data aplikací\OpenOffice.org
2011-02-24 17:48:40 ----D---- D:\Program Files\OpenOffice.org 3
2011-02-23 20:01:25 ----D---- D:\WINDOWS\system32\drivers\imon
2011-02-20 13:16:11 ----D---- D:\Program Files\Common Files\Adobe
2011-02-20 13:16:11 ----D---- D:\Program Files\Adobe
2011-02-20 13:15:21 ----D---- D:\Documents and Settings\All Users\Data aplikací\Adobe
2011-02-17 18:33:56 ----D---- D:\Documents and Settings\Radon\Data aplikací\Canneverbe Limited
2011-02-17 18:33:38 ----D---- D:\Program Files\CDBurnerXP
2011-02-17 18:33:38 ----D---- D:\Documents and Settings\All Users\Data aplikací\Canneverbe Limited
2011-02-17 16:50:44 ----D---- D:\Program Files\MAXON
2011-02-17 16:33:01 ----D---- D:\Documents and Settings\Radon\Data aplikací\MAXON
2011-02-17 16:23:57 ----D---- D:\WINDOWS\system32\appmgmt
2011-02-16 16:19:32 ----D---- D:\Documents and Settings\Radon\Data aplikací\PACE Anti-Piracy
2011-02-16 16:19:32 ----D---- D:\Documents and Settings\All Users\Data aplikací\PACE Anti-Piracy
2011-02-16 16:19:31 ----D---- D:\Program Files\Common Files\PACE Anti-Piracy
2011-02-13 18:12:53 ----D---- D:\Program Files\SecurityXploded
2011-02-11 23:00:44 ----A---- D:\WINDOWS\Star Assault Demo Uninstaller.exe
2011-02-11 23:00:17 ----D---- D:\Program Files\Kalypso
2011-02-11 22:48:01 ----D---- D:\Documents and Settings\Radon\Data aplikací\Unity
2011-02-11 00:00:54 ----A---- D:\WINDOWS\iun6002.exe
2011-02-11 00:00:46 ----D---- D:\Program Files\Codec Pack - All In 1
2011-02-11 00:00:16 ----A---- D:\WINDOWS\Codec Pack - All In 1 Setup Log.txt
2011-02-09 23:29:16 ----D---- D:\Documents and Settings\Radon\Data aplikací\gtk-2.0
2011-02-09 23:26:09 ----D---- D:\Program Files\GIMP-2.0
2011-02-09 20:00:33 ----A---- D:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-02-09 20:00:19 ----D---- D:\Program Files\DAEMON Tools Lite
2011-02-09 20:00:02 ----D---- D:\Documents and Settings\Radon\Data aplikací\DAEMON Tools Lite
2011-02-09 20:00:02 ----D---- D:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-02-08 01:43:38 ----A---- D:\WINDOWS\AviSplitter.INI
2011-02-07 15:50:49 ----A---- D:\WINDOWS\system32\drivers\USBSTOR.SYS
2011-02-06 23:14:02 ----D---- D:\Documents and Settings\Radon\Data aplikací\ATI
2011-02-06 23:07:30 ----HDC---- D:\WINDOWS\$NtUninstallXPSEPSCLP$
2011-02-06 23:07:16 ----D---- D:\WINDOWS\system32\cs-CZ
2011-02-06 23:05:58 ----D---- D:\Program Files\MSBuild
2011-02-06 22:59:17 ----D---- D:\WINDOWS\system32\XPSViewer
2011-02-06 22:59:14 ----D---- D:\WINDOWS\system32\en-us
2011-02-06 22:58:42 ----D---- D:\Program Files\Reference Assemblies
2011-02-06 22:58:23 ----N---- D:\WINDOWS\system32\spmsg2.dll
2011-02-06 22:57:54 ----N---- D:\WINDOWS\system32\spmsg.dll
2011-02-06 22:57:50 ----A---- D:\WINDOWS\system32\spupdsvc.exe
2011-02-06 22:57:48 ----HDC---- D:\WINDOWS\$NtUninstallWIC$
2011-02-06 22:51:32 ----RSD---- D:\WINDOWS\assembly
2011-02-06 22:50:56 ----D---- D:\WINDOWS\Microsoft.NET
2011-02-06 22:44:46 ----N---- D:\WINDOWS\system32\ati2sgag.exe
2011-02-06 22:44:32 ----D---- D:\WINDOWS\system32\ReinstallBackups
2011-02-06 22:44:24 ----D---- D:\Program Files\ATI Technologies
2011-02-06 22:44:19 ----HD---- D:\Program Files\InstallShield Installation Information
2011-02-06 22:43:42 ----D---- D:\Program Files\Common Files\InstallShield
2011-02-06 22:23:51 ----A---- D:\WINDOWS\system32\XAudio2_5.dll
2011-02-06 22:23:51 ----A---- D:\WINDOWS\system32\xactengine3_5.dll
2011-02-06 22:23:50 ----A---- D:\WINDOWS\system32\d3dcsx_42.dll
2011-02-06 22:23:50 ----A---- D:\WINDOWS\system32\D3DCompiler_42.dll
2011-02-06 22:23:49 ----A---- D:\WINDOWS\system32\d3dx11_42.dll
2011-02-06 22:23:49 ----A---- D:\WINDOWS\system32\d3dx10_42.dll
2011-02-06 22:23:48 ----A---- D:\WINDOWS\system32\D3DX9_42.dll
2011-02-06 22:23:48 ----A---- D:\WINDOWS\system32\D3DCompiler_41.dll
2011-02-06 22:23:47 ----A---- D:\WINDOWS\system32\D3DX9_41.dll
2011-02-06 22:23:47 ----A---- D:\WINDOWS\system32\d3dx10_41.dll
2011-02-06 22:23:46 ----A---- D:\WINDOWS\system32\XAudio2_4.dll
2011-02-06 22:23:46 ----A---- D:\WINDOWS\system32\XAPOFX1_3.dll
2011-02-06 22:23:46 ----A---- D:\WINDOWS\system32\xactengine3_4.dll
2011-02-06 22:23:45 ----A---- D:\WINDOWS\system32\X3DAudio1_6.dll
2011-02-06 22:23:45 ----A---- D:\WINDOWS\system32\d3dx10_40.dll
2011-02-06 22:23:45 ----A---- D:\WINDOWS\system32\D3DCompiler_40.dll
2011-02-06 22:23:44 ----A---- D:\WINDOWS\system32\XAudio2_3.dll
2011-02-06 22:23:44 ----A---- D:\WINDOWS\system32\XAPOFX1_2.dll
2011-02-06 22:23:44 ----A---- D:\WINDOWS\system32\D3DX9_40.dll
2011-02-06 22:23:43 ----A---- D:\WINDOWS\system32\xactengine3_3.dll
2011-02-06 22:23:43 ----A---- D:\WINDOWS\system32\X3DAudio1_5.dll
2011-02-06 22:23:42 ----A---- D:\WINDOWS\system32\XAudio2_2.dll
2011-02-06 22:23:42 ----A---- D:\WINDOWS\system32\XAPOFX1_1.dll
2011-02-06 22:23:42 ----A---- D:\WINDOWS\system32\xactengine3_2.dll
2011-02-06 22:23:42 ----A---- D:\WINDOWS\system32\d3dx10_39.dll
2011-02-06 22:23:42 ----A---- D:\WINDOWS\system32\D3DCompiler_39.dll
2011-02-06 22:23:41 ----A---- D:\WINDOWS\system32\D3DX9_39.dll
2011-02-06 22:23:40 ----A---- D:\WINDOWS\system32\XAudio2_1.dll
2011-02-06 22:23:40 ----A---- D:\WINDOWS\system32\XAPOFX1_0.dll
2011-02-06 22:23:40 ----A---- D:\WINDOWS\system32\xactengine3_1.dll
2011-02-06 22:23:40 ----A---- D:\WINDOWS\system32\X3DAudio1_4.dll
2011-02-06 22:23:39 ----A---- D:\WINDOWS\system32\D3DX9_38.dll
2011-02-06 22:23:39 ----A---- D:\WINDOWS\system32\d3dx10_38.dll
2011-02-06 22:23:39 ----A---- D:\WINDOWS\system32\D3DCompiler_38.dll
2011-02-06 22:23:38 ----A---- D:\WINDOWS\system32\XAudio2_0.dll
2011-02-06 22:23:38 ----A---- D:\WINDOWS\system32\xactengine3_0.dll
2011-02-06 22:23:37 ----A---- D:\WINDOWS\system32\X3DAudio1_3.dll
2011-02-06 22:23:37 ----A---- D:\WINDOWS\system32\d3dx10_37.dll
2011-02-06 22:23:37 ----A---- D:\WINDOWS\system32\D3DCompiler_37.dll
2011-02-06 22:23:36 ----A---- D:\WINDOWS\system32\xactengine2_10.dll
2011-02-06 22:23:36 ----A---- D:\WINDOWS\system32\D3DX9_37.dll
2011-02-06 22:23:35 ----A---- D:\WINDOWS\system32\d3dx9_36.dll
2011-02-06 22:23:35 ----A---- D:\WINDOWS\system32\d3dx10_36.dll
2011-02-06 22:23:35 ----A---- D:\WINDOWS\system32\D3DCompiler_36.dll
2011-02-06 22:23:34 ----A---- D:\WINDOWS\system32\xactengine2_9.dll
2011-02-06 22:23:33 ----A---- D:\WINDOWS\system32\d3dx9_35.dll
2011-02-06 22:23:33 ----A---- D:\WINDOWS\system32\d3dx10_35.dll
2011-02-06 22:23:33 ----A---- D:\WINDOWS\system32\D3DCompiler_35.dll
2011-02-06 22:23:32 ----A---- D:\WINDOWS\system32\xactengine2_8.dll
2011-02-06 22:23:32 ----A---- D:\WINDOWS\system32\X3DAudio1_2.dll
2011-02-06 22:23:32 ----A---- D:\WINDOWS\system32\d3dx10_34.dll
2011-02-06 22:23:32 ----A---- D:\WINDOWS\system32\D3DCompiler_34.dll
2011-02-06 22:23:31 ----A---- D:\WINDOWS\system32\d3dx9_34.dll
2011-02-06 22:23:30 ----A---- D:\WINDOWS\system32\xinput1_3.dll
2011-02-06 22:23:30 ----A---- D:\WINDOWS\system32\xactengine2_7.dll
2011-02-06 22:23:29 ----A---- D:\WINDOWS\system32\d3dx10_33.dll
2011-02-06 22:23:29 ----A---- D:\WINDOWS\system32\D3DCompiler_33.dll
2011-02-06 22:23:28 ----A---- D:\WINDOWS\system32\xactengine2_6.dll
2011-02-06 22:23:28 ----A---- D:\WINDOWS\system32\xactengine2_5.dll
2011-02-06 22:23:28 ----A---- D:\WINDOWS\system32\d3dx9_33.dll
2011-02-06 22:23:27 ----A---- D:\WINDOWS\system32\d3dx9_32.dll
2011-02-06 22:23:26 ----A---- D:\WINDOWS\system32\xactengine2_4.dll
2011-02-06 22:23:26 ----A---- D:\WINDOWS\system32\xactengine2_3.dll
2011-02-06 22:23:26 ----A---- D:\WINDOWS\system32\x3daudio1_1.dll
2011-02-06 22:23:26 ----A---- D:\WINDOWS\system32\d3dx9_31.dll
2011-02-06 22:23:25 ----A---- D:\WINDOWS\system32\xinput1_2.dll
2011-02-06 22:23:25 ----A---- D:\WINDOWS\system32\xinput1_1.dll
2011-02-06 22:23:25 ----A---- D:\WINDOWS\system32\xactengine2_2.dll
2011-02-06 22:23:24 ----A---- D:\WINDOWS\system32\xactengine2_1.dll
2011-02-06 22:23:24 ----A---- D:\WINDOWS\system32\xactengine2_0.dll
2011-02-06 22:23:24 ----A---- D:\WINDOWS\system32\x3daudio1_0.dll
2011-02-06 22:23:24 ----A---- D:\WINDOWS\system32\d3dx9_30.dll
2011-02-06 22:23:23 ----A---- D:\WINDOWS\system32\d3dx9_29.dll
2011-02-06 22:23:23 ----A---- D:\WINDOWS\system32\d3dx9_28.dll
2011-02-06 22:23:22 ----A---- D:\WINDOWS\system32\xinput9_1_0.dll
2011-02-06 22:23:22 ----A---- D:\WINDOWS\system32\d3dx9_27.dll
2011-02-06 22:23:21 ----A---- D:\WINDOWS\system32\d3dx9_26.dll
2011-02-06 22:23:20 ----A---- D:\WINDOWS\system32\d3dx9_25.dll
2011-02-06 22:23:19 ----A---- D:\WINDOWS\system32\d3dx9_24.dll
2011-02-06 22:18:09 ----HD---- D:\WINDOWS\msdownld.tmp
2011-02-06 22:18:05 ----D---- D:\WINDOWS\Logs
2011-02-06 22:17:55 ----D---- D:\Documents and Settings\Radon\Data aplikací\Macromedia
2011-02-06 22:17:55 ----D---- D:\Documents and Settings\Radon\Data aplikací\Adobe
2011-02-06 22:15:11 ----N---- D:\WINDOWS\system32\Ltih30tb.dll
2011-02-06 22:15:11 ----A---- D:\WINDOWS\system32\awrtl30.dll
2011-02-06 22:15:10 ----D---- D:\Program Files\WexTech
2011-02-06 22:15:10 ----D---- D:\Program Files\Common Files\WexTech Shared
2011-02-06 22:15:10 ----D---- D:\Program Files\Common Files\LHSPF
2011-02-06 22:15:07 ----A---- D:\WINDOWS\IsUninst.exe
2011-02-06 20:59:38 ----A---- D:\WINDOWS\system32\h323log.txt
2011-02-06 20:57:01 ----A---- D:\WINDOWS\system32\drivers\drmkaud.sys
2011-02-06 20:57:00 ----A---- D:\WINDOWS\system32\drivers\MSPQM.sys
2011-02-06 20:56:57 ----A---- D:\WINDOWS\system32\drivers\wdmaud.sys
2011-02-06 20:56:55 ----A---- D:\WINDOWS\system32\drivers\kmixer.sys
2011-02-06 20:56:54 ----A---- D:\WINDOWS\system32\drivers\sysaudio.sys
2011-02-06 20:56:52 ----A---- D:\WINDOWS\system32\drivers\splitter.sys
2011-02-06 20:56:49 ----A---- D:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011-02-06 20:56:47 ----A---- D:\WINDOWS\system32\drivers\aec.sys
2011-02-06 20:56:45 ----A---- D:\WINDOWS\system32\drivers\MSKSSRV.sys
2011-02-06 20:56:44 ----A---- D:\WINDOWS\system32\drivers\swmidi.sys
2011-02-06 20:56:41 ----A---- D:\WINDOWS\system32\drivers\DMusic.sys
2011-02-06 20:56:37 ----A---- D:\WINDOWS\system32\drivers\audstub.sys
2011-02-06 20:55:48 ----A---- D:\WINDOWS\system32\drivers\redbook.sys
2011-02-06 20:55:38 ----A---- D:\WINDOWS\system32\drivers\e100b325.sys
2011-02-06 20:55:29 ----A---- D:\WINDOWS\system32\drivers\ati2mtag.sys
2011-02-06 20:55:29 ----A---- D:\WINDOWS\system32\ativvaxx.dll
2011-02-06 20:55:29 ----A---- D:\WINDOWS\system32\ati3duag.dll
2011-02-06 20:55:29 ----A---- D:\WINDOWS\system32\ati3d1ag.dll
2011-02-06 20:55:28 ----A---- D:\WINDOWS\system32\ati2dvag.dll
2011-02-06 20:55:28 ----A---- D:\WINDOWS\system32\ati2cqag.dll
2011-02-06 20:55:09 ----A---- D:\WINDOWS\system32\drivers\ac97intc.sys
2011-02-06 20:55:07 ----A---- D:\WINDOWS\system32\ksuser.dll
2011-02-06 20:55:07 ----A---- D:\WINDOWS\system32\drivers\portcls.sys
2011-02-06 20:55:07 ----A---- D:\WINDOWS\system32\drivers\msmpu401.sys
2011-02-06 20:55:06 ----A---- D:\WINDOWS\system32\drivers\drmk.sys
2011-02-06 20:55:01 ----A---- D:\WINDOWS\system32\usbui.dll
2011-02-06 20:54:54 ----A---- D:\WINDOWS\system32\drivers\gameenum.sys
2011-02-06 20:54:45 ----A---- D:\WINDOWS\system32\drivers\AGP440.SYS
2011-02-06 20:52:49 ----A---- D:\WINDOWS\imsins.BAK
2011-02-06 20:52:45 ----SHD---- D:\WINDOWS\Installer
2011-02-06 20:52:45 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2011-02-06 20:52:44 ----D---- D:\Program Files\Common Files\ODBC
2011-02-06 20:52:44 ----A---- D:\WINDOWS\ODBCINST.INI
2011-02-06 20:52:40 ----D---- D:\Program Files\Common Files\SpeechEngines
2011-02-06 20:52:40 ----D---- D:\Program Files\Common Files\Microsoft Shared
2011-02-06 20:52:40 ----D---- D:\Program Files\Common Files
2011-02-06 20:52:36 ----RA---- D:\WINDOWS\system32\kbdtuq.dll
2011-02-06 20:52:36 ----RA---- D:\WINDOWS\system32\kbdtuf.dll
2011-02-06 20:52:36 ----RA---- D:\WINDOWS\system32\kbdazel.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbduzb.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdur.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdtat.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdmon.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdkyr.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdkaz.dll
2011-02-06 20:52:35 ----RA---- D:\WINDOWS\system32\kbdaze.dll
2011-02-06 20:52:34 ----RA---- D:\WINDOWS\system32\kbdycc.dll
2011-02-06 20:52:34 ----RA---- D:\WINDOWS\system32\kbdru1.dll
2011-02-06 20:52:34 ----RA---- D:\WINDOWS\system32\kbdru.dll
2011-02-06 20:52:34 ----RA---- D:\WINDOWS\system32\kbdbu.dll
2011-02-06 20:52:34 ----RA---- D:\WINDOWS\system32\kbdblr.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhept.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhela3.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhela2.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhe319.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhe220.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdhe.dll
2011-02-06 20:52:33 ----RA---- D:\WINDOWS\system32\kbdgkl.dll
2011-02-06 20:52:31 ----RA---- D:\WINDOWS\system32\kbdlv1.dll
2011-02-06 20:52:31 ----RA---- D:\WINDOWS\system32\kbdlv.dll
2011-02-06 20:52:31 ----RA---- D:\WINDOWS\system32\kbdlt1.dll
2011-02-06 20:52:31 ----RA---- D:\WINDOWS\system32\kbdlt.dll
2011-02-06 20:52:31 ----RA---- D:\WINDOWS\system32\kbdest.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdycl.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdsl1.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdsl.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdro.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdpl1.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdpl.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdhu1.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdhu.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\kbdcr.dll
2011-02-06 20:52:27 ----A---- D:\WINDOWS\system32\KBDAL.DLL
2011-02-06 20:52:25 ----A---- D:\WINDOWS\system32\spxcoins.dll
2011-02-06 20:52:25 ----A---- D:\WINDOWS\system32\irclass.dll
2011-02-06 20:52:25 ----A---- D:\WINDOWS\system32\EqnClass.Dll
2011-02-06 20:52:25 ----A---- D:\WINDOWS\system32\dgsetup.dll
2011-02-06 20:52:25 ----A---- D:\WINDOWS\system32\dgrpsetu.dll
2011-02-06 20:52:23 ----N---- D:\WINDOWS\system32\CONFIG.TMP
2011-02-06 20:52:23 ----A---- D:\WINDOWS\TASKMAN.EXE
2011-02-06 20:52:23 ----A---- D:\WINDOWS\system32\drivers\irenum.sys
2011-02-06 20:52:23 ----A---- D:\WINDOWS\system32\batt.dll
2011-02-06 20:52:23 ----A---- D:\WINDOWS\NOTEPAD.EXE
2011-02-06 20:52:20 ----A---- D:\WINDOWS\system32\storprop.dll
2011-02-06 20:52:09 ----ASH---- D:\Documents and Settings\All Users\Data aplikací\desktop.ini
2011-02-06 20:50:51 ----RA---- D:\WINDOWS\SET8.tmp
2011-02-06 20:50:48 ----RA---- D:\WINDOWS\SET4.tmp
2011-02-06 20:50:47 ----RA---- D:\WINDOWS\SET3.tmp
2011-02-06 20:50:42 ----D---- D:\WINDOWS\system32\CatRoot2
2011-02-06 20:50:42 ----D---- D:\WINDOWS\system32\CatRoot
2011-02-06 20:50:36 ----ASD---- D:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-02-06 20:50:18 ----A---- D:\WINDOWS\setuplog.txt
2011-02-06 20:50:13 ----D---- D:\Documents and Settings
2011-02-06 20:42:15 ----RSHDC---- D:\WINDOWS\system32\dllcache
2011-02-06 20:42:15 ----RSD---- D:\WINDOWS\Fonts
2011-02-06 20:42:15 ----RD---- D:\WINDOWS\Web
2011-02-06 20:42:15 ----HD---- D:\WINDOWS\inf
2011-02-06 20:42:15 ----D---- D:\WINDOWS\WinSxS
2011-02-06 20:42:15 ----D---- D:\WINDOWS\twain_32
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Temp
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\wins
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\wbem
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\usmt
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\spool
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\ShellExt
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\Setup
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\ras
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\oobe
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\npp
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\mui
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\inetsrv
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\IME
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\icsxml
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\ias
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\export
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\drivers\etc
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\drivers\disdn
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\drivers
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\dhcp
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\config
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\3com_dmi
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\3076
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\2052
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1054
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1042
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1041
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1037
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1033
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1031
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1029
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1028
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32\1025
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system32
2011-02-06 20:42:15 ----D---- D:\WINDOWS\system
2011-02-06 20:42:15 ----D---- D:\WINDOWS\security
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Resources
2011-02-06 20:42:15 ----D---- D:\WINDOWS\repair
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Provisioning
2011-02-06 20:42:15 ----D---- D:\WINDOWS\pchealth
2011-02-06 20:42:15 ----D---- D:\WINDOWS\PeerNet
2011-02-06 20:42:15 ----D---- D:\WINDOWS\mui
2011-02-06 20:42:15 ----D---- D:\WINDOWS\msapps
2011-02-06 20:42:15 ----D---- D:\WINDOWS\msagent
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Media
2011-02-06 20:42:15 ----D---- D:\WINDOWS\java
2011-02-06 20:42:15 ----D---- D:\WINDOWS\ime
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Help
2011-02-06 20:42:15 ----D---- D:\WINDOWS\ehome
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Driver Cache
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Debug
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Cursors
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Connection Wizard
2011-02-06 20:42:15 ----D---- D:\WINDOWS\Config
2011-02-06 20:42:15 ----D---- D:\WINDOWS\AppPatch
2011-02-06 20:42:15 ----D---- D:\WINDOWS\addins
2011-02-06 20:42:15 ----D---- D:\WINDOWS
2011-02-06 20:42:15 ----ASH---- D:\pagefile.sys
2011-02-06 20:19:43 ----D---- D:\Program Files\7-Zip
2011-02-06 20:17:12 ----D---- D:\Documents and Settings\Radon\Data aplikací\Opera
2011-02-06 20:17:07 ----D---- D:\Program Files\Opera
2011-02-06 20:15:11 ----D---- D:\Documents and Settings\Radon\Data aplikací\Identities
2011-02-06 20:15:08 ----HD---- D:\Program Files\Uninstall Information
2011-02-06 20:14:51 ----SD---- D:\Documents and Settings\Radon\Data aplikací\Microsoft
2011-02-06 20:14:51 ----ASH---- D:\Documents and Settings\Radon\Data aplikací\desktop.ini
2011-02-06 20:13:34 ----D---- D:\WINDOWS\SoftwareDistribution
2011-02-06 20:13:25 ----D---- D:\WINDOWS\Prefetch
2011-02-06 20:13:24 ----SD---- D:\WINDOWS\system32\Microsoft
2011-02-06 20:13:24 ----A---- D:\WINDOWS\SchedLgU.Txt
2011-02-06 20:08:47 ----D---- D:\WINDOWS\system32\xircom
2011-02-06 20:08:47 ----D---- D:\Program Files\xerox
2011-02-06 20:08:47 ----D---- D:\Program Files\microsoft frontpage
2011-02-06 20:08:15 ----A---- D:\WINDOWS\control.ini
2011-02-06 20:07:56 ----A---- D:\WINDOWS\OEWABLog.txt
2011-02-06 20:07:49 ----A---- D:\WINDOWS\system32\mapi32.dll
2011-02-06 20:06:23 ----SD---- D:\WINDOWS\Downloaded Program Files
2011-02-06 20:06:23 ----RD---- D:\WINDOWS\Offline Web Pages
2011-02-06 20:06:23 ----RAH---- D:\WINDOWS\system32\logonui.exe.manifest
2011-02-06 20:06:13 ----RAH---- D:\WINDOWS\system32\cdplayer.exe.manifest
2011-02-06 20:06:06 ----HD---- D:\Program Files\WindowsUpdate
2011-02-06 20:06:01 ----D---- D:\Program Files\Online Services
2011-02-06 20:05:42 ----D---- D:\WINDOWS\system32\DirectX
2011-02-06 20:05:25 ----A---- D:\WINDOWS\system32\atrace.dll
2011-02-06 20:05:23 ----A---- D:\WINDOWS\system32\desktop.ini
2011-02-06 20:05:23 ----A---- D:\WINDOWS\desktop.ini
2011-02-06 20:05:17 ----A---- D:\WINDOWS\system32\nmevtmsg.dll
2011-02-06 20:05:16 ----D---- D:\Program Files\Common Files\Services
2011-02-06 20:05:16 ----A---- D:\WINDOWS\system32\acctres.dll
2011-02-06 20:05:14 ----SD---- D:\WINDOWS\Tasks
2011-02-06 20:05:14 ----A---- D:\WINDOWS\system32\icfgnt5.dll
2011-02-06 20:05:13 ----D---- D:\Program Files\Common Files\MSSoap
2011-02-06 20:05:10 ----D---- D:\WINDOWS\srchasst
2011-02-06 20:05:09 ----D---- D:\WINDOWS\system32\Macromed
2011-02-06 20:05:07 ----A---- D:\WINDOWS\system32\wuweb.dll
2011-02-06 20:05:07 ----A---- D:\WINDOWS\system32\wucltui.dll
2011-02-06 20:05:07 ----A---- D:\WINDOWS\system32\wuauserv.dll
2011-02-06 20:05:07 ----A---- D:\WINDOWS\system32\wuaueng1.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\wups.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\wuaueng.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\wuauclt1.exe
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\wuauclt.exe
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\wuapi.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\qmgrprxy.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\qmgr.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\bitsprx3.dll
2011-02-06 20:05:06 ----A---- D:\WINDOWS\system32\bitsprx2.dll
2011-02-06 20:05:02 ----D---- D:\Program Files\Movie Maker
2011-02-06 20:04:59 ----A---- D:\WINDOWS\system32\safrslv.dll
2011-02-06 20:04:59 ----A---- D:\WINDOWS\system32\safrdm.dll
2011-02-06 20:04:59 ----A---- D:\WINDOWS\system32\safrcdlg.dll
2011-02-06 20:04:59 ----A---- D:\WINDOWS\system32\racpldlg.dll
2011-02-06 20:04:56 ----D---- D:\WINDOWS\system32\Restore
2011-02-06 20:04:56 ----A---- D:\WINDOWS\system32\fltMc.exe
2011-02-06 20:04:56 ----A---- D:\WINDOWS\system32\fltlib.dll
2011-02-06 20:04:56 ----A---- D:\WINDOWS\system32\drivers\fltMgr.sys
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\srsvc.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\srrstr.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\srclient.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\mnmdd.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\isrdbg32.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\ils.dll
2011-02-06 20:04:55 ----A---- D:\WINDOWS\system32\drivers\sr.sys
2011-02-06 20:04:54 ----A---- D:\WINDOWS\system32\nmmkcert.dll
2011-02-06 20:04:54 ----A---- D:\WINDOWS\system32\msconf.dll
2011-02-06 20:04:54 ----A---- D:\WINDOWS\system32\mnmsrvc.exe
2011-02-06 20:04:52 ----D---- D:\Program Files\NetMeeting
2011-02-06 20:04:52 ----A---- D:\WINDOWS\system32\msoert2.dll
2011-02-06 20:04:52 ----A---- D:\WINDOWS\system32\msoeacct.dll
2011-02-06 20:04:51 ----A---- D:\WINDOWS\system32\inetres.dll
2011-02-06 20:04:51 ----A---- D:\WINDOWS\system32\inetcomm.dll
2011-02-06 20:04:50 ----D---- D:\Program Files\Outlook Express
2011-02-06 20:04:50 ----A---- D:\WINDOWS\system32\schedsvc.dll
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\mstinit.exe
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\mstask.dll
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\isign32.dll
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\inetcfg.dll
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\icwphbk.dll
2011-02-06 20:04:49 ----A---- D:\WINDOWS\system32\icwdial.dll
2011-02-06 20:04:44 ----D---- D:\Program Files\Common Files\System
2011-02-06 20:04:41 ----D---- D:\Program Files\Internet Explorer
2011-02-06 20:03:48 ----D---- D:\Program Files\ComPlus Applications
2011-02-06 20:03:45 ----A---- D:\WINDOWS\vbaddin.ini
2011-02-06 20:03:45 ----A---- D:\WINDOWS\vb.ini
2011-02-06 20:03:38 ----D---- D:\WINDOWS\Registration
2011-02-06 20:03:28 ----D---- D:\Program Files\Windows Media Player
2011-02-06 20:03:21 ----D---- D:\Program Files\Messenger
2011-02-06 20:03:18 ----D---- D:\Program Files\MSN Gaming Zone
2011-02-06 20:03:18 ----A---- D:\WINDOWS\system32\write.exe
2011-02-06 20:03:09 ----A---- D:\WINDOWS\system32\sndvol32.exe
2011-02-06 20:03:09 ----A---- D:\WINDOWS\system32\hticons.dll
2011-02-06 20:03:09 ----A---- D:\WINDOWS\system32\avwav.dll
2011-02-06 20:03:09 ----A---- D:\WINDOWS\system32\avtapi.dll
2011-02-06 20:03:09 ----A---- D:\WINDOWS\system32\avmeter.dll
2011-02-06 20:03:08 ----A---- D:\WINDOWS\system32\winchat.exe
2011-02-06 20:03:03 ----A---- D:\WINDOWS\system32\charmap.exe
2011-02-06 20:03:03 ----A---- D:\WINDOWS\system32\getuname.dll
2011-02-06 20:03:02 ----A---- D:\WINDOWS\system32\winmine.exe
2011-02-06 20:03:02 ----A---- D:\WINDOWS\system32\sol.exe
2011-02-06 20:03:02 ----A---- D:\WINDOWS\system32\mshearts.exe
2011-02-06 20:03:02 ----A---- D:\WINDOWS\system32\freecell.exe
2011-02-06 20:03:02 ----A---- D:\WINDOWS\system32\calc.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\usrlogon.cmd
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\tsshutdn.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\tslabels.ini
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\tskill.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\tsdiscon.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\tscon.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\shadow.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\rwinsta.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\reset.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\regini.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\rdpcfgex.dll
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\qwinsta.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\qappsrv.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\msg.exe
2011-02-06 20:03:01 ----A---- D:\WINDOWS\system32\logoff.exe
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\mtxlegih.dll
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\mtxex.dll
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\mtxdm.dll
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\msdtcprf.ini
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\dcomcnfg.exe
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\comaddin.dll
2011-02-06 20:03:00 ----A---- D:\WINDOWS\system32\cdmodem.dll
2011-02-06 20:02:59 ----A---- D:\WINDOWS\system32\stclient.dll
2011-02-06 20:02:59 ----A---- D:\WINDOWS\system32\comsnap.dll
2011-02-06 20:02:59 ----A---- D:\WINDOWS\system32\comrepl.dll
2011-02-06 20:02:55 ----A---- D:\WINDOWS\system32\wmimgmt.msc
2011-02-06 20:02:54 ----A---- D:\WINDOWS\system32\sndrec32.exe
2011-02-06 20:02:54 ----A---- D:\WINDOWS\system32\mplay32.exe
2011-02-06 20:02:54 ----A---- D:\WINDOWS\system32\accwiz.exe
2011-02-06 20:02:53 ----D---- D:\Program Files\Windows NT
2011-02-06 20:02:53 ----A---- D:\WINDOWS\system32\spider.exe
2011-02-06 20:02:53 ----A---- D:\WINDOWS\system32\mspaint.exe
2011-02-06 20:02:53 ----A---- D:\WINDOWS\system32\hypertrm.dll
2011-02-06 20:02:53 ----A---- D:\WINDOWS\system32\clipbrd.exe
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\tscfgwmi.dll
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\remotepg.dll
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\rdshost.exe
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\rdsaddin.exe
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\mstscax.dll
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\mstsc.exe
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\drivers\tdtcp.sys
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\drivers\tdpipe.sys
2011-02-06 20:02:52 ----A---- D:\WINDOWS\system32\drivers\rdpwd.sys
2011-02-06 20:02:51 ----D---- D:\WINDOWS\system32\MsDtc
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\tscupgrd.exe
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\termsrv.dll
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\sessmgr.exe
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\rdpwsx.dll
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\rdpsnd.dll
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\rdpclip.exe
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\rdchost.dll
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\qprocess.exe
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\icaapi.dll
2011-02-06 20:02:51 ----A---- D:\WINDOWS\system32\cfgbkend.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\xolehlp.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\mtxoci.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\msdtcuiu.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\msdtctm.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\msdtcprx.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\msdtclog.dll
2011-02-06 20:02:50 ----A---- D:\WINDOWS\system32\msdtc.exe
2011-02-06 20:02:49 ----D---- D:\WINDOWS\system32\Com
2011-02-06 20:02:49 ----A---- D:\WINDOWS\system32\colbact.dll
2011-02-06 20:02:49 ----A---- D:\WINDOWS\system32\clbcatex.dll
2011-02-06 20:02:49 ----A---- D:\WINDOWS\system32\catsrvut.dll
2011-02-06 20:02:49 ----A---- D:\WINDOWS\system32\catsrvps.dll
2011-02-06 20:02:49 ----A---- D:\WINDOWS\system32\catsrv.dll
2011-02-06 20:02:48 ----A---- D:\WINDOWS\system32\comuid.dll
2011-02-06 20:02:48 ----A---- D:\WINDOWS\system32\comsvcs.dll
2011-02-06 20:02:48 ----A---- D:\WINDOWS\system32\clbcatq.dll
2011-02-06 20:02:43 ----A---- D:\WINDOWS\system32\servdeps.dll
2011-02-06 20:02:43 ----A---- D:\WINDOWS\system32\mmfutil.dll
2011-02-06 20:02:42 ----A---- D:\WINDOWS\system32\licwmi.dll
2011-02-06 20:02:42 ----A---- D:\WINDOWS\system32\cmprops.dll
2011-02-06 20:02:37 ----A---- D:\WINDOWS\system32\drivers\rdpdr.sys
2011-02-06 20:02:36 ----A---- D:\WINDOWS\system32\drivers\termdd.sys
2011-02-06 19:35:03 ----D---- D:\.wine

======List of files/folders modified in the last 1 months======

2011-03-02 14:57:09 ----RD---- D:\Program Files
2011-03-01 15:20:16 ----SHD---- D:\Config.Msi
2011-02-17 18:37:11 ----D---- D:\Downloads
2011-02-13 17:56:46 ----SHD---- D:\RECYCLER
2011-02-11 22:25:55 ----A---- D:\WINDOWS\win.ini
2011-02-09 20:02:23 ----D---- D:\Downloadnet
2011-02-08 01:10:31 ----SHD---- D:\System Volume Information
2011-02-06 20:52:38 ----A---- D:\WINDOWS\system.ini
2011-02-06 20:07:32 ----ASH---- D:\WINDOWS\fonts\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; D:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; D:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-02-09 218688]
R3 E100B;Intel(R) PRO Adapter Driver; D:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
R3 hidusb;Ovladač třídy standardu HID; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 ati2mtag;ati2mtag; D:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
S3 C-Dilla;C-Dilla; \??\D:\WINDOWS\system32\drivers\CDANT.SYS []
S3 exqdl;exqdl; \??\D:\WINDOWS\system32\01.tmp []
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; D:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
S3 StarOpen;StarOpen; D:\WINDOWS\system32\drivers\StarOpen.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Ati HotKey Poller;Ati HotKey Poller; D:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
S2 ATI Smart;ATI Smart; D:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S2 C-DillaSrv;C-DillaSrv; D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE [2002-07-18 46080]
S2 NMSAccess;NMSAccess; D:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-03-01 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 SwitchBoard;SwitchBoard; D:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

ComboFix 11-03-01.03 - Radon 02.03.2011 16:36:03.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.783 [GMT 1:00]
Spuštěný z: d:\documents and settings\Radon\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\idjxfae.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_kqaqmk
-------\Service_kqaqmk


((((((((((((((((((((((((( Soubory vytvořené od 2011-02-02 do 2011-03-02 )))))))))))))))))))))))))))))))
.

2011-03-02 13:57 . 2011-03-02 14:13 -------- d-----w- d:\program files\trend micro
2011-03-02 13:57 . 2011-03-02 13:57 -------- d-----w- D:\rsit
2011-03-01 21:32 . 2011-03-01 21:34 -------- d-----w- d:\program files\Spybot - Search & Destroy
2011-02-26 13:26 . 2011-02-26 13:26 -------- d-----w- d:\program files\Adobe Media Player
2011-02-24 16:48 . 2011-02-24 16:48 -------- d-----w- d:\program files\OpenOffice.org 3
2011-02-17 17:33 . 2011-02-17 17:33 -------- d-----w- d:\program files\CDBurnerXP
2011-02-17 15:50 . 2011-02-17 15:50 -------- d-----w- d:\program files\MAXON
2011-02-13 17:12 . 2011-02-13 17:12 -------- d-----w- d:\program files\SecurityXploded
2011-02-11 22:00 . 2011-02-11 22:00 -------- d-----w- d:\program files\Kalypso
2011-02-11 17:41 . 2011-02-11 17:41 -------- d-----w- d:\program files\BitTorrent
2011-02-10 23:00 . 2011-02-10 23:00 -------- d-----w- d:\program files\Codec Pack - All In 1
2011-02-09 22:26 . 2011-02-09 22:26 -------- d-----w- d:\program files\GIMP-2.0
2011-02-09 19:00 . 2011-02-09 19:00 -------- d-----w- d:\program files\DAEMON Tools Lite
2011-02-06 22:05 . 2011-02-06 22:05 -------- d-----w- d:\program files\MSBuild
2011-02-06 21:58 . 2011-02-06 21:58 -------- d-----w- d:\program files\Reference Assemblies
2011-02-06 21:44 . 2011-02-06 22:12 -------- d-----w- d:\program files\ATI Technologies
2011-02-06 21:44 . 2011-02-27 14:29 -------- d--h--w- d:\program files\InstallShield Installation Information
2011-02-06 21:15 . 2011-02-06 21:15 -------- d-----w- d:\program files\WexTech

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-22 17:59 . 2010-11-22 17:59 14996216 ----a-w- d:\program files\mx3.0.18.2000.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"AdobeAAMUpdater-1.0"="d:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-02-26 500208]
"SwitchBoard"="d:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="d:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

d:\documents and settings\Radon\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7016:TCP"= 7016:TCP:lqsmuao

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;d:\windows\system32\drivers\dtsoftbus01.sys [9.2.2011 20:00 218688]
S2 kqaqmk;Driver Microsoft;d:\windows\system32\svchost.exe -k netsvcs [17.8.2004 14:49 14336]
S3 exqdl;exqdl;\??\d:\windows\system32\01.tmp --> d:\windows\system32\01.tmp [?]
S3 SwitchBoard;SwitchBoard;d:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kqaqmk
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-AdobeBridge - (no file)
AddRemove-Freeraser - d:\program files\Codyssey\Freeraser\Uninstall.exe
AddRemove-UnityWebPlayer - d:\documents and settings\Radon\Local Settings\Data aplikací\Unity\WebPlayer\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-02 16:46
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\exqdl]
"ImagePath"="\??\d:\windows\system32\01.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kqaqmk]
"ServiceDll"="d:\windows\system32\idjxfae.dll"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(640)
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1620)
d:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\DRIVERS\CDANTSRV.EXE
d:\program files\CDBurnerXP\NMSAccessU.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-03-02 16:49:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-03-02 15:49

Před spuštěním: 4 874 072 064
Po spuštění: 4 830 257 152

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - BA61717398D8F65BE63C44825FEE1DF6

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  "SpybotSD TeaTimer"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "AdobeAAMUpdater-1.0"=-
  "SwitchBoard"=-
  "AdobeCS5ServiceManager"=-
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "7016:TCP"=-
  
  Driver::
  kqaqmk
  exqdl
  
  File::
  d:\windows\system32\01.tmp
  
  NetSvc::
  kqaqmk
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte