VIRY.CZ

RSIT :
Logfile of random's system information tool 1.08 (written by random/random)
Run by Marek at 2011-05-23 16:35:56
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (37%) free of 30 GB
Total RAM: 511 MB (18% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:36:18, on 23.5.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21256)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Marek\Plocha\RSIT.exe
C:\Program Files\trend micro\Marek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB001" /M "Stylus C48"
O4 - HKLM\..\Run: [Speedfan] C:\Program Files\SpeedFan/speedfan.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Reloader] C:\WINDOWS\NiwradSoft Shell Pack\Tools\Reloader.exe /S
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\WORD\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Billeo - {97ED3A9F-CD6F-473A-8FE1-7505C1B844C3} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra button: Unibet - {BC3F8E6D-44CF-4B7D-BB80-84CBEA6B350C} - C:\Microgaming\Poker\unibetpokerMPP\MPPoker.exe (HKCU)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (Omega 1.6693) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5311 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-12-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2009-11-09 180224]
"EPSON Stylus C48 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE [2005-05-17 99840]
"Speedfan"=C:\Program Files\SpeedFan/speedfan.exe [2011-03-17 4523928]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-10-29 4620288]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-10-29 86016]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]
"Reloader"=C:\WINDOWS\NiwradSoft Shell Pack\Tools\Reloader.exe [2010-07-04 325046]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe [2004-02-13 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NiwradSoft Welcome]
C:\WINDOWS\NiwradSoft Shell Pack\Tools\NS Welcome.exe [2010-07-04 243442]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 265728]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vds]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"HonorAutoRunSetting"=1
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe"="C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe:*:Enabled:Nokia Ovi Suite 2"
"C:\WINDOWS\system32\LEXPPS.EXE"="C:\WINDOWS\system32\LEXPPS.EXE:*:Enabled:LEXPPS.EXE"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"D:\FM2011\fm.exe"="D:\FM2011\fm.exe:*:Enabled:Football Manager 2011"
"D:\skype\Phone\Skype.exe"="D:\skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Casino\ParadiseCasino\casino.exe"="D:\Casino\ParadiseCasino\casino.exe:*:Enabled:casino"
"D:\ICQ7.5\ICQ.exe"="D:\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\ICQ7.5\ICQ.exe"="D:\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

======List of files/folders created in the last 1 months======

2011-05-23 16:36:01 ----D---- C:\Program Files\trend micro
2011-05-23 16:35:56 ----D---- C:\rsit
2011-05-23 15:40:09 ----SHD---- C:\RECYCLER
2011-05-23 15:40:04 ----D---- C:\WINDOWS\temp
2011-05-23 15:40:01 ----A---- C:\ComboFix.txt
2011-05-16 22:14:15 ----D---- C:\WINDOWS\Prefetch
2011-05-16 21:55:29 ----A---- C:\WINDOWS\zip.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\SWSC.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\SWREG.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\sed.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\PEV.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\NIRCMD.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\MBR.exe
2011-05-16 21:55:29 ----A---- C:\WINDOWS\grep.exe
2011-05-16 21:55:08 ----D---- C:\Qoobox
2011-05-07 21:08:28 ----D---- C:\Program Files\ICQ6Toolbar
2011-04-28 23:08:28 ----D---- C:\Program Files\Defraggler
2011-04-27 09:56:29 ----D---- C:\Documents and Settings\Marek\Data aplikací\Uniblue
2011-04-27 00:27:13 ----ASH---- C:\hiberfil.sys
2011-04-27 00:25:29 ----A---- C:\WINDOWS\system32\nvwrszht.dll
2011-04-27 00:25:29 ----A---- C:\WINDOWS\system32\nvwrszhc.dll
2011-04-27 00:25:29 ----A---- C:\WINDOWS\system32\nvrszht.dll
2011-04-27 00:25:29 ----A---- C:\WINDOWS\system32\nvrszhc.dll
2011-04-27 00:25:28 ----A---- C:\WINDOWS\system32\nvwrstr.dll
2011-04-27 00:25:28 ----A---- C:\WINDOWS\system32\nvwrssv.dll
2011-04-27 00:25:28 ----A---- C:\WINDOWS\system32\nvwrssl.dll
2011-04-27 00:25:28 ----A---- C:\WINDOWS\system32\nvrstr.dll
2011-04-27 00:25:28 ----A---- C:\WINDOWS\system32\nvrssv.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvwrssk.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvwrsru.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvwrsptb.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvrssl.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvrssk.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvrsru.dll
2011-04-27 00:25:27 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvwrspt.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvwrspl.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvwrsno.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvrspt.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvrspl.dll
2011-04-27 00:25:26 ----A---- C:\WINDOWS\system32\nvrsno.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvwrsnl.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvwrsko.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvwrsja.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvwrsit.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvrsko.dll
2011-04-27 00:25:25 ----A---- C:\WINDOWS\system32\nvrsja.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvwrshu.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvwrshe.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvwrsfr.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvrsit.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvrshu.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvrshe.dll
2011-04-27 00:25:24 ----A---- C:\WINDOWS\system32\nvrsfr.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvwrsfi.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvwrsesm.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvwrses.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvwrseng.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2011-04-27 00:25:23 ----A---- C:\WINDOWS\system32\nvrses.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvwrsel.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvwrsde.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvwrsda.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvrseng.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvrsel.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvrsde.dll
2011-04-27 00:25:22 ----A---- C:\WINDOWS\system32\nvrsda.dll
2011-04-27 00:25:21 ----A---- C:\WINDOWS\system32\nwiz.exe
2011-04-27 00:25:21 ----A---- C:\WINDOWS\system32\nvwrscs.dll
2011-04-27 00:25:21 ----A---- C:\WINDOWS\system32\nvwrsar.dll
2011-04-27 00:25:21 ----A---- C:\WINDOWS\system32\nvrscs.dll
2011-04-27 00:25:21 ----A---- C:\WINDOWS\system32\nvrsar.dll
2011-04-27 00:25:20 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2011-04-27 00:25:20 ----A---- C:\WINDOWS\system32\nvshell.dll
2011-04-27 00:25:20 ----A---- C:\WINDOWS\system32\nview.dll
2011-04-27 00:25:19 ----A---- C:\WINDOWS\system32\nvudisp.exe
2011-04-27 00:25:19 ----A---- C:\WINDOWS\system32\nvappbar.exe
2011-04-27 00:25:19 ----A---- C:\WINDOWS\system32\keystone.exe
2011-04-27 00:15:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\nView_Profiles
2011-04-27 00:09:41 ----A---- C:\WINDOWS\system32\nvwimg.dll
2011-04-27 00:09:41 ----A---- C:\WINDOWS\system32\nvdspsch.exe
2011-04-27 00:09:04 ----A---- C:\WINDOWS\iun6002.exe
2011-04-27 00:08:41 ----D---- C:\Program Files\Nvidia Omega Drivers
2011-04-26 14:08:28 ----A---- C:\WINDOWS\system32\midimap.dll.niwrad
2011-04-26 14:07:25 ----A---- C:\WINDOWS\system32\uxtheme.dll.backup
2011-04-26 14:07:03 ----HD---- C:\WINDOWS\NiwradSoft Shell Pack
2011-04-26 14:01:13 ----A---- C:\WINDOWS\esellerateEngine.dll

======List of files/folders modified in the last 1 months======

2011-05-23 16:36:01 ----RD---- C:\Program Files
2011-05-23 15:40:05 ----D---- C:\WINDOWS\system32\drivers
2011-05-23 15:40:04 ----D---- C:\WINDOWS
2011-05-23 15:39:04 ----SD---- C:\WINDOWS\Tasks
2011-05-23 15:36:39 ----D---- C:\WINDOWS\system32\CatRoot2
2011-05-23 15:33:35 ----D---- C:\WINDOWS\system32
2011-05-23 15:33:35 ----A---- C:\WINDOWS\system.ini
2011-05-23 15:33:23 ----D---- C:\Program Files\SpeedFan
2011-05-23 15:33:20 ----D---- C:\WINDOWS\ERDNT
2011-05-23 15:33:14 ----D---- C:\WINDOWS\system32\drivers\etc
2011-05-23 15:28:03 ----D---- C:\WINDOWS\AppPatch
2011-05-23 15:28:00 ----D---- C:\Program Files\Common Files
2011-05-23 15:18:49 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-05-23 15:09:23 ----D---- C:\Documents and Settings\Marek\Data aplikací\ICQ
2011-05-16 22:50:25 ----D---- C:\Program Files\CCleaner
2011-05-16 22:11:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-05-16 21:44:33 ----D---- C:\Program Files\Mozilla Firefox
2011-05-15 21:33:49 ----RD---- C:\WINDOWS\Web
2011-05-15 21:31:03 ----A---- C:\WINDOWS\ODBCINST.INI
2011-05-15 21:28:45 ----D---- C:\WINDOWS\system32\CatRoot
2011-05-15 21:26:38 ----D---- C:\WINDOWS\system32\ias
2011-05-15 21:24:12 ----SHD---- C:\WINDOWS\Installer
2011-05-15 21:22:27 ----SD---- C:\Documents and Settings\Marek\Data aplikací\Microsoft
2011-05-14 12:57:28 ----A---- C:\WINDOWS\NeroDigital.ini
2011-05-10 12:02:25 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-05-08 00:12:41 ----D---- C:\Documents and Settings\Marek\Data aplikací\Skype
2011-05-08 00:10:22 ----D---- C:\Documents and Settings\Marek\Data aplikací\skypePM
2011-05-07 21:08:20 ----HD---- C:\Program Files\InstallShield Installation Information
2011-05-07 21:08:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2011-04-27 10:16:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2011-04-27 10:06:51 ----D---- C:\WINDOWS\system32\config
2011-04-27 00:27:08 ----D---- C:\WINDOWS\Help
2011-04-27 00:27:07 ----D---- C:\WINDOWS\nview
2011-04-27 00:25:04 ----HD---- C:\WINDOWS\inf
2011-04-27 00:18:44 ----D---- C:\WINDOWS\system32\ReinstallBackups
2011-04-26 23:46:20 ----SHD---- C:\System Volume Information
2011-04-26 23:46:20 ----D---- C:\WINDOWS\system32\Restore
2011-04-26 14:12:28 ----D---- C:\Program Files\Windows Media Player
2011-04-26 14:12:28 ----D---- C:\Program Files\Outlook Express
2011-04-26 14:12:28 ----D---- C:\Program Files\Common Files\System
2011-04-26 14:12:27 ----D---- C:\WINDOWS\system32\usmt
2011-04-26 14:12:27 ----D---- C:\WINDOWS\srchasst
2011-04-26 14:12:27 ----D---- C:\Program Files\Windows NT
2011-04-26 14:12:27 ----D---- C:\Program Files\Internet Explorer
2011-04-26 14:10:40 ----RSD---- C:\WINDOWS\Fonts
2011-04-26 14:07:25 ----A---- C:\WINDOWS\system32\uxtheme.dll
2011-04-26 13:57:18 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-11-14 43528]
R0 speedfan;speedfan; C:\WINDOWS\system32\speedfan.sys [2010-12-18 21696]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-07-25 691696]
R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R0 viaagp1;VIA AGP Filter; C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2003-07-02 27904]
R0 viamraid;viamraid; C:\WINDOWS\system32\DRIVERS\viamraid.sys [2004-03-29 73600]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-07-13 91904]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2004-08-23 821760]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-03-29 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-10-29 2826944]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 CrystalSysInfo;CrystalSysInfo; C:\WINDOWS\system32\drivers\CrystalSysInfo.sys []
S3 mbr;mbr; \??\C:\DOCUME~1\Marek\LOCALS~1\Temp\mbr.sys []
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys [2009-05-23 29696]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-07-13 132224]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2004-01-14 311296]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service (Omega 1.6693) (Q); C:\WINDOWS\system32\nvsvc32.exe [2004-10-29 127043]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2011-03-01 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-10-20 630272]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-11 153376]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


COMBOFIX:
ComboFix 11-05-22.01 - Marek 23.05.2011 15:20:30.15.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.317 [GMT 2:00]
Spuštěný z: c:\documents and settings\Marek\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\Marek\LOCALS~1\Temp\sfamcc00001.dll
c:\docume~1\Marek\LOCALS~1\Temp\sfareca00001.dll
c:\documents and settings\Marek\Local Settings\temp\sfamcc00001.dll
c:\documents and settings\Marek\Local Settings\temp\sfareca00001.dll
.
Nakažená kopie c:\windows\system32\midimap.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\midimap.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-23 do 2011-05-23 )))))))))))))))))))))))))))))))
.
.
2011-05-16 21:11 . 2011-05-16 21:11 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-07 19:08 . 2011-05-07 19:08 -------- d-----w- c:\program files\ICQ6Toolbar
2011-04-28 21:08 . 2011-04-28 21:08 -------- d-----w- c:\program files\Defraggler
2011-04-27 07:56 . 2011-04-27 07:56 -------- d-----w- c:\documents and settings\Marek\Data aplikací\Uniblue
2011-04-27 07:55 . 2011-04-27 07:55 -------- d-----w- c:\documents and settings\Marek\Local Settings\Data aplikací\PackageAware
2011-04-26 22:15 . 2011-04-26 22:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\nView_Profiles
2011-04-26 22:09 . 2004-10-29 20:50 1339392 ----a-w- c:\windows\system32\nvdspsch.exe
2011-04-26 22:09 . 2004-10-29 20:50 1019904 ----a-w- c:\windows\system32\nvwimg.dll
2011-04-26 22:09 . 2011-04-26 22:08 737280 ----a-w- c:\windows\iun6002.exe
2011-04-26 22:08 . 2011-04-26 22:08 -------- d-----w- c:\program files\Nvidia Omega Drivers
2011-04-26 12:08 . 2008-04-14 07:51 42496 ----a-w- c:\windows\system32\midimap.dll.niwrad
2011-04-26 12:07 . 2008-04-14 07:52 219648 ----a-w- c:\windows\system32\uxtheme.dll.backup
2011-04-26 12:07 . 2011-05-23 13:33 -------- d--h--w- c:\windows\NiwradSoft Shell Pack
2011-04-26 12:01 . 2002-12-21 17:04 327680 ----a-w- c:\windows\esellerateEngine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-26 12:07 . 2004-08-17 13:49 219648 ----a-w- c:\windows\system32\uxtheme.dll
2011-04-30 19:23 . 2011-04-03 08:56 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2009-08-31 13:25 . 2005-08-09 00:18 118000 ----a-w- c:\program files\mozilla firefox\components\qippipe.dll
.
.
------- Sigcheck -------
.
[7] 2008-04-14 07:51 . E7B375DFFB68A16659CA66474A280C47 . 806912 . . [2001.12.4414.700] . . c:\windows\ERDNT\cache\comres.dll
[7] 2008-04-14 07:51 . E7B375DFFB68A16659CA66474A280C47 . 806912 . . [2001.12.4414.700] . . c:\windows\NiwradSoft Shell Pack\Backup\comres.dll
[-] 2008-04-14 07:51 . 9BBABCB691B887769048255FA7047C05 . 1508864 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll
[-] 2008-04-14 07:51 . 9BBABCB691B887769048255FA7047C05 . 1508864 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[-] 2008-04-14 07:51 . 9BBABCB691B887769048255FA7047C05 . 1508864 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll
[7] 2004-08-17 13:49 . B44F68274AB7B8A54E9AD74AFF0EFAAC . 806912 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll
.
[7] 2008-04-14 . CDDB1F8E1AEA356F3AD106F2CF9B7FEA . 507904 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\winlogon.exe
[7] 2008-04-14 . CDDB1F8E1AEA356F3AD106F2CF9B7FEA . 507904 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe
[-] 2008-04-14 . 471341D353962A35DA3C6324D59D09C4 . 547328 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . 471341D353962A35DA3C6324D59D09C4 . 547328 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . 471341D353962A35DA3C6324D59D09C4 . 547328 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
[7] 2004-08-17 . 221C29AE1B4CC61D11D8B27DE78B2307 . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe
.
[7] 2008-04-14 . 4F993463DC5F3F80D77A3D34D7BFBFED . 617472 . . [5.82] . . c:\windows\ERDNT\cache\comctl32.dll
[7] 2008-04-14 . 4F993463DC5F3F80D77A3D34D7BFBFED . 617472 . . [5.82] . . c:\windows\NiwradSoft Shell Pack\Backup\comctl32.dll
[-] 2008-04-14 . 330F30CB175655313A93AF27C7366550 . 643072 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2008-04-14 . 330F30CB175655313A93AF27C7366550 . 643072 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2008-04-14 . 330F30CB175655313A93AF27C7366550 . 643072 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[7] 2008-04-14 . D7B7AE36A2EBA312AC4B53862019B3F5 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-03-29 . E26B26189B786E6B092F002041D5A1E2 . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2006-08-25 . 6CB1BAC5FA7E692B63C3D5AAA348E76A . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
[7] 2001-10-25 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
.
[7] 2010-05-04 . A85A3A10CA88BD7861D1859183559ED5 . 3603456 . . [7.00.6000.21264] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\mshtml.dll
[7] 2010-05-04 . A85A3A10CA88BD7861D1859183559ED5 . 3603456 . . [7.00.6000.21264] . . c:\windows\ERDNT\cache\mshtml.dll
[7] 2010-05-04 . A85A3A10CA88BD7861D1859183559ED5 . 3603456 . . [7.00.6000.21264] . . c:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
[-] 2010-05-04 . 9CE04362C2CAC43BD00423381DCCD0AB . 3763712 . . [7.00.6000.21264] . . c:\windows\ServicePackFiles\i386\mshtml.dll
[-] 2010-05-04 . 9CE04362C2CAC43BD00423381DCCD0AB . 3763712 . . [7.00.6000.21264] . . c:\windows\system32\mshtml.dll
[-] 2010-05-04 . 9CE04362C2CAC43BD00423381DCCD0AB . 3763712 . . [7.00.6000.21264] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2009-10-29 . EC37726162FF477D0E38111CD11C3000 . 3598336 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3gdr\mshtml.dll
[-] 2009-10-29 . C4C38495BA7AFC2C1752501A6875B323 . 3602432 . . [7.00.6000.21148] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3qfe\mshtml.dll
[-] 2008-03-29 . DBDDA1D78F879B4562DF99805490FC97 . 3593216 . . [7.00.6000.20733] . . c:\windows\ie7updates\KB982381-IE7\mshtml.dll
.
[7] 2008-04-14 . E16E0990967374E76F3E40CACAFD3D53 . 578560 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\user32.dll
[7] 2008-04-14 . E16E0990967374E76F3E40CACAFD3D53 . 578560 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\user32.dll
[-] 2008-04-14 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2008-04-14 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll
[-] 2008-03-29 . 5393076FDCD6DAEB82814688DDE3E9A2 . 578048 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
.
[7] 2010-05-04 . 3D4713D326A245AAE068E7148C08AA77 . 841216 . . [7.00.6000.21256] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\wininet.dll
[7] 2010-05-04 . 3D4713D326A245AAE068E7148C08AA77 . 841216 . . [7.00.6000.21256] . . c:\windows\ERDNT\cache\wininet.dll
[7] 2010-05-04 . 3D4713D326A245AAE068E7148C08AA77 . 841216 . . [7.00.6000.21256] . . c:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
[-] 2010-05-04 . E1F28C81C1C554E48768B5C5808CD625 . 907776 . . [7.00.6000.21256] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2010-05-04 . E1F28C81C1C554E48768B5C5808CD625 . 907776 . . [7.00.6000.21256] . . c:\windows\system32\wininet.dll
[-] 2010-05-04 . E1F28C81C1C554E48768B5C5808CD625 . 907776 . . [7.00.6000.21256] . . c:\windows\system32\dllcache\wininet.dll
[-] 2009-10-29 . 33D6B94981C3FB88F27CFBBE72B59122 . 832512 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3gdr\wininet.dll
[-] 2009-10-29 . 7CD98B487F578D12281B163E2FEF7487 . 841216 . . [7.00.6000.21148] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3qfe\wininet.dll
[-] 2008-03-29 . 32CC73F851F377B035A5B8216CAC63CE . 825344 . . [7.00.6000.20733] . . c:\windows\ie7updates\KB982381-IE7\wininet.dll
.
[-] 2008-04-14 . D63C59BB0CA2F83B62D003FD52863090 . 1541120 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[7] 2008-04-14 . 27AFD587C462E280EE046B8CCA3C2CD1 . 1034240 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\explorer.exe
[7] 2008-04-14 . 27AFD587C462E280EE046B8CCA3C2CD1 . 1034240 . . [6.00.2900.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
[-] 2008-04-14 . D63C59BB0CA2F83B62D003FD52863090 . 1541120 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2008-04-14 . D63C59BB0CA2F83B62D003FD52863090 . 1541120 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
[7] 2004-08-17 . 53114D57AB73A406AC7F602227781A99 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
[-] 2008-04-14 . 6915639F41228891A883B2DA59AA7429 . 277504 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[7] 2008-04-14 . FDEB1D02CAE38665CBF114F44E6B997E . 147968 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\regedit.exe
[-] 2008-04-14 . 6915639F41228891A883B2DA59AA7429 . 277504 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[-] 2008-04-14 . 6915639F41228891A883B2DA59AA7429 . 277504 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
[7] 2004-08-17 . CB5A91928D94224E7E30EE277B45E8A3 . 147968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
[7] 2008-04-14 . 21F836AAB269FF644E0E708B794B0DF7 . 1287168 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ole32.dll
[7] 2008-04-14 . 21F836AAB269FF644E0E708B794B0DF7 . 1287168 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\ole32.dll
[-] 2008-04-14 . 79E4E0BCF353CA222DCCA7DD396F15A9 . 1312256 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2008-04-14 . 79E4E0BCF353CA222DCCA7DD396F15A9 . 1312256 . . [5.1.2600.5512] . . c:\windows\system32\ole32.dll
[-] 2008-04-14 . 79E4E0BCF353CA222DCCA7DD396F15A9 . 1312256 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ole32.dll
[-] 2008-03-29 . 93AC0C1189CB7C34910CD00748A23E3A . 1285632 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\ole32.dll
.
[7] 2008-04-14 . A756B8F0F7BAFBA6DFE39F7D169F2519 . 15360 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ctfmon.exe
[7] 2008-04-14 . A756B8F0F7BAFBA6DFE39F7D169F2519 . 15360 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe
[-] 2008-04-14 . 0415E09C0BCCBF8B5CD5A05889EFB962 . 40448 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 . 0415E09C0BCCBF8B5CD5A05889EFB962 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-04-14 . 0415E09C0BCCBF8B5CD5A05889EFB962 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe
[7] 2004-08-17 . A5BAA91475167161DEA02BA3C4CA4F59 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
.
[7] 2008-04-14 . ED18ADEE4AA21EB26977260152D7241A . 345088 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\hnetcfg.dll
[7] 2008-04-14 . ED18ADEE4AA21EB26977260152D7241A . 345088 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\hnetcfg.dll
[-] 2008-04-14 . FDE84E2C6D0E1F75D61D7CC111A1DA5A . 369152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll
[-] 2008-04-14 . FDE84E2C6D0E1F75D61D7CC111A1DA5A . 369152 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[-] 2008-04-14 . FDE84E2C6D0E1F75D61D7CC111A1DA5A . 369152 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll
[7] 2004-08-17 . FAABA83BE47C5B15F620FAA53267A9B8 . 345088 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll
.
[7] 2010-02-16 . 6C31566C176BC28C7D73BC6332642A58 . 2068992 . . [5.1.2600.5938] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2010-02-16 . 6C31566C176BC28C7D73BC6332642A58 . 2068992 . . [5.1.2600.5938] . . c:\windows\ERDNT\cache\ntkrnlpa.exe
[7] 2010-02-16 . 6C31566C176BC28C7D73BC6332642A58 . 2068992 . . [5.1.2600.5938] . . c:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
[-] 2010-02-16 . B48BBDD536DC063C06981048C9157674 . 2230144 . . [5.1.2600.5938] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2010-02-16 . B48BBDD536DC063C06981048C9157674 . 2230144 . . [5.1.2600.5938] . . c:\windows\system32\ntkrnlpa.exe
[-] 2010-02-16 . B48BBDD536DC063C06981048C9157674 . 2230144 . . [5.1.2600.5938] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2010-02-16 . DCC3D91A3DEDBBA9ECFFA6028D872CF5 . 2069120 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[-] 2009-08-04 . 97815C93200676C727CE951AE5C78137 . 2068352 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP3QFE\ntkrnlpa.exe
[-] 2009-08-04 . 182A95C233C9C254FEE7F047E6CA73D1 . 2068224 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP3GDR\ntkrnlpa.exe
[-] 2009-08-04 . 90E58FFA70A7951899BBF5551A9D246A . 2065152 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP2QFE\ntkrnlpa.exe
[-] 2009-08-04 . 809D2CA366FBA705B143D1EA84A3BC1A . 2059904 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP2GDR\ntkrnlpa.exe
[7] 2009-02-09 . FF8A3F180A224AA27EBAB937CA027F4D . 2068352 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-03-29 . A873FF1754E2A81CB1A34588CAB363D6 . 2061568 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
.
[7] 2010-04-16 . B24A4E23A2FEDB6976EB04D334AD82B2 . 634648 . . [7.00.6000.21256] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[7] 2010-04-16 . B24A4E23A2FEDB6976EB04D334AD82B2 . 634648 . . [7.00.6000.21256] . . c:\windows\ERDNT\cache\iexplore.exe
[7] 2010-04-16 . B24A4E23A2FEDB6976EB04D334AD82B2 . 634648 . . [7.00.6000.21256] . . c:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe
[-] 2010-04-16 . D12CF430E3F01EE1E873AE1E7702C9D3 . 507160 . . [7.00.6000.21256] . . c:\windows\ServicePackFiles\i386\iexplore.exe
[-] 2010-04-16 . D12CF430E3F01EE1E873AE1E7702C9D3 . 507160 . . [7.00.6000.21256] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2009-10-28 . 80675329E0FD54F016C4F8A83C616349 . 634632 . . [7.00.6000.21148] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3qfe\iexplore.exe
[7] 2009-10-28 . 4F9B04D546C23A295F3F0AE015BE51DB . 634632 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\2d21da1b434f63ab8c96a1d526689a8b\sp3gdr\iexplore.exe
[-] 2008-03-29 . 809D17D8FA0FDAEE07778CD821CAFFDE . 625664 . . [7.00.6000.20733] . . c:\windows\ie7updates\KB982381-IE7\iexplore.exe
.
[7] 2010-02-17 . 4E8268B816B2D27E711A688D6FD0E319 . 2192128 . . [5.1.2600.5938] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-02-17 . 4E8268B816B2D27E711A688D6FD0E319 . 2192128 . . [5.1.2600.5938] . . c:\windows\ERDNT\cache\ntoskrnl.exe
[7] 2010-02-17 . 4E8268B816B2D27E711A688D6FD0E319 . 2192128 . . [5.1.2600.5938] . . c:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
[-] 2010-02-17 . 0E24CEAE7F1E5E354A037987ED5AF01F . 2353280 . . [5.1.2600.5938] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2010-02-17 . 0E24CEAE7F1E5E354A037987ED5AF01F . 2353280 . . [5.1.2600.5938] . . c:\windows\system32\ntoskrnl.exe
[-] 2010-02-17 . 0E24CEAE7F1E5E354A037987ED5AF01F . 2353280 . . [5.1.2600.5938] . . c:\windows\system32\dllcache\ntoskrnl.exe
[7] 2010-02-16 . 6B2312D847BA95F4E858CB4C3B5F51E1 . 2192256 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[-] 2009-08-04 . F61EB18DA0AA630E2F8A944ED6BD3BF9 . 2191360 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP3GDR\ntoskrnl.exe
[-] 2009-08-04 . 3502DBBC657001D7A2A2768BD7DE1483 . 2191488 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP3QFE\ntoskrnl.exe
[-] 2009-08-04 . 90DFE2B714EDEF95891C979720E23B4F . 2188160 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP2QFE\ntoskrnl.exe
[-] 2009-08-04 . F46E90D50BA9D114D606C19D81ADB761 . 2182528 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\fd1bc4b90d8186dfe936ba7e1aed3d74\SP2GDR\ntoskrnl.exe
[7] 2009-02-10 . 97480EBFE1D4B547657BAD75AAAB1325 . 2191360 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2008-03-29 . D40B4F66D877802EC5E655B91B5490FA . 2184320 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Speedfan"="c:\program files\SpeedFan" [X]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"EPSON Stylus C48 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE" [2005-05-17 99840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"nwiz"="nwiz.exe" [2004-10-29 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Reloader"="c:\windows\NiwradSoft Shell Pack\Tools\Reloader.exe" [2010-07-04 325046]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-05-04 124928]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
2004-02-13 13:05 57344 ----a-w- c:\program files\Lexmark 2200 Series\lxbvbmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NiwradSoft Welcome]
2010-07-04 04:14 243442 ----a-w- c:\windows\NiwradSoft Shell Pack\Tools\NS Welcome.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"d:\\FM2011\\fm.exe"=
"d:\\skype\\Phone\\Skype.exe"=
"d:\\Casino\\ParadiseCasino\\casino.exe"=
"d:\\ICQ7.5\\ICQ.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [25.7.2010 17:11 691696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [19.7.2010 11:01 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [19.7.2010 11:01 8320]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
IE: E&xportovat do aplikace Microsoft Excel
IE: E&xportovat do aplikace Microsoft Office Excel
IE: WikiKomentáře Google...
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - d:\icq7.5\ICQ.exe
FF - ProfilePath - c:\documents and settings\Marek\Data aplikací\Mozilla\Firefox\Profiles\spoohsnp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
FF - prefs.js: network.proxy.gopher -
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-23 15:33
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="4C622626F1F2B19B72D1D5488CE922D303E86B6F02DF722D8AD93F425278CD545E8F5472AFD144E6D405C87A3B4A73DA877648B2551153B62BDC1CABFB127E1DFAB545E338A11C2127A8A4481E064EF062EA36FD594F36CEF101DD0DCF728757DB4ABEC748C5299C955C2910B242680E50B00EE8EE983A30CB2195512E969223BE322CFAE259BE7F4E34B8C7BCD25F7D11AA4D1AB821E66A278AF8F5BD2F2DF4E4CA9DF1CDA8934303385DF6444433DCE62C14501FD02462FA01E18DE6A0CB969460C3B314B6C3B56A65C13992D34920997F28DB50C2BF4FBD384EBFD782C32497B8F6DA83384FF7C02AB6BF39F3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA6A0AC4980AC79338EDD5E5BE2F6E6677F61ADB35D744F15E5615D3931FAC8C0367E368DC37E2E62966E263EE53DB2008CCEABC07855BE8B26C605CFD405332F2367FB1C4D37AFD83FE438C5326776257FA4AA296E515B0E9813FC7B34F0BB77DE47A136B35297FA4A046258E736A512857788E9EE7B0809175D17E3F7E50B430CDE0B513AAC6D4FC14DB8558359474C32302EF1CC79721EDB1529246A218A72AEBF1F56C4B67E12131BD4152118A98C7C8B04A27E8806A3867B8ECD7C72EA962E50C9A15C76D9B31097D3E1844DDC3E3C1976D49DF675219AA6A5E341BD1E7657CBF905AD8454566CC3547711E5B582B23E7952EBA8B7D6FE0050DEF1FC5C0C5AC1A445898E05D1C3F1FB0A53E550AE0035815BCA1487347FC4F7AA69BA21874C14C01BE4D6C9B291C9743E786286C92C090822C0C5E05F4B078427A718A9C9A479C9B3D8B041B7B8C869AF5185FA11A09A8B4D795B0832F5AD6528D0497BEAC07D3FB0220751D3FDBC0B6BD38E92F52CA08C78C48982B9F6718D752C965B33607E2526A1D69FAF894C8FF21BCEF59B02A19133131719B8A9E0F34CA6DC56A3292F839E5C319A26EAEB2E3DE4AD145A37FAA47F7C5FDB234E5C92DB4F8A3AEDA1956594FA3B71C6926924B213249BBF465ED154BBD01CA3869B6749DB259BF6B60EDA7BCBAD1855D563B2B3AA41838C8ECEAC1E316F70165BA6772BA1C4D05B3A46F638BDD647496ECE1D91D5278434D1A7C8BADDD3320EB65CC68D9D96F4695EC152A16797FB4EF8722C91620C1C603693C07DE927004F69ECE1F0EFD966223ED688077F65F3C3F7EAADEDC23A09ECC693B3AD9EA8BB55A5E0D6C9DC62CA3DD3AFB7296549B4BDCFA7F1D48D9054E9717DC106ECAD0C4C048F377FCA9906A600CC853B19DF8782CB6C4D68FA00C41C88F91035E69B5A16FEA71BEDC67BC67908FE97E7BDDCF58D965098BE6A10E77D440449DEC16ED548F62B9D668118F88A146E9BCB1F82D290C24130615CDA8EB8BBEE"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\SETUPAPI.dll
.
- - - - - - - > 'explorer.exe'(3696)
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\netshell.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\MSVCP71.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\SpeedFan\speedfan.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-05-23 15:40:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-05-23 13:39
ComboFix2.txt 2011-05-16 20:19
.
Před spuštěním: Volných bajtů: 11 572 006 912
Po spuštění: Volných bajtů: 11 551 969 280
.
- - End Of File - - E54BD7ADFA94CF37114BB509517D16B5


Diky za odpoved

CF smazal několik infikovaných polžek. Zbytek logu vypadá čistý.

Rudy píše:CF smazal několik infikovaných polžek. Zbytek logu vypadá čistý.

Nakažená kopie c:\windows\system32\midimap.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\midimap.dll

A tohle je v poradku? jde o to ze mi to vyjede pri kazdem spusteni combofixu

Je to informace CF, že nahradil soubor, který byl podle něj infikován. Jelikož to určuje podle kontrolního součto, nemusí to vždy být pravda. Pro jistotu zkontrolujte soubor :\windows\system32\midimap.dll online na www.virustotal.com .