VIRY.CZ

Dobrý den,mám na PC hlášku Virus Angela.C právě smazal soubor hal.dll s tvého windowsu.Pokud vypneš svůj comp tak už nikdy nepujde spustit xD xD komentaře k viru napis na www.EK-VIRUS.ic.cz.Prosím pomozte co s tím,ale jsem úplný laik na PC,takže co jsem si četla už k tomu viru na těchto stránkách mi nic neříká co mám s tím dělat.Děkuji předem Vilkuska

zdravim

Stahni OTListIt2, http://oldtimer.geekstogo.com/OTL.exe , na plochu

- spust
- file scans zmen z 30 days na 7 day
- oznac "Scan All Users
- oznac Purity i Loop
- klik na "Run Scan"
- otevrou se dva logy, jejich obsahy mi zkopiruj sem.

uvidime ci nekeca
stiahni na plochu Download

spust do okna vloz zeleny text a klik look,co da vloz sem,,

help mam stejný problém a potřebuju pomoct nevim co mam dělat.jel sem podle tvího návodu a co jako pak sem to zavřel a nevimco,to okno nejde zavřít help help je mi teprve 13.let -help.kýbl

zdravim
Na druhy raz,,treba stale otvorit novu temu,,a tam napisat svoj problem,ale co uz stebou,,
treba sa ukludnit a precitaj este raz co som napisal a krok za krokom sprav,,logy vloz sem,

OTL logfile created on: 11.11.2009 23:51:07 - Run 1
OTL by OldTimer - Version 3.1.5.0 Folder = C:\Documents and Settings\CML\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

1,25 Gb Total Physical Memory | 0,76 Gb Available Physical Memory | 60,59% Memory free
2,98 Gb Paging File | 2,33 Gb Available in Paging File | 78,07% Paging File free
Paging file location(s): C:\pagefile.sys 1920 3840 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111,78 Gb Total Space | 73,67 Gb Free Space | 65,91% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: C
Current User Name: CML
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.11.11 23:47:21 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CML\Plocha\OTL.exe
PRC - [2009.11.07 11:42:56 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.11.03 06:40:28 | 00,921,072 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2009.10.29 22:23:08 | 00,289,072 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\CML\Plocha\utorrent.exe
PRC - [2009.10.09 13:11:12 | 25,623,336 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe
PRC - [2009.10.09 13:11:12 | 00,078,008 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe
PRC - [2009.09.29 13:03:46 | 00,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009.09.29 13:02:52 | 02,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009.07.27 03:37:50 | 00,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2009.07.21 16:42:04 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2009.07.21 16:42:04 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2009.03.01 11:59:42 | 00,172,792 | ---- | M] (ICQ, LLC.) -- C:\Program Files\ICQ6.5\ICQ.exe
PRC - [2008.12.18 14:32:52 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2008.12.18 13:19:44 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
PRC - [2008.11.12 16:10:46 | 00,846,336 | ---- | M] () -- C:\Documents and Settings\CML\Dokumenty\ICQ\471815429\ReceivedFiles\114016046 egon\pbsetup.exe
PRC - [2008.04.14 13:00:00 | 01,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.05.15 15:55:46 | 01,628,208 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
PRC - [2007.05.15 15:55:46 | 01,550,896 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2007.05.15 15:55:26 | 01,057,328 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCD.exe
PRC - [2007.05.14 09:38:34 | 37,385,776 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Core\nero.exe
PRC - [2007.05.14 09:38:34 | 37,385,776 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Core\nero.exe
PRC - [2007.05.14 09:38:34 | 37,385,776 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Core\nero.exe
PRC - [2007.05.08 19:47:22 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
PRC - [2007.03.20 21:13:36 | 07,116,336 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe
PRC - [2004.08.11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe
PRC - [2002.10.23 10:15:08 | 00,086,016 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
PRC - [2002.07.15 16:36:54 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2002.07.02 17:56:00 | 00,024,576 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTHELPER.EXE
PRC - [2002.06.26 17:36:58 | 00,090,112 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMTray.exe


========== Modules (SafeList) ==========

MOD - [2009.11.11 23:47:21 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CML\Plocha\OTL.exe
MOD - [2008.04.14 13:00:00 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008.04.14 13:00:00 | 00,367,616 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dsound.dll
MOD - [2008.04.14 13:00:00 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2002.11.05 11:05:30 | 00,061,440 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTAGENT.DLL
MOD - [2001.10.04 16:50:08 | 00,040,820 | ---- | M] (SoundMAX) -- C:\WINDOWS\system32\Syncor11.dll


========== Win32 Services (SafeList) ==========

SRV - [2009.11.07 11:42:56 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2009.11.07 11:07:34 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1ca5f92261067d6)
SRV - [2009.09.29 13:11:10 | 00,020,680 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009.09.29 13:03:46 | 00,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2009.07.21 16:42:04 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2009.07.21 10:40:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)
SRV - [2008.07.29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008.07.29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008.07.29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.07.25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.07.25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008.04.14 13:00:00 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007.05.15 15:55:46 | 01,550,896 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2007.05.08 19:47:22 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.04.13 21:09:56 | 00,792,112 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2004.08.11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf)
SRV - [2002.09.27 11:56:20 | 00,139,264 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)
SRV - [2002.07.15 16:36:54 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)


========== Driver Services (SafeList) ==========

DRV - [2009.09.29 13:05:54 | 00,096,408 | ---- | M] (ESET) -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2009.09.29 13:02:58 | 00,108,792 | ---- | M] (ESET) -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009.09.29 12:56:32 | 00,116,008 | ---- | M] (ESET) -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2009.07.27 03:43:18 | 00,058,908 | ---- | M] (PowerISO Computing, Inc.) -- C:\WINDOWS\system32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2009.07.21 17:30:48 | 03,565,056 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009.04.28 21:20:06 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2008.04.14 13:00:00 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008.04.14 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2008.04.14 00:15:30 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.05.15 15:55:36 | 00,118,576 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2007.05.15 15:55:36 | 00,038,576 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007.05.15 15:55:36 | 00,037,040 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2002.10.16 00:11:22 | 00,019,968 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)
DRV - [2002.09.25 06:09:12 | 00,140,800 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B)
DRV - [2002.08.23 14:46:22 | 00,549,672 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm)
DRV - [2002.08.22 17:57:02 | 00,098,752 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio)
DRV - [2002.07.24 13:52:26 | 00,998,004 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)
DRV - [2002.07.19 10:48:32 | 00,156,604 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)
DRV - [2002.07.19 10:48:22 | 00,213,860 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2002.07.19 10:48:08 | 00,011,068 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV - [2002.07.19 10:48:04 | 00,195,432 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2002.07.19 10:47:52 | 00,837,548 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k)
DRV - [2002.07.19 10:46:28 | 00,127,948 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)
DRV - [2001.08.17 21:19:34 | 00,036,480 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman)
DRV - [2001.08.17 21:19:28 | 00,006,912 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1)
DRV - [2001.08.17 21:19:26 | 00,283,904 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k)
DRV - [2001.08.17 21:19:20 | 00,003,712 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/ ... chcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1645522239-616249376-842925246-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1645522239-616249376-842925246-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKU\S-1-5-21-1645522239-616249376-842925246-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-1645522239-616249376-842925246-1003\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1645522239-616249376-842925246-1003\S-1-5-21-1645522239-616249376-842925246-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "BS Player Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.as ... earchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz/"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_result ... id=afex&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009.11.01 03:00:37 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.10.29 20:58:07 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.11.07 11:07:50 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009.10.29 21:36:20 | 00,000,000 | ---D | M]

[2009.11.09 11:21:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\Mozilla\Firefox\Profiles\3n4irgeb.default\extensions
[2009.11.01 15:08:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\Mozilla\Firefox\Profiles\3n4irgeb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.10.29 21:40:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\Mozilla\Firefox\Profiles\3n4irgeb.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
[2009.07.01 13:22:12 | 00,000,880 | ---- | M] () -- C:\Documents and Settings\CML\Data aplikací\Mozilla\Firefox\Profiles\3n4irgeb.default\searchplugins\conduit.xml
[2009.11.05 22:14:13 | 00,000,944 | ---- | M] () -- C:\Documents and Settings\CML\Data aplikací\Mozilla\Firefox\Profiles\3n4irgeb.default\searchplugins\icqplugin.xml
[2009.11.09 02:17:37 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.10.29 21:59:28 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.10.29 20:58:02 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009.10.29 22:18:23 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009.10.29 20:58:04 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org
[2008.12.17 23:25:55 | 00,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll
[2008.12.17 23:25:55 | 00,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2008.12.17 23:25:55 | 00,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll
[2008.12.17 23:25:55 | 00,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2008.12.17 23:25:55 | 00,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2009.05.01 22:02:48 | 01,044,480 | ---- | M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\Mozilla Firefox\plugins\libdivx.dll
[2009.05.12 19:46:20 | 01,650,992 | ---- | M] (DivX,Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
[2008.12.17 23:25:55 | 00,022,656 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2009.07.17 20:21:00 | 03,883,424 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
[2009.05.01 22:02:48 | 00,200,704 | ---- | M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\Mozilla Firefox\plugins\ssldivx.dll
[2006.06.04 21:11:07 | 00,001,118 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\centrum-cz.xml
[2007.01.17 23:05:32 | 00,002,368 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2006.06.04 21:11:07 | 00,000,661 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2006.06.04 21:11:07 | 00,001,674 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2006.08.25 16:16:33 | 00,001,302 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2006.06.04 21:11:07 | 00,000,765 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml

O1 HOSTS File: (737 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WINDVDPatch] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKU\S-1-5-21-1645522239-616249376-842925246-1003..\Run: [ICQ] C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1645522239-616249376-842925246-1003..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKU\S-1-5-21-1645522239-616249376-842925246-1003..\Run: [uTorrent] C:\Documents and Settings\CML\Plocha\utorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1645522239-616249376-842925246-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.10.29 11:45:30 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 7 Days ==========

[2009.11.11 23:47:06 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\CML\Plocha\OTL.exe
[2009.11.10 23:40:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CML\Plocha\2012 Doomsday[2009]DvDrip-LW
[2009.11.07 16:17:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CML\Data aplikací\Ahead
[2009.11.07 11:42:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2009.11.07 11:42:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CML\Local Settings\Data aplikací\PunkBuster
[2009.11.07 11:07:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CML\Local Settings\Data aplikací\Google
[2009.11.07 11:07:32 | 00,000,000 | ---D | C] -- C:\Program Files\Google
[2009.11.07 11:07:32 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared
[2009.11.07 11:07:31 | 00,000,000 | R--D | C] -- C:\Documents and Settings\CML\Dokumenty\Filmy
[2009.11.07 11:07:31 | 00,000,000 | ---D | C] -- C:\Program Files\DivX
[2009.11.01 15:18:52 | 00,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2009.11.11 23:47:21 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CML\Plocha\OTL.exe
[2009.11.11 23:30:00 | 00,000,940 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009.11.11 14:04:17 | 01,572,864 | -H-- | M] () -- C:\Documents and Settings\CML\NTUSER.DAT
[2009.11.11 14:00:07 | 00,000,310 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2009.11.11 14:00:07 | 00,000,302 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2009.11.11 14:00:06 | 00,000,302 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2009.11.11 01:37:49 | 00,018,182 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\2012+doomsday(0000098760).zip
[2009.11.11 01:37:49 | 00,018,182 | ---- | M] () -- C:\2012+doomsday(0000098760).zip
[2009.11.11 01:28:15 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.11.11 01:28:14 | 00,006,144 | ---- | M] () -- C:\Documents and Settings\CML\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.10 23:45:54 | 99,662,0288 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\2Bobule.avi
[2009.11.10 23:42:10 | 00,046,575 | ---- | M] () -- C:\Nostradamus%40+2012(0000138787).zip
[2009.11.10 23:42:10 | 00,046,575 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\Nostradamus%40+2012(0000138787).zip
[2009.11.10 21:36:30 | 73,074,0736 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\Vy Nam Taky Sefe (2008)-Komedie CZdub CZdab CZ.avi
[2009.11.10 20:28:35 | 00,139,904 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.11.10 20:28:18 | 00,189,744 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2009.11.10 20:28:17 | 00,189,744 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2009.11.10 11:30:00 | 00,000,936 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009.11.07 13:44:18 | 39,367,442 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\J.A.R. - Frtka (1992) MP3.rar
[2009.11.07 11:42:56 | 00,075,064 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2009.11.07 11:07:31 | 00,001,430 | ---- | M] () -- C:\Documents and Settings\CML\Plocha\DivX Movies.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009.11.11 14:00:07 | 00,000,310 | ---- | C] () -- C:\WINDOWS\tasks\At11.job
[2009.11.11 14:00:06 | 00,000,302 | ---- | C] () -- C:\WINDOWS\tasks\At2.job
[2009.11.11 14:00:05 | 00,000,302 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2009.11.11 01:38:00 | 00,018,182 | ---- | C] () -- C:\2012+doomsday(0000098760).zip
[2009.11.11 01:37:53 | 00,018,182 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\2012+doomsday(0000098760).zip
[2009.11.11 01:34:36 | 00,046,575 | ---- | C] () -- C:\Nostradamus%40+2012(0000138787).zip
[2009.11.10 23:42:12 | 00,046,575 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\Nostradamus%40+2012(0000138787).zip
[2009.11.10 22:35:59 | 99,662,0288 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\2Bobule.avi
[2009.11.10 19:49:50 | 73,074,0736 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\Vy Nam Taky Sefe (2008)-Komedie CZdub CZdab CZ.avi
[2009.11.07 13:36:08 | 39,367,442 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\J.A.R. - Frtka (1992) MP3.rar
[2009.11.07 11:43:25 | 00,139,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.11.07 11:43:03 | 00,189,744 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2009.11.07 11:43:01 | 00,189,744 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2009.11.07 11:42:56 | 00,075,064 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2009.11.07 11:25:20 | 00,000,940 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009.11.07 11:25:20 | 00,000,936 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009.11.07 11:07:31 | 00,001,430 | ---- | C] () -- C:\Documents and Settings\CML\Plocha\DivX Movies.lnk
[2009.11.01 15:39:53 | 00,000,128 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2009.11.01 15:39:51 | 00,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
[2009.11.01 15:38:37 | 00,037,727 | ---- | C] () -- C:\WINDOWS\System32\Emu10kx.ini
[2009.11.01 15:38:37 | 00,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2009.11.01 15:38:32 | 00,000,180 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI
[2009.11.01 15:20:07 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009.11.01 15:18:50 | 00,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2009.10.30 00:49:50 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.10.29 21:47:04 | 00,006,144 | ---- | C] () -- C:\Documents and Settings\CML\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.29 21:36:46 | 00,012,328 | ---- | C] () -- C:\Documents and Settings\CML\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2009.10.29 21:11:52 | 00,000,000 | -H-- | C] () -- C:\Documents and Settings\CML\Local Settings\Data aplikací\IconCache.db
[2009.10.29 12:19:26 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Data aplikací\desktop.ini
[2009.10.29 11:51:56 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\CML\Data aplikací\desktop.ini
[2009.06.19 20:06:22 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008.04.14 13:00:00 | 00,000,477 | ---- | C] () -- C:\WINDOWS\win.ini
[2008.04.14 13:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2006.06.29 14:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006.06.29 14:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006.04.18 15:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006.04.18 15:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2002.10.07 18:15:36 | 00,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2009.11.01 16:34:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ATI
[2009.10.29 21:36:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2009.10.29 21:59:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ICQ
[2009.10.29 21:36:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\ATI
[2009.10.29 21:47:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\BSplayer
[2009.10.29 21:40:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\BSplayer Pro
[2009.10.29 22:14:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\GHISLER
[2009.10.29 22:01:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\ICQ
[2009.11.11 23:53:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CML\Data aplikací\uTorrent
[2009.11.11 14:00:06 | 00,000,302 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2009.11.11 14:00:07 | 00,000,310 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2009.11.11 14:00:07 | 00,000,302 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2008.04.14 13:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009.11.04 03:07:15 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========


< End of report >

OTL Extras logfile created on: 11.11.2009 23:51:07 - Run 1
OTL by OldTimer - Version 3.1.5.0 Folder = C:\Documents and Settings\CML\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

1,25 Gb Total Physical Memory | 0,76 Gb Available Physical Memory | 60,59% Memory free
2,98 Gb Paging File | 2,33 Gb Available in Paging File | 78,07% Paging File free
Paging file location(s): C:\pagefile.sys 1920 3840 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111,78 Gb Total Space | 73,67 Gb Free Space | 65,91% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: C
Current User Name: CML
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\PROGRA~1\MOZILL~1\FIREFOX.EXE File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] -- C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1" File not found
https [open] -- C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1" File not found
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Documents and Settings\CML\Plocha\utorrent.exe" = C:\Documents and Settings\CML\Plocha\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Wolfenstein - Enemy Territory\ET.exe" = C:\Program Files\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET -- ()
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French
"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard
"{129DDEC1-A6A3-3D60-AABE-76E6E5334922}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - CSY
"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish
"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian
"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing
"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German
"{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}" = Sound Blaster Live! Web 2K/XP
"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese
"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full
"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai
"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese
"{6FE8B722-4D7E-3CD7-BB3A-3AD1684B1295}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - CSY
"{74DCC43B-33C9-3389-BD0D-33EB37973657}" = Microsoft .NET Framework 3.5 Language Pack - csy
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech
"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian
"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish
"{9B4E6CB9-E54D-47F7-A414-E2D5740E1029}" = Nero 7 Essentials
"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation
"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean
"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek
"{AB47445C-8CA6-4A84-8A1B-42361B78BA4D}" = ESET NOD32 Antivirus
"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility
"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish
"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All
"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins
"{EF4EF65F-4D62-44D7-82C9-1AECCBA74C50}" = Intel(R) PROSet
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static
"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common
"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = Softarová utilita ATI - Odinstalovat
"ATI Display Driver" = ATI Display Driver
"BSPlayerf" = BS.Player FREE
"Electronic Arts Game Updater" = Electronic Arts Game Updater
"Google Chrome" = Google Chrome
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Microsoft .NET Framework 3.5 Language Pack - csy" = Microsoft .NET Framework 3.5 Language Pack - CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (2.0.0.20)" = Mozilla Firefox (2.0.0.20)
"Need For Speed - Porsche Unleashed" = Need For Speed - Porsche Unleashed
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PowerISO" = PowerISO
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"Puzzle Veselé motory_is1" = Puzzle Veselé motory 1.5
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"Victor Chandler" = Victor Chandler
"Winamp" = Winamp
"Windows Lemmings" = Lemmings for Windows 95
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1.11.2009 11:17:54 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace et.exe, verze 0.0.0.0, chybující modul atioglxx.dll,
verze 6.14.10.8544, adresa chyby 0x0051aaae.

Error - 1.11.2009 11:59:47 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace shift.exe, verze 1.0.0.0, chybující modul shift.exe,
verze 1.0.0.0, adresa chyby 0x009837f5.

Error - 1.11.2009 12:00:36 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace shift.exe, verze 1.0.0.0, chybující modul shift.exe,
verze 1.0.0.0, adresa chyby 0x00432056.

Error - 1.11.2009 12:07:04 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace shift.exe, verze 1.0.0.0, chybující modul shift.exe,
verze 1.0.0.0, adresa chyby 0x00432056.

Error - 1.11.2009 12:27:11 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace shift.exe, verze 1.0.0.0, chybující modul shift.exe,
verze 1.0.0.0, adresa chyby 0x00432056.

Error - 1.11.2009 12:34:00 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace porsche.exe, verze 0.0.0.0, chybující modul gimme.dll,
verze 0.0.0.0, adresa chyby 0x001055e0.

Error - 1.11.2009 12:36:32 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace porsche.exe, verze 0.0.0.0, chybující modul gimme.dll,
verze 0.0.0.0, adresa chyby 0x001055e0.

Error - 1.11.2009 12:37:21 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace porsche.exe, verze 0.0.0.0, chybující modul gimme.dll,
verze 0.0.0.0, adresa chyby 0x001055e0.

Error - 1.11.2009 16:55:04 | Computer Name = C | Source = Application Error | ID = 1000
Description = Chybující aplikace porsche.icd, verze 0.0.0.0, chybující modul porsche.icd,
verze 0.0.0.0, adresa chyby 0x001a2acb.

Error - 7.11.2009 11:29:33 | Computer Name = C | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace nero.exe, verze 7.9.6.0, zablokovaný modul hungapp,
verze 0.0.0.0, adresa bloku 0x00000000.

[ System Events ]
Error - 1.11.2009 9:56:16 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 10:25:18 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 10:41:43 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 10:52:43 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 11:16:24 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 11:34:52 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 1.11.2009 12:04:51 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 2.11.2009 4:02:08 | Computer Name = C | Source = incdrm | ID = 262151
Description =

Error - 2.11.2009 8:43:06 | Computer Name = C | Source = Dhcp | ID = 1002
Description = Zapůjčení adresy IP 10.0.0.2 pro síťovou kartu s adresou 0007E9ABB231
byla serverem DHCP 10.0.0.138 odmítnuta. (Server DHCP odeslal zprávu DHCPNACK).

Error - 2.11.2009 8:43:26 | Computer Name = C | Source = incdrm | ID = 262151
Description =


< End of report >

A co stím mám dělat ted poradte mi někdo prosiiiiiiim

Holmiss
prosim otvor si vlastnu novu temu,,a napis ze aky problem mas s pc,,
dakujem,

Já jsem ten virus také chytil. Ale nevím jeslti to bylo typu C. Mám win. 7.
Po restartu počítače sem chtěl odstranit ten virus keygen a ono mi to napsalo tabulku že tento soubo vymazal důležité součásti windousu, tak jsem dal obnova systému o tři dny naspátek... Pomohlo to? Dá se zjistit jestli mi tam něco chybí?

Odstranění viru angela je jednoduché. Virus si při spustění vytvoří dva scripty z názvem (msg box) a

(open disk) stačí ručně dohledat a smazat. Ve správci ůloh jsou spuštěny dva exe soubory z názvem

wscript.exe stačí zadat ukončit spuštění, a jeden soubor z názvem keygen nebo autor EK exe taktéž

vypnout a vše smazat a resetovat. taktéž odkazuje na stránky www.EK-VIRUS.blog.cz nelezte tam

jsou tam jen keci jak je ten vir ůžasnej a blog je též zavirován scriptem. Virus angela je primityvní

a že prý má ovládnout všechny pc tak to se dost divím autorovy blogu páni trochu domýšlivé!!!

zase malí děcko dostalo hračku ach jo bejt míň takovejch tak se líp na netu dejchá, abych

nezapoměl tlačítka myši fungují obráceně takže i příkazy myší jsou otočené při odstranění a

povipínání všech zavirovaných exe a scriptů stačí jen resetovar a počítač zase funguje normal

při activaci viru pc nevipínat takle jsem ten vir odstranil za 2 minuty ale může být více variant

postup je obdobný tak zdar lidi snad vám to pomůže. Miloš

prosím jenom se se chtěl zeptat co je myšleno tím resetovat,protože mám z toho strach že se mi smažou všechny soubory v komplu

filiphorak2
Zdravim
Prosim ta nepis do rok stareho topicu,za navod ktory si tam nasiel, nerucime, nie je nas navod.
Ak mas problem s pc, prosim zaloz si vlastny novy topic
Dakujem
temu zatvaram.