VIRY.CZ

Logfile of random's system information tool 1.06 (written by random/random)
Run by Lukáš at 2010-01-13 18:19:02
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 13 GB (65%) free of 20 GB
Total RAM: 767 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:33, on 13.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lukáš\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Přidat do blokovaných reklamních lišt - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Statisktika ochrany webového provozu - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{56BDE3E6-7A4E-4560-B662-0E130044557B}: NameServer = 192.168.30.2,192.168.30.4
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6084 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1261759127.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2009-12-24 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"=Rundll32 P17.dll,P17Helper []
"NvCplDaemon"=C:\WINDOWS\System32\NvCpl.dll [2004-12-15 5513216]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\System32\NvMcTray.dll [2004-12-15 86016]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-12-24 201992]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [2002-04-11 69632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-04-25 206088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FBFD382A-AC6E-4EB7-8944-F97D358B378D}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe"="C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe:*:Enabled:Sunbelt Kerio Firewall GUI"
"C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\Czech\setup.exe"="C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\Czech\setup.exe:*:Enabled:Kaspersky Internet Security 2009 Setup"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-01-13 18:19:03 ----D---- C:\Program Files\trend micro
2010-01-13 18:19:02 ----D---- C:\rsit
2010-01-05 16:21:38 ----A---- C:\WINDOWS\isxdl.dll
2010-01-05 16:19:17 ----D---- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2010-01-05 16:19:11 ----D---- C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)
2010-01-05 16:19:09 ----D---- C:\Program Files\SDHelper (Spybot - Search & Destroy)
2010-01-05 16:18:46 ----D---- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
2010-01-05 16:15:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-01-03 19:55:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-12-25 17:38:38 ----A---- C:\WINDOWS\pagesuit.ini
2009-12-25 17:38:37 ----A---- C:\WINDOWS\system32\irisco32.dll
2009-12-25 17:38:11 ----D---- C:\Program Files\ReadIris
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZisn12.dll
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZipt12.dll
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZipr12.dll
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZipm12.exe
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZinw12.exe
2009-12-25 17:35:39 ----RA---- C:\WINDOWS\system32\HPZidr12.dll
2009-12-25 17:32:21 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2009-12-25 17:31:58 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Složka odesílání Share-to-Web
2009-12-25 17:30:46 ----D---- C:\Program Files\Hewlett-Packard
2009-12-25 12:11:40 ----A---- C:\WINDOWS\system32\msonpmon.dll
2009-12-25 12:08:23 ----D---- C:\Program Files\Microsoft Works
2009-12-25 12:08:06 ----D---- C:\Program Files\MSBuild
2009-12-25 12:07:32 ----D---- C:\Program Files\Microsoft Visual Studio
2009-12-25 12:07:32 ----D---- C:\Program Files\Common Files\DESIGNER
2009-12-25 12:06:27 ----D---- C:\Program Files\Microsoft.NET
2009-12-25 12:03:33 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-12-25 12:02:41 ----D---- C:\WINDOWS\SHELLNEW
2009-12-25 12:02:04 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2009-12-25 12:00:52 ----RHD---- C:\MSOCache
2009-12-24 19:51:31 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\ICQ
2009-12-24 19:51:02 ----D---- C:\Program Files\ICQ6.5
2009-12-24 19:32:52 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\InstallShield
2009-12-24 19:07:11 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Jpeg Resampler
2009-12-24 07:58:25 ----D---- C:\Program Files\Kaspersky Lab
2009-12-24 07:58:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab
2009-12-24 07:36:02 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Kaspersky_Key_Finder_(KKF
2009-12-24 07:12:13 ----D---- C:\WINDOWS\SoftwareDistribution
2009-12-24 07:12:10 ----D---- C:\WINDOWS\Prefetch
2009-12-24 07:05:30 ----N---- C:\WINDOWS\system32\comsdupd.exe
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ati3duag.dll
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2009-12-24 07:05:24 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\fwcfg.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\fsquirt.exe
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\fltmc.exe
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\fltlib.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\extmgr.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\cmsetacl.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\btpanui.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\bthserv.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\bthci.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\blastcln.exe
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\bitsprx3.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\bitsprx2.dll
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\auditusr.exe
2009-12-24 07:05:23 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\mspmsnsv.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\msdadiag.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\mp4sdmod.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\mp43dmod.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdukx.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdsmsno.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdsmsfi.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdno1.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdmlt48.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdmlt47.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdmaori.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdinmal.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdinben.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdinbe1.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\kbdfi1.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ir50_qcx.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ir50_qc.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ir50_32.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ir41_qcx.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ir41_qc.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\ieencode.dll
2009-12-24 07:05:22 ----N---- C:\WINDOWS\system32\httpapi.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\xpsp2res.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\xpob2res.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\twext.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\strmfilt.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\smbinst.exe
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\slserv.exe
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\slrundll.exe
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\slgen.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\slextspk.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\slcoinst.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\sdhcinst.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\s3gnb.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\powercfg.exe
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\pnrpnsp.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\p2psvc.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\p2pnetsh.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\p2pgraph.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\p2pgasvc.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\p2p.dll
2009-12-24 07:05:21 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2009-12-24 07:05:20 ----N---- C:\WINDOWS\system32\wmidx.dll
2009-12-24 07:05:20 ----N---- C:\WINDOWS\system32\wmerror.dll
2009-12-24 07:05:20 ----N---- C:\WINDOWS\system32\winshfhc.dll
2009-12-24 07:05:20 ----N---- C:\WINDOWS\system32\w3ssl.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wuaueng1.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wuauclt1.exe
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wuapi.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wshbth.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wscsvc.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wscntfy.exe
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmvdmoe2.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmspdmoe.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmspdmod.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmsdmoe2.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmpdxm.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmpasf.dll
2009-12-24 07:05:19 ----N---- C:\WINDOWS\system32\wmp.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\system32\xmlprovi.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\system32\xmlprov.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\system32\wuweb.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\system32\wups.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\system32\wucltui.dll
2009-12-24 07:05:18 ----N---- C:\WINDOWS\slrundll.exe
2009-12-24 07:05:12 ----D---- C:\WINDOWS\peernet
2009-12-24 07:05:10 ----D---- C:\WINDOWS\provisioning
2009-12-24 07:03:26 ----D---- C:\WINDOWS\ServicePackFiles
2009-12-24 07:00:50 ----A---- C:\WINDOWS\002338_.tmp
2009-12-24 07:00:33 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-12-24 06:59:21 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-12-24 06:59:17 ----D---- C:\WINDOWS\EHome
2009-12-23 19:29:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2009-12-23 19:19:28 ----A---- C:\WINDOWS\system32\capicom.dll
2009-12-23 19:19:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Symantec
2009-12-23 12:47:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2009-12-23 12:47:21 ----D---- C:\Program Files\Common Files\Adobe
2009-12-23 12:47:21 ----D---- C:\Program Files\Adobe
2009-12-21 10:42:36 ----D---- C:\WINDOWS\system32\appmgmt
2009-12-20 18:27:20 ----A---- C:\WINDOWS\ODBC.INI
2009-12-20 18:27:16 ----A---- C:\WINDOWS\system32\mdimon.dll
2009-12-20 18:25:40 ----D---- C:\Program Files\Microsoft Office
2009-12-20 18:23:23 ----D---- C:\Program Files\Alcohol Soft
2009-12-20 15:04:54 ----D---- C:\Program Files\Light Artist
2009-12-20 15:01:01 ----D---- C:\WINDOWS\Downloaded Installations
2009-12-19 15:52:25 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Thinstall
2009-12-19 15:42:43 ----D---- C:\Program Files\iXi Tools
2009-12-18 21:06:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters Inc
2009-12-18 21:01:43 ----D---- C:\Program Files\ASUSTeK
2009-12-18 21:01:34 ----D---- C:\WINDOWS\RegisteredPackages
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\wstdecod.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\quartz.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qedwipes.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qedit.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qdvd.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qdv.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qcap.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\qasf.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\psisdecd.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\msyuv.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\mswebdvd.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\msvidctl.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\msdmo.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\mciqtz32.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\encapi.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dswave.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmusic.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmsynth.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmstyle.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmscript.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmloader.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmime.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmcompos.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\dmband.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\devenum.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\d3d9.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\d3d8.dll
2009-12-18 21:01:17 ----A---- C:\WINDOWS\system32\amstream.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dxdiagn.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dxdiag.exe
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dx8vb.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dx7vb.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dsound3d.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dsound.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dsdmoprp.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dsdmo.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpwsockx.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpvvox.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpvsetup.exe
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpvoice.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpvacm.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnsvr.exe
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnlobby.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnhupnp.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnhpast.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnet.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpnaddr.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dpmodemx.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dplayx.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\dplaysvr.exe
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\ddrawex.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\ddraw.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\d3dim700.dll
2009-12-18 21:01:16 ----A---- C:\WINDOWS\system32\d3d8thk.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKOSDX.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKOSDMini.DLL
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKOGL.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\atkid.ini
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKCheckDispIDs.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKDispCPL.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\system32\ATKDISP.dll
2009-12-18 21:01:03 ----A---- C:\WINDOWS\ATKKBService.exe
2009-12-18 21:00:25 ----D---- C:\WINDOWS\nview
2009-12-18 21:00:24 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-12-18 20:53:00 ----D---- C:\WINDOWS\system32\AGEIA
2009-12-18 20:53:00 ----D---- C:\Program Files\AGEIA Technologies
2009-12-18 20:52:42 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-12-18 20:49:49 ----A---- C:\WINDOWS\system32\iuengine.dll
2009-12-18 20:45:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA Corporation
2009-12-18 20:29:44 ----A---- C:\WINDOWS\system32\usbui.dll
2009-12-18 20:29:38 ----A---- C:\WINDOWS\system32\vusetup.dll
2009-12-18 20:29:27 ----A---- C:\WINDOWS\IsUn0405.exe
2009-12-18 20:25:48 ----A---- C:\WINDOWS\IsUninst.exe
2009-12-18 20:24:47 ----A---- C:\WINDOWS\system32\RtNicProp32.dll
2009-12-18 20:24:45 ----D---- C:\Program Files\Realtek
2009-12-18 20:23:46 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-12-18 20:23:17 ----N---- C:\WINDOWS\system32\difxapi.dll
2009-12-18 20:23:17 ----D---- C:\Program Files\VIA
2009-12-18 20:17:03 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2009-12-18 20:17:03 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2009-12-18 20:16:33 ----D---- C:\WINDOWS\system32\Data
2009-12-18 20:16:33 ----A---- C:\WINDOWS\system32\ludap17.ini
2009-12-18 20:16:33 ----A---- C:\WINDOWS\system32\ctzapxx.ini
2009-12-18 20:16:33 ----A---- C:\WINDOWS\INRES.DLL
2009-12-18 20:16:31 ----D---- C:\Program Files\Creative
2009-12-18 20:16:10 ----HD---- C:\Program Files\InstallShield Installation Information
2009-12-18 20:15:03 ----D---- C:\Program Files\Common Files\InstallShield
2009-12-18 20:12:42 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\GetRightToGo
2009-12-18 19:54:00 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Macromedia
2009-12-18 19:54:00 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Adobe
2009-12-18 19:37:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters
2009-12-18 19:33:02 ----RSD---- C:\WINDOWS\assembly
2009-12-18 19:32:35 ----D---- C:\WINDOWS\Microsoft.NET
2009-12-18 19:31:21 ----SHD---- C:\RECYCLER
2009-12-18 19:29:57 ----A---- C:\WINDOWS\system32\h323log.txt
2009-12-18 19:26:10 ----HD---- C:\WINDOWS\system32\skype
2009-12-18 19:08:45 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Uniblue
2009-12-18 19:08:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\DriverScanner
2009-12-18 19:06:24 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-12-18 19:06:20 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-12-18 19:04:58 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\WinRAR
2009-12-18 19:04:37 ----D---- C:\Program Files\WinRAR
2009-12-18 19:00:38 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Mozilla
2009-12-18 19:00:34 ----D---- C:\Program Files\Mozilla Firefox
2009-12-18 18:55:28 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\MSN6
2009-12-18 18:55:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\MSN6
2009-12-18 18:47:06 ----SD---- C:\WINDOWS\system32\Microsoft
2009-12-18 18:45:51 ----D---- C:\Program Files\Sunbelt Software
2009-12-18 18:41:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-18 18:41:49 ----D---- C:\Program Files\Common Files\ODBC
2009-12-18 18:41:49 ----A---- C:\WINDOWS\ODBCINST.INI
2009-12-18 18:41:46 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-12-18 18:41:45 ----RD---- C:\Program Files
2009-12-18 18:41:45 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-12-18 18:41:45 ----D---- C:\Program Files\Common Files
2009-12-18 18:41:43 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-12-18 18:41:43 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-12-18 18:41:43 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-12-18 18:41:40 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-12-18 18:41:39 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-12-18 18:41:39 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-12-18 18:41:37 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-12-18 18:41:35 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-12-18 18:41:35 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-12-18 18:41:35 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-12-18 18:41:35 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-12-18 18:41:35 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdycl.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdsl1.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdsl.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdro.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdpl1.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdpl.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdhu1.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdhu.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\kbdcr.dll
2009-12-18 18:41:30 ----A---- C:\WINDOWS\system32\KBDAL.DLL
2009-12-18 18:41:29 ----A---- C:\WINDOWS\system32\irclass.dll
2009-12-18 18:41:29 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-12-18 18:41:29 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-12-18 18:41:28 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-12-18 18:41:28 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-12-18 18:41:25 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-12-18 18:41:25 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-12-18 18:41:25 ----A---- C:\WINDOWS\system32\batt.dll
2009-12-18 18:41:25 ----A---- C:\WINDOWS\notepad.exe
2009-12-18 18:41:24 ----A---- C:\WINDOWS\system32\storprop.dll
2009-12-18 18:41:21 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini
2009-12-18 18:41:16 ----RA---- C:\WINDOWS\SETA.tmp
2009-12-18 18:41:13 ----RA---- C:\WINDOWS\SET3.tmp
2009-12-18 18:41:08 ----D---- C:\WINDOWS\system32\CatRoot2
2009-12-18 18:41:08 ----D---- C:\WINDOWS\system32\CatRoot
2009-12-18 18:41:02 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2009-12-18 18:40:44 ----D---- C:\Documents and Settings
2009-12-18 18:40:39 ----SHD---- C:\WINDOWS\Installer
2009-12-18 18:40:36 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Identities
2009-12-18 18:40:32 ----HD---- C:\Program Files\Uninstall Information
2009-12-18 18:40:28 ----SD---- C:\Documents and Settings\Lukáš\Data aplikací\Microsoft
2009-12-18 18:40:28 ----ASH---- C:\Documents and Settings\Lukáš\Data aplikací\desktop.ini
2009-12-18 18:39:53 ----SHD---- C:\System Volume Information
2009-12-18 18:39:17 ----RASH---- C:\boot.ini
2009-12-18 18:38:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-18 18:35:11 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-18 18:35:11 ----RSD---- C:\WINDOWS\Fonts
2009-12-18 18:35:11 ----RD---- C:\WINDOWS\Web
2009-12-18 18:35:11 ----HD---- C:\WINDOWS\inf
2009-12-18 18:35:11 ----D---- C:\WINDOWS\WinSxS
2009-12-18 18:35:11 ----D---- C:\WINDOWS\twain_32
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Temp
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\wins
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\wbem
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\usmt
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\spool
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\ShellExt
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\Setup
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\ras
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\oobe
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\npp
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\mui
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\inetsrv
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\IME
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\icsxml
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\ias
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\export
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\drivers
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\dhcp
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\config
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\3com_dmi
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\3076
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\2052
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1054
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1042
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1041
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1037
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1033
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1031
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1029
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1028
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32\1025
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system32
2009-12-18 18:35:11 ----D---- C:\WINDOWS\system
2009-12-18 18:35:11 ----D---- C:\WINDOWS\security
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Resources
2009-12-18 18:35:11 ----D---- C:\WINDOWS\repair
2009-12-18 18:35:11 ----D---- C:\WINDOWS\mui
2009-12-18 18:35:11 ----D---- C:\WINDOWS\msapps
2009-12-18 18:35:11 ----D---- C:\WINDOWS\msagent
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Media
2009-12-18 18:35:11 ----D---- C:\WINDOWS\java
2009-12-18 18:35:11 ----D---- C:\WINDOWS\ime
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Help
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Driver Cache
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Debug
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Cursors
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Connection Wizard
2009-12-18 18:35:11 ----D---- C:\WINDOWS\Config
2009-12-18 18:35:11 ----D---- C:\WINDOWS\AppPatch
2009-12-18 18:35:11 ----D---- C:\WINDOWS\addins
2009-12-18 18:35:11 ----D---- C:\WINDOWS
2009-12-18 18:34:59 ----D---- C:\WINDOWS\system32\xircom
2009-12-18 18:34:59 ----D---- C:\Program Files\xerox
2009-12-18 18:34:59 ----D---- C:\Program Files\microsoft frontpage
2009-12-18 18:34:43 ----A---- C:\WINDOWS\control.ini
2009-12-18 18:34:43 ----A---- C:\AUTOEXEC.BAT
2009-12-18 18:34:35 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-12-18 18:33:53 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-12-18 18:33:53 ----RD---- C:\WINDOWS\Offline Web Pages
2009-12-18 18:33:53 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-12-18 18:33:48 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-12-18 18:33:26 ----D---- C:\WINDOWS\system32\DirectX
2009-12-18 18:32:51 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-12-18 18:32:51 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-12-18 18:32:51 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-12-18 18:32:51 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-12-18 18:32:51 ----A---- C:\WINDOWS\system32\atrace.dll
2009-12-18 18:32:48 ----A---- C:\WINDOWS\system32\desktop.ini
2009-12-18 18:32:48 ----A---- C:\WINDOWS\desktop.ini
2009-12-18 18:32:39 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-12-18 18:32:39 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-12-18 18:32:38 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-12-18 18:32:37 ----A---- C:\WINDOWS\system32\acctres.dll
2009-12-18 18:32:36 ----D---- C:\Program Files\Common Files\Services
2009-12-18 18:32:35 ----A---- C:\WINDOWS\system32\inetres.dll
2009-12-18 18:32:31 ----SD---- C:\WINDOWS\Tasks
2009-12-18 18:32:30 ----A---- C:\WINDOWS\system32\isign32.dll
2009-12-18 18:32:30 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-12-18 18:32:30 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-12-18 18:32:30 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-12-18 18:32:30 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-12-18 18:32:27 ----D---- C:\Program Files\Common Files\MSSoap
2009-12-18 18:32:21 ----D---- C:\WINDOWS\srchasst
2009-12-18 18:32:20 ----D---- C:\WINDOWS\system32\Macromed
2009-12-18 18:32:19 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-12-18 18:32:19 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-12-18 18:32:18 ----D---- C:\Program Files\Movie Maker
2009-12-18 18:32:14 ----D---- C:\WINDOWS\PCHealth
2009-12-18 18:32:13 ----D---- C:\WINDOWS\system32\Restore
2009-12-18 18:32:13 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-12-18 18:32:13 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-12-18 18:32:13 ----A---- C:\WINDOWS\system32\srclient.dll
2009-12-18 18:32:12 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-12-18 18:32:12 ----A---- C:\WINDOWS\system32\msconf.dll
2009-12-18 18:32:12 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-12-18 18:32:12 ----A---- C:\WINDOWS\system32\ils.dll
2009-12-18 18:32:09 ----D---- C:\Program Files\NetMeeting
2009-12-18 18:32:09 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-12-18 18:32:08 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-12-18 18:32:08 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-12-18 18:32:07 ----D---- C:\Program Files\Outlook Express
2009-12-18 18:32:07 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-12-18 18:32:06 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-12-18 18:32:06 ----A---- C:\WINDOWS\system32\mstask.dll
2009-12-18 18:31:59 ----D---- C:\Program Files\Common Files\System
2009-12-18 18:31:58 ----D---- C:\Program Files\Internet Explorer
2009-12-18 18:31:30 ----D---- C:\Program Files\ComPlus Applications
2009-12-18 18:31:29 ----A---- C:\WINDOWS\vbaddin.ini
2009-12-18 18:31:29 ----A---- C:\WINDOWS\vb.ini
2009-12-18 18:31:28 ----D---- C:\WINDOWS\Registration
2009-12-18 18:31:26 ----HD---- C:\Program Files\WindowsUpdate
2009-12-18 18:31:26 ----D---- C:\Program Files\Windows Media Player
2009-12-18 18:31:26 ----D---- C:\Program Files\Online Services
2009-12-18 18:31:22 ----D---- C:\Program Files\Messenger
2009-12-18 18:31:17 ----D---- C:\Program Files\MSN Gaming Zone
2009-12-18 18:31:17 ----A---- C:\WINDOWS\system32\write.exe
2009-12-18 18:31:05 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-12-18 18:31:04 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-12-18 18:31:04 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-12-18 18:31:04 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-12-18 18:31:04 ----A---- C:\WINDOWS\system32\hticons.dll
2009-12-18 18:31:03 ----A---- C:\WINDOWS\system32\avwav.dll
2009-12-18 18:31:03 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-12-18 18:31:03 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-12-18 18:31:02 ----A---- C:\WINDOWS\system32\winchat.exe
2009-12-18 18:30:53 ----A---- C:\WINDOWS\system32\charmap.exe
2009-12-18 18:30:53 ----A---- C:\WINDOWS\system32\getuname.dll
2009-12-18 18:30:52 ----A---- C:\WINDOWS\system32\winmine.exe
2009-12-18 18:30:52 ----A---- C:\WINDOWS\system32\sol.exe
2009-12-18 18:30:52 ----A---- C:\WINDOWS\system32\calc.exe
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\tskill.exe
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\reset.exe
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-12-18 18:30:51 ----A---- C:\WINDOWS\system32\freecell.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\tscon.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\shadow.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\regini.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-12-18 18:30:50 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-12-18 18:30:49 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-12-18 18:30:49 ----A---- C:\WINDOWS\system32\msg.exe
2009-12-18 18:30:49 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-12-18 18:30:49 ----A---- C:\WINDOWS\system32\logoff.exe
2009-12-18 18:30:49 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-12-18 18:30:48 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-12-18 18:30:48 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-12-18 18:30:48 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-12-18 18:30:48 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-12-18 18:30:48 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\stclient.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-12-18 18:30:46 ----A---- C:\WINDOWS\system32\colbact.dll
2009-12-18 18:30:45 ----A---- C:\WINDOWS\system32\comuid.dll
2009-12-18 18:30:45 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-12-18 18:30:45 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-12-18 18:30:45 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-12-18 18:30:44 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-12-18 18:30:44 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-12-18 18:30:34 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-12-18 18:30:34 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-12-18 18:30:34 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-12-18 18:30:34 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-12-18 18:30:29 ----D---- C:\Program Files\MSN
2009-12-18 18:30:28 ----D---- C:\Program Files\Windows NT
2009-12-18 18:30:28 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-12-18 18:30:28 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-12-18 18:30:28 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-12-18 18:30:27 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-12-18 18:30:27 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-12-18 18:30:27 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-12-18 18:30:27 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-12-18 18:30:27 ----A---- C:\WINDOWS\system32\spider.exe
2009-12-18 18:30:26 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-12-18 18:30:26 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-12-18 18:30:26 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-12-18 18:30:26 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-12-18 18:30:26 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-12-18 18:30:25 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-12-18 18:30:24 ----D---- C:\WINDOWS\system32\MsDtc
2009-12-18 18:30:24 ----D---- C:\WINDOWS\system32\Com
2009-12-18 18:30:24 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-12-18 18:30:24 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-12-18 18:30:23 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-12-18 18:30:19 ----A---- C:\WINDOWS\system32\licwmi.dll

======List of files/folders modified in the last 1 months======

2009-12-25 17:48:08 ----A---- C:\WINDOWS\win.ini
2009-12-24 07:01:16 ----RASH---- C:\NTDETECT.COM
2009-12-18 18:41:45 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2009-12-25 82380]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2004-08-17 41216]
R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2004-07-20 20096]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-12-24 213520]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2002-02-15 50960]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2002-03-21 16112]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2002-03-08 22512]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-12-15 3329504]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\System32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys [2009-03-25 130432]
R3 sermouse;Ovladač sériové myši; C:\WINDOWS\System32\DRIVERS\sermouse.sys [2001-10-25 17664]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS\System32\Drivers\vulfnth.sys [2005-01-05 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS\System32\Drivers\vulfntr.sys [2005-06-06 11264]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 viafilter;VIA USB Filter; C:\WINDOWS\System32\Drivers\viausb1.sys [2001-09-19 9728]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2004-07-20 90112]
R2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-12-24 201992]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2004-12-15 139331]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2002-03-15 81920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Dobrý večer

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

motji píše:Dobrý večer

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

ComboFix 10-01-14.02 - Lukáš 14.01.2010 22:59:36.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.481 [GMT 1:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Luk ç\Dokumenty\cc_20100103_195123.reg
c:\program files\ICQ6.5\ICQLRun.exe
c:\windows\system32\Data
c:\windows\system32\ieuinit.inf
c:\windows\system32\skype
c:\windows\system32\skype\klog.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-14 do 2010-01-14 )))))))))))))))))))))))))))))))
.

2010-01-13 17:19 . 2010-01-13 17:20 -------- d-----w- c:\program files\trend micro
2010-01-13 17:19 . 2010-01-13 17:20 -------- d-----w- C:\rsit
2010-01-05 15:21 . 2005-03-11 18:42 59392 ----a-w- c:\windows\isxdl.dll
2010-01-05 15:19 . 2010-01-05 15:19 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-01-05 15:19 . 2010-01-05 15:19 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-01-05 15:19 . 2010-01-05 15:19 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-01-05 15:18 . 2010-01-05 15:18 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-01-05 15:15 . 2010-01-13 17:11 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-25 16:38 . 1997-05-26 13:55 23040 ----a-w- c:\windows\system32\irisco32.dll
2009-12-25 16:38 . 2009-12-25 16:38 -------- d-----w- c:\program files\ReadIris
2009-12-25 16:35 . 2001-08-17 20:56 7552 -c--a-w- c:\windows\system32\dllcache\sonypvu1.sys
2009-12-25 16:35 . 2001-08-17 20:56 7552 ----a-w- c:\windows\system32\drivers\SONYPVU1.SYS
2009-12-25 16:35 . 2002-04-10 21:00 167936 ----a-r- c:\windows\system32\HPZipr12.dll
2009-12-25 16:35 . 2002-03-21 17:37 16112 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2009-12-25 16:35 . 2002-03-15 20:37 81920 ----a-r- c:\windows\system32\HPZipm12.exe
2009-12-25 16:35 . 2002-03-15 20:37 196608 ----a-r- c:\windows\system32\HPZidr12.dll
2009-12-25 16:35 . 2002-02-15 18:26 73728 ----a-r- c:\windows\system32\HPZinw12.exe
2009-12-25 16:35 . 2002-02-15 18:26 69632 ----a-r- c:\windows\system32\HPZisn12.dll
2009-12-25 16:35 . 2002-02-15 18:26 106496 ----a-r- c:\windows\system32\HPZipt12.dll
2009-12-25 16:35 . 2002-02-15 18:26 50960 ----a-r- c:\windows\system32\drivers\hpzid412.sys
2009-12-25 16:34 . 2002-03-08 10:49 22512 ----a-r- c:\windows\system32\drivers\HPZius12.sys
2009-12-25 16:34 . 2004-08-03 22:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-12-25 16:34 . 2004-08-03 22:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-12-25 16:33 . 2004-08-03 21:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-12-25 16:33 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-12-25 16:33 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-12-25 16:33 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-12-25 16:32 . 2009-12-25 16:32 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-12-25 16:30 . 2009-12-25 16:31 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-25 16:30 . 2009-12-25 16:30 82380 ----a-w- c:\windows\system32\drivers\AFS2K.SYS
2009-12-25 16:26 . 2002-06-11 17:29 27874 ------w- c:\windows\hpoins01.dat
2009-12-25 16:26 . 2002-04-25 15:40 7765 ------w- c:\windows\hpomdl01.dat
2009-12-25 11:11 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2009-12-25 11:11 . 2006-10-26 18:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-12-25 11:08 . 2009-12-25 11:08 -------- d-----w- c:\program files\Microsoft Works
2009-12-25 11:08 . 2009-12-25 11:08 -------- d-----w- c:\program files\MSBuild
2009-12-25 11:06 . 2009-12-25 11:06 -------- d-----w- c:\program files\Microsoft.NET
2009-12-25 11:03 . 2009-12-25 11:03 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-25 11:02 . 2009-12-25 11:07 -------- d-----w- c:\windows\SHELLNEW
2009-12-25 11:00 . 2009-12-25 11:00 -------- d-----r- C:\MSOCache
2009-12-24 18:51 . 2010-01-14 22:04 -------- d-----w- c:\program files\ICQ6.5
2009-12-24 06:59 . 2009-12-24 07:22 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-12-24 06:59 . 2009-12-24 07:22 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-12-24 06:58 . 2010-01-14 22:43 286752 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-12-24 06:58 . 2010-01-14 22:43 2354720 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-24 06:58 . 2009-12-24 06:58 -------- d-----w- c:\program files\Kaspersky Lab
2009-12-24 06:13 . 2009-12-24 06:13 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2009-12-24 06:12 . 2009-12-25 11:08 -------- d-----w- c:\windows\system32\wbem\AutoRecover
2009-12-24 06:03 . 2009-12-24 06:03 -------- d-----w- c:\windows\ServicePackFiles
2009-12-24 06:00 . 2004-08-03 21:42 15872 ----a-w- c:\windows\system32\spupdsvc.exe
2009-12-24 05:59 . 2009-12-24 06:05 -------- d-----w- c:\windows\EHome
2009-12-23 11:47 . 2009-12-23 11:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-20 17:27 . 2004-03-22 22:17 25840 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2009-12-20 17:27 . 2004-03-22 22:17 24816 ----a-w- c:\windows\system32\mdimon.dll
2009-12-20 17:23 . 2009-12-20 17:23 -------- d-----w- c:\program files\Alcohol Soft
2009-12-20 14:04 . 2009-12-21 07:05 -------- d-----w- c:\program files\Light Artist
2009-12-20 14:01 . 2009-12-20 14:01 -------- d-----w- c:\windows\Downloaded Installations
2009-12-19 14:42 . 2009-12-20 13:50 -------- d-----w- c:\program files\iXi Tools
2009-12-18 20:00 . 2009-12-18 20:14 -------- d-----w- c:\windows\nview
2009-12-18 20:00 . 2004-12-15 04:01 176128 ----a-w- c:\windows\system32\nvudisp.exe
2009-12-18 19:59 . 2004-12-14 15:55 9472 ----a-r- c:\windows\system32\drivers\EIO.sys
2009-12-18 19:53 . 2009-12-18 19:53 -------- d-----w- c:\program files\AGEIA Technologies
2009-12-18 19:53 . 2009-12-18 19:53 -------- d-----w- c:\windows\system32\AGEIA
2009-12-18 19:52 . 2009-12-18 19:52 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-18 19:49 . 2004-08-17 14:49 192000 ----a-w- c:\windows\system32\iuengine.dll
2009-12-18 19:29 . 2004-08-17 14:49 75264 ----a-w- c:\windows\system32\usbui.dll
2009-12-18 19:29 . 2004-08-03 22:08 26624 ----a-w- c:\windows\system32\drivers\usbehci.sys
2009-12-18 19:29 . 2004-08-03 22:08 57600 ----a-w- c:\windows\system32\drivers\usbhub.sys
2009-12-18 19:29 . 2004-08-03 22:08 142976 ----a-w- c:\windows\system32\drivers\usbport.sys
2009-12-18 19:29 . 2005-06-06 16:51 11264 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2009-12-18 19:29 . 2005-01-05 17:02 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2009-12-18 19:29 . 2003-10-03 15:28 45056 ----a-w- c:\windows\system32\vusetup.dll
2009-12-18 19:29 . 1998-11-13 11:58 307200 ----a-w- c:\windows\IsUn0405.exe
2009-12-18 19:25 . 2001-09-19 12:28 9728 ----a-w- c:\windows\system32\drivers\viausb1.sys
2009-12-18 19:25 . 2001-09-24 00:10 306688 ----a-w- c:\windows\IsUninst.exe
2009-12-18 19:24 . 2009-03-25 13:29 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2009-12-18 19:24 . 2009-03-03 19:18 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2009-12-18 19:24 . 2009-12-18 19:24 -------- d-----w- c:\program files\Realtek
2009-12-18 19:23 . 2001-10-24 10:44 35840 -c--a-w- c:\windows\system32\dllcache\isapnp.sys
2009-12-18 19:23 . 2001-10-24 10:44 35840 ----a-w- c:\windows\system32\drivers\isapnp.sys
2009-12-18 19:23 . 2009-12-18 19:23 -------- d-----w- c:\program files\VIA
2009-12-18 19:23 . 2005-04-12 11:54 331184 ------w- c:\windows\system32\difxapi.dll
2009-12-18 19:23 . 2009-05-05 08:58 13976 ----a-w- c:\windows\system32\drivers\videX32.sys
2009-12-18 19:23 . 2003-07-02 03:42 27904 ----a-w- c:\windows\system32\drivers\VIAAGP1.SYS
2009-12-18 19:17 . 2009-12-18 19:17 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-18 19:17 . 2009-12-18 19:17 114688 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-18 19:17 . 2004-08-03 22:15 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2009-12-18 19:16 . 2009-12-25 16:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-18 19:15 . 2009-12-25 16:38 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-18 18:00 . 2009-12-18 18:00 0 ----a-w- c:\windows\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-14 22:43 . 2009-12-24 06:58 3108 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-01-14 22:43 . 2009-12-24 06:58 21572 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-25 16:14 . 2001-10-25 14:00 70106 ----a-w- c:\windows\system32\perfc005.dat
2009-12-25 16:14 . 2001-10-25 14:00 393192 ----a-w- c:\windows\system32\perfh005.dat
2009-12-24 07:22 . 2008-01-29 17:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-12-24 06:08 . 2009-12-18 17:34 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-12-24 06:08 . 2009-12-18 17:34 2724 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2009-12-24 06:06 . 2009-12-18 17:34 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2009-12-18 20:01 . 2009-12-18 20:01 -------- d-----w- c:\program files\ASUSTeK
2009-12-18 19:17 . 2009-12-18 19:16 -------- d-----w- c:\program files\Creative
2009-12-18 17:45 . 2009-12-18 17:45 -------- d-----w- c:\program files\Sunbelt Software
2009-12-18 17:34 . 2009-12-18 17:34 -------- d-----w- c:\program files\microsoft frontpage
2009-12-18 17:34 . 2009-12-18 17:34 558142 ----a-w- c:\windows\java\Packages\U860OOMO.ZIP
2009-12-18 17:34 . 2009-12-18 17:34 2678 ----a-w- c:\windows\java\Packages\Data\RDN5VTJP.DAT
2009-12-18 17:34 . 2009-12-18 17:34 2678 ----a-w- c:\windows\java\Packages\Data\U6HFLZ3R.DAT
2009-12-18 17:34 . 2009-12-18 17:34 155995 ----a-w- c:\windows\java\Packages\71371VVZ.ZIP
2009-12-18 17:34 . 2009-12-18 17:34 2678 ----a-w- c:\windows\java\Packages\Data\R93FV1FV.DAT
2009-12-18 17:34 . 2009-12-18 17:34 2678 ----a-w- c:\windows\java\Packages\Data\JVLJ7PJV.DAT
2009-12-18 17:34 . 2009-12-18 17:34 2678 ----a-w- c:\windows\java\Packages\Data\C4OYE6ZP.DAT
2009-12-18 17:31 . 2009-12-18 17:31 21812 ----a-w- c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 64512]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-12-15 5513216]
"nwiz"="nwiz.exe" [2004-12-15 1490944]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-12-15 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-12-24 201992]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-6-11 323646]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-6-11 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Czech\\setup.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29.1.2008 18:29 33808]
R0 sojubus;sojubus;c:\windows\system32\drivers\sojubus.sys [5.10.2003 10:41 123520]
R0 sojuscsi;sojuscsi;c:\windows\system32\drivers\sojuscsi.sys [28.9.2003 10:57 5504]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13.3.2008 19:02 26640]
S3 viafilter;VIA USB Filter;c:\windows\system32\drivers\viausb1.sys [18.12.2009 20:25 9728]
.
Obsah adresáře 'Naplánované úlohy'

2009-12-25 c:\windows\Tasks\FRU Task 2002-06-11 17:56ewlett-Packard2002-06-11 17:56p psc 2200 series0873DBB30DAF953F7DCEA1BDCC4F78BFDB130745261759127.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-06-11 09:56]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Přidat do blokovaných reklamních lišt - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
TCP: {56BDE3E6-7A4E-4560-B662-0E130044557B} = 192.168.30.2,192.168.30.4
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\o5fykipg.default\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-14 23:46
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\klogon.dll

- - - - - - - > 'explorer.exe'(3428)
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\ATKKBService.exe
c:\windows\System32\nvsvc32.exe
c:\windows\system32\Rundll32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\windows\system32\wscntfy.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
.
**************************************************************************
.
Celkový čas: 2010-01-14 23:50:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-14 22:49

Před spuštěním: Volných bajtů: 13 834 604 544
Po spuštění: Volných bajtů: 13 738 156 032

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 1EF9DF7FB556AEBBD480BF34C3BD417B

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

motji píše: Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3568
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

15.1.2010 9:23:15
mbam-log-2010-01-15 (09-23-07).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 107934
Uplynulý čas: 5 minute(s), 49 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{9b71d88c-c598-4935-c5d1-43aa4db90836} (Trojan.Agent) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

Co našel mbam, smažte.
Jak to vypadá s počítačem??

motji píše:Co našel mbam, smažte.
Jak to vypadá s počítačem??

PC pořát najíždí dlouho od zapnutí do uvodní orazovky VÍTEJTE to trvá cca 2min

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

motji píše:

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2010-01-15 12:22:16
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xF4A44940]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xF4A449A8]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Modules - GMER 1.0.14 ----

Module _________ F7453000-F746B000 (98304 bytes)

---- Threads - GMER 1.0.14 ----

Thread 4:388 8222F170
Thread 4:392 8220D000
Thread 4:396 8220D000
Thread 4:400 821DA7E0
Thread 4:404 821DA7E0
Thread 4:412 821DC7D0
Thread 4:416 821DC7D0
Thread 4:420 821DA7E0
Thread 4:444 8220D000
Thread 4:608 8220D000
Thread 4:2120 81BF1190

---- EOF - GMER 1.0.14 ----



GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2010-01-15 12:30:45
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwAdjustPrivilegesToken [0xF4A44A72]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwClose [0xF4A4501E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwConnectPort [0xF4A46A82]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateFile [0xF4A46438]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateKey [0xF4A441E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xF4A483E4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateThread [0xF4A44E1A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeleteKey [0xF4A4462A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeleteValueKey [0xF4A4482A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeviceIoControlFile [0xF4A46744]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDuplicateObject [0xF4A488F0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xF4A44940]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xF4A449A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwFsControlFile [0xF4A465FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwLoadDriver [0xF4A47EA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenFile [0xF4A46294]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenKey [0xF4A4434A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenProcess [0xF4A44C40]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenSection [0xF4A4840E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenThread [0xF4A44B96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryKey [0xF4A44A10]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryMultipleValueKey [0xF4A44714]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryValueKey [0xF4A444F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueueApcThread [0xF4A48110]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwReplaceKey [0xF4A43E6A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRequestWaitReplyPort [0xF4A4730C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRestoreKey [0xF4A43FCC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwResumeThread [0xF4A487C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSaveKey [0xF4A43C68]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSecureConnectPort [0xF4A46924]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetContextThread [0xF4A44F18]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSecurityObject [0xF4A47FA2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSystemInformation [0xF4A48438]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetValueKey [0xF4A443A0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendProcess [0xF4A4851C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendThread [0xF4A48648]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSystemDebugControl [0xF4A47DD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwTerminateProcess [0xF4A44CEA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwWriteVirtualMemory [0xF4A44D5C]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.14 ----

.text ntoskrnl.exe!_abnormal_termination + 443 804E3114 12 Bytes [ 1C, 85, A4, F4, 48, 86, A4, ... ]
.text ntoskrnl.exe!IoIsOperationSynchronous 804E8EBA 5 Bytes JMP F4A5B5A2 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804FDAF1 5 Bytes JMP F4A5B1E8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
? C:\DOCUME~1\LUK~1\LOCALS~1\Temp\kfxiraob.sys Systém nemůže nalézt uvedený soubor. !

---- User code sections - GMER 1.0.14 ----

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[320] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[320] USER32.dll!VRipOutput + FFFA5010 77D32A78 4 Bytes [ 70, 11, 41, 35 ]
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[1860] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[1860] USER32.dll!VRipOutput + FFFA5010 77D32A78 4 Bytes [ 70, 11, 41, 35 ]

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\System32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] 82206660
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 82206070
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] 82206250
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] 821CC820
IAT \SystemRoot\System32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] 821CC820
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 82206830
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 82206070
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] 82206250
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] 82206660
IAT \SystemRoot\System32\DRIVERS\sermouse.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 82206070
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 82206830
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] 82206660
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] 82206250
IAT \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\mrxdav.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0
IAT \SystemRoot\system32\drivers\kmixer.sys[ntoskrnl.exe!IoCreateDevice] 821CC6D0

---- Devices - GMER 1.0.14 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

Device \Driver\Cdrom \Device\CdRom0 82AC5C70
Device \Driver\Cdrom \Device\CdRom1 82AC5C70
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 82AB5AE8
Device \Driver\atapi \Device\Ide\IdePort0 82AB5AE8
Device \Driver\atapi \Device\Ide\IdePort1 82AB5AE8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 82AB5AE8

AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

Device \Driver\sojuscsi \Device\Scsi\sojuscsi1 82AED488
Device \Driver\sojuscsi \Device\Scsi\sojuscsi1Port2Path0Target0Lun0 82AED488

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Modules - GMER 1.0.14 ----

Module _________ F7453000-F746B000 (98304 bytes)

---- Threads - GMER 1.0.14 ----

Thread 4:388 8222F170
Thread 4:392 8220D000
Thread 4:396 8220D000
Thread 4:400 821DA7E0
Thread 4:404 821DA7E0
Thread 4:412 821DC7D0
Thread 4:416 821DC7D0
Thread 4:420 821DA7E0
Thread 4:444 8220D000
Thread 4:608 8220D000
Thread 4:2120 81BF1190

---- EOF - GMER 1.0.14 ----

první log z gmeru by nebyl?

motji píše:první log z gmeru by nebyl?

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2010-01-15 22:47:30
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xF475C940]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xF475C9A8]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.14 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Modules - GMER 1.0.14 ----

Module _________ F7453000-F746B000 (98304 bytes)

---- Threads - GMER 1.0.14 ----

Thread 4:392 82219170
Thread 4:396 821F7000
Thread 4:400 821F7000
Thread 4:404 821C47E0
Thread 4:408 821C47E0
Thread 4:416 821C67D0
Thread 4:420 821C67D0
Thread 4:424 821C47E0
Thread 4:448 821F7000
Thread 4:608 821F7000
Thread 4:2256 81BF0190

---- EOF - GMER 1.0.14 ----

Stáhněte Rootkit Unhooker http://forum.sysinternals.com/uploads/2 ... 300509.rar
-spusťte, klikněte na Report a potom klikněte na tlačítko Scan
-objeví se tabulka, dáte fajfku do všech okének a OK
-až se objeví tabulka "Select Disk for scan", vypněte ji křížkem v pravém horním rohu
-proběhne sken, objeví se okno z výsledky.Označte text a pravým tl. myši zkopírujte výsledky zde

motji píše: Stáhněte Rootkit Unhooker http://forum.sysinternals.com/uploads/2 ... 300509.rar
-spusťte, klikněte na Report a potom klikněte na tlačítko Scan
-objeví se tabulka, dáte fajfku do všech okének a OK
-až se objeví tabulka "Select Disk for scan", vypněte ji křížkem v pravém horním rohu
-proběhne sken, objeví se okno z výsledky.Označte text a pravým tl. myši zkopírujte výsledky zde

>SSDT State
NtAdjustPrivilegesToken
Actual Address 0xF475CA72
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtClose
Actual Address 0xF475D01E
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtConnectPort
Actual Address 0xF475EA82
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtCreateFile
Actual Address 0xF475E438
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtCreateKey
Actual Address 0xF475C1E8
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtCreateSymbolicLinkObject
Actual Address 0xF47603E4
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtCreateThread
Actual Address 0xF475CE1A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtDeleteKey
Actual Address 0xF475C62A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtDeleteValueKey
Actual Address 0xF475C82A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtDeviceIoControlFile
Actual Address 0xF475E744
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtDuplicateObject
Actual Address 0xF47608F0
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtEnumerateKey
Actual Address 0xF475C940
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtEnumerateValueKey
Actual Address 0xF475C9A8
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtFsControlFile
Actual Address 0xF475E5FA
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtLoadDriver
Actual Address 0xF475FEA8
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtOpenFile
Actual Address 0xF475E294
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtOpenKey
Actual Address 0xF475C34A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtOpenProcess
Actual Address 0xF475CC40
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtOpenSection
Actual Address 0xF476040E
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtOpenThread
Actual Address 0xF475CB96
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtQueryKey
Actual Address 0xF475CA10
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtQueryMultipleValueKey
Actual Address 0xF475C714
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtQueryValueKey
Actual Address 0xF475C4F2
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtQueueApcThread
Actual Address 0xF4760110
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtReplaceKey
Actual Address 0xF475BE6A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtRequestWaitReplyPort
Actual Address 0xF475F30C
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtRestoreKey
Actual Address 0xF475BFCC
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtResumeThread
Actual Address 0xF47607C0
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSaveKey
Actual Address 0xF475BC68
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSecureConnectPort
Actual Address 0xF475E924
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSetContextThread
Actual Address 0xF475CF18
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSetSecurityObject
Actual Address 0xF475FFA2
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSetSystemInformation
Actual Address 0xF4760438
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSetValueKey
Actual Address 0xF475C3A0
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSuspendProcess
Actual Address 0xF476051C
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSuspendThread
Actual Address 0xF4760648
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtSystemDebugControl
Actual Address 0xF475FDD4
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtTerminateProcess
Actual Address 0xF475CCEA
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtWriteVirtualMemory
Actual Address 0xF475CD5C
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

>Shadow
NtGdiBitBlt
Actual Address 0xF475E1D4
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtGdiMaskBlt
Actual Address 0xF475E234
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtGdiPlgBlt
Actual Address 0xF475E264
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtGdiStretchBlt
Actual Address 0xF475E204
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserAttachThreadInput
Actual Address 0xF475D6C4
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserCallOneParam
Actual Address 0xF475E890
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserFindWindowEx
Actual Address 0xF475D9A2
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserGetAsyncKeyState
Actual Address 0xF475D604
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserGetKeyboardState
Actual Address 0xF475D664
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserGetKeyState
Actual Address 0xF475D634
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserMessageCall
Actual Address 0xF475FD24
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserPostMessage
Actual Address 0xF475FD7C
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserPostThreadMessage
Actual Address 0xF475FDA8
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserRegisterRawInputDevices
Actual Address 0xF475E83A
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserSendInput
Actual Address 0xF475D97C
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserSetWindowsHookEx
Actual Address 0xF475D076
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

NtUserSetWinEventHook
Actual Address 0xF475D28E
Hooked by: C:\WINDOWS\system32\DRIVERS\klif.sys

>Processes
>Drivers
>Stealth
Unknown page with executable code
Address: 0x821F8A42
Size: 1470
Unknown page with executable code
Address: 0x81AB592C
Size: 1748
Unknown page with executable code
Address: 0x821C485C
Size: 1956
Unknown page with executable code
Address: 0x821B6FEC
Size: 20
Unknown page with executable code
Address: 0x81BF0556
Size: 2730
Unknown page with executable code
Address: 0x81AB6552
Size: 2734
Unknown page with executable code
Address: 0x821B72D8
Size: 3368
Unknown page with executable code
Address: 0x821C62B2
Size: 3406
>Files
>Hooks
fastfat.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF053887C hook handler located in [unknown_code_page]
ntoskrnl.exe+0x00005032, Type: Inline - RelativeJump at address 0x804DC032 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BD4C, Type: Inline - RelativeJump at address 0x804E2D4C hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BDB4, Type: Inline - RelativeJump at address 0x804E2DB4 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BDC4, Type: Inline - RelativeCall at address 0x804E2DC4 hook handler located in [unknown_code_page]
ntoskrnl.exe+0x0000BDF0, Type: Inline - RelativeJump at address 0x804E2DF0 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BE1C, Type: Inline - RelativeJump at address 0x804E2E1C hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BE24, Type: Inline - RelativeJump at address 0x804E2E24 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BE3C, Type: Inline - RelativeJump at address 0x804E2E3C hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BE44, Type: Inline - RelativeJump at address 0x804E2E44 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BEA4, Type: Inline - RelativeJump at address 0x804E2EA4 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BEFC, Type: Inline - PushRet at address 0x804E2EFC hook handler located in [unknown_code_page]
ntoskrnl.exe+0x0000BEFE, Type: Inline - RelativeJump at address 0x804E2EFE hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BF0A, Type: Inline - RelativeJump at address 0x804E2F0A hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BF20, Type: Inline - RelativeJump at address 0x804E2F20 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BFA0, Type: Inline - RelativeJump at address 0x804E2FA0 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000BFF0, Type: Inline - RelativeJump at address 0x804E2FF0 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000C024, Type: Inline - RelativeJump at address 0x804E3024 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000C040, Type: Inline - RelativeJump at address 0x804E3040 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000C068, Type: Inline - RelativeJump at address 0x804E3068 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000C074, Type: Inline - RelativeJump at address 0x804E3074 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000C114, Type: Inline - RelativeJump at address 0x804E3114 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe-->FsRtlCheckLockForReadAccess, Type: Inline - RelativeJump at address 0x804FDAF1 hook handler located in [klif.sys]
ntoskrnl.exe-->IoCreateDevice, Type: EAT modification at address 0x80681C70 hook handler located in [unknown_code_page]
ntoskrnl.exe-->IoIsOperationSynchronous, Type: Inline - RelativeJump at address 0x804E8EBA hook handler located in [klif.sys]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF46D9FB4 hook handler located in [unknown_code_page]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF46D9FD4 hook handler located in [unknown_code_page]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF46D9FCC hook handler located in [unknown_code_page]
tcpip.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF46D9E68 hook handler located in [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7694B4C hook handler located in [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7694B1C hook handler located in [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7694B3C hook handler located in [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7694B28 hook handler located in [unknown_code_page]
wanarp.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF7694C08 hook handler located in [unknown_code_page]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

Otestujte na www.virustotal.com
C:\WINDOWS\system32\DRIVERS\ndis.sys
C:\WINDOWS\system32\DRIVERS\ntoskrnl.exe

Používáte daemon nebo alcohol?

Stahněte dr. Web CureIt http://www.viry.cz/forum/viewtopic.php?f=29&t=47721
-udělejte sken , co najde nechte léčit, smazat
-sken může trvat několik hodin
-Soubor/Uložit výsledky - uložíte jako textovy soubor a zkopírujete zde