Malware

Zpráva

Rolandman · #1 Příspěvek od **Rolandman** » 23 led 2010 14:56

Dobrý den,při kontrole počítače ad awarem mi to nachází malware který nejde smazat,vždycky to tam napíše že čištění selhalo,posílam log z rsit

Logfile of random's system information tool 1.06 (written by random/random)
Run by Kuba at 2010-01-23 14:55:25
Systém Microsoft Windows XP Professional Service Pack 3
System drive D: has 455 GB (97%) free of 467 GB
Total RAM: 3327 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55:32, on 23.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\RTHDCPL.EXE
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Common Files\LightScribe\LSSrvc.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\PnkBstrB.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\vVX1000.exe
D:\Program Files\QIP\qip.exe
D:\Documents and Settings\Kuba\Dokumenty\Stažené soubory\RSIT.exe
D:\Program Files\trend micro\Kuba.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - D:\Documents and Settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - D:\Documents and Settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [VX1000] D:\WINDOWS\vVX1000.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - D:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - D:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6163 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
D:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - D:\Documents and Settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-04-28 61440]
"RTHDCPL"=D:\WINDOWS\RTHDCPL.EXE [2008-11-17 17676288]
"Alcmtr"=D:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"avast!"=D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"NeroFilterCheck"=D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2008-07-14 570664]
"VX1000"=D:\WINDOWS\vVX1000.exe [2006-12-06 707360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
D:\WINDOWS\system32\Ati2evxx.dll [2009-04-29 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\wpdshserviceobj.dll [2008-08-08 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\Skype\Plugin Manager\skypePM.exe"="D:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Garena\Garena.exe"="C:\Garena\Garena.exe:*:Enabled:Garena"
"D:\Program Files\QIP\qip.exe"="D:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"D:\Program Files\Hry\Far cry 2\bin\FarCry2.exe"="D:\Program Files\Hry\Far cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2"
"D:\Program Files\Hry\Far cry 2\bin\FC2Launcher.exe"="D:\Program Files\Hry\Far cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"
"D:\Program Files\Hry\Far cry 2\bin\FC2Editor.exe"="D:\Program Files\Hry\Far cry 2\bin\FC2Editor.exe:*:Enabled:Editor"
"D:\WINDOWS\system32\PnkBstrA.exe"="D:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"D:\WINDOWS\system32\PnkBstrB.exe"="D:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-01-23 14:55:26 ----D---- D:\Program Files\trend micro
2010-01-23 14:55:25 ----D---- D:\rsit
2010-01-23 13:29:02 ----RA---- D:\WINDOWS\system32\LCCoin13.dll
2010-01-23 13:29:01 ----RA---- D:\WINDOWS\VX1000.ini
2010-01-23 13:29:01 ----RA---- D:\WINDOWS\system32\cVX1000.dll
2010-01-23 13:29:00 ----RA---- D:\WINDOWS\VX1000.dll
2010-01-23 13:29:00 ----RA---- D:\WINDOWS\vVX1000.exe
2010-01-23 13:29:00 ----RA---- D:\WINDOWS\vVX1000.dll
2010-01-23 13:28:58 ----A---- D:\WINDOWS\system32\vfwwdm32.dll
2010-01-23 13:28:57 ----D---- D:\WINDOWS\LastGood
2010-01-22 18:03:37 ----A---- D:\WINDOWS\system32\XAudio2_1.dll
2010-01-22 18:03:37 ----A---- D:\WINDOWS\system32\XAPOFX1_0.dll
2010-01-22 18:03:36 ----A---- D:\WINDOWS\system32\xactengine3_1.dll
2010-01-22 18:03:36 ----A---- D:\WINDOWS\system32\X3DAudio1_4.dll
2010-01-22 18:03:36 ----A---- D:\WINDOWS\system32\D3DX9_38.dll
2010-01-22 18:03:36 ----A---- D:\WINDOWS\system32\d3dx10_38.dll
2010-01-22 18:03:36 ----A---- D:\WINDOWS\system32\D3DCompiler_38.dll
2010-01-22 18:03:35 ----A---- D:\WINDOWS\system32\XAudio2_0.dll
2010-01-22 18:03:35 ----A---- D:\WINDOWS\system32\xactengine3_0.dll
2010-01-22 18:03:35 ----A---- D:\WINDOWS\system32\X3DAudio1_3.dll
2010-01-22 18:03:34 ----A---- D:\WINDOWS\system32\xactengine2_10.dll
2010-01-22 18:03:34 ----A---- D:\WINDOWS\system32\D3DX9_37.dll
2010-01-22 18:03:34 ----A---- D:\WINDOWS\system32\d3dx10_37.dll
2010-01-22 18:03:34 ----A---- D:\WINDOWS\system32\D3DCompiler_37.dll
2010-01-22 18:03:33 ----A---- D:\WINDOWS\system32\xactengine2_9.dll
2010-01-22 18:03:33 ----A---- D:\WINDOWS\system32\d3dx9_36.dll
2010-01-22 18:03:33 ----A---- D:\WINDOWS\system32\d3dx10_36.dll
2010-01-22 18:03:33 ----A---- D:\WINDOWS\system32\D3DCompiler_36.dll
2010-01-22 18:03:32 ----A---- D:\WINDOWS\system32\xactengine2_8.dll
2010-01-22 18:03:32 ----A---- D:\WINDOWS\system32\X3DAudio1_2.dll
2010-01-22 18:03:32 ----A---- D:\WINDOWS\system32\d3dx9_35.dll
2010-01-22 18:03:32 ----A---- D:\WINDOWS\system32\d3dx10_35.dll
2010-01-22 18:03:32 ----A---- D:\WINDOWS\system32\D3DCompiler_35.dll
2010-01-22 18:03:31 ----A---- D:\WINDOWS\system32\d3dx10_34.dll
2010-01-22 18:03:31 ----A---- D:\WINDOWS\system32\D3DCompiler_34.dll
2010-01-22 18:03:30 ----A---- D:\WINDOWS\system32\xactengine2_7.dll
2010-01-22 18:03:29 ----A---- D:\WINDOWS\system32\d3dx10_33.dll
2010-01-22 18:03:29 ----A---- D:\WINDOWS\system32\D3DCompiler_33.dll
2010-01-22 18:03:27 ----A---- D:\WINDOWS\system32\xactengine2_6.dll
2010-01-22 18:03:27 ----A---- D:\WINDOWS\system32\xactengine2_5.dll
2010-01-22 18:03:27 ----A---- D:\WINDOWS\system32\d3dx9_33.dll
2010-01-22 18:03:27 ----A---- D:\WINDOWS\system32\d3dx9_32.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\xinput1_2.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\xinput1_1.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\xactengine2_4.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\xactengine2_3.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\xactengine2_2.dll
2010-01-22 18:03:26 ----A---- D:\WINDOWS\system32\x3daudio1_1.dll
2010-01-22 18:03:25 ----A---- D:\WINDOWS\system32\xactengine2_1.dll
2010-01-22 18:03:22 ----A---- D:\WINDOWS\system32\xactengine2_0.dll
2010-01-22 18:03:22 ----A---- D:\WINDOWS\system32\x3daudio1_0.dll
2010-01-22 18:03:21 ----A---- D:\WINDOWS\system32\xinput9_1_0.dll
2010-01-22 18:03:21 ----A---- D:\WINDOWS\system32\d3dx9_29.dll
2010-01-22 18:03:21 ----A---- D:\WINDOWS\system32\d3dx9_27.dll
2010-01-22 18:03:21 ----A---- D:\WINDOWS\system32\d3dx9_26.dll
2010-01-22 18:03:21 ----A---- D:\WINDOWS\system32\d3dx9_25.dll
2010-01-22 18:03:20 ----A---- D:\WINDOWS\system32\d3dx9_24.dll
2010-01-22 18:02:55 ----D---- D:\WINDOWS\Logs
2010-01-22 18:02:02 ----A---- D:\WINDOWS\system32\PnkBstrB.exe
2010-01-22 18:02:01 ----D---- D:\WINDOWS\system32\LogFiles
2010-01-22 18:02:01 ----A---- D:\WINDOWS\system32\PnkBstrA.exe
2010-01-22 18:02:01 ----A---- D:\WINDOWS\system32\pbsvc.exe
2010-01-21 21:55:49 ----A---- D:\WINDOWS\system32\d3dx9_34.dll
2010-01-21 21:06:10 ----D---- D:\Documents and Settings\Kuba\Data aplikací\gnupg
2010-01-21 20:04:27 ----D---- D:\Documents and Settings\Kuba\Data aplikací\dvdcss
2010-01-21 17:58:38 ----A---- D:\WINDOWS\system32\lsdelete.exe
2010-01-21 17:37:31 ----D---- D:\Documents and Settings\Kuba\Data aplikací\vlc
2010-01-21 17:34:37 ----D---- D:\Program Files\VideoLAN
2010-01-20 20:53:47 ----D---- D:\Documents and Settings\Kuba\Data aplikací\WinRAR
2010-01-20 20:52:45 ----D---- D:\Program Files\WinRAR
2010-01-19 19:54:41 ----D---- D:\Program Files\Webteh
2010-01-19 19:51:39 ----A---- D:\WINDOWS\NeroDigital.ini
2010-01-19 19:32:05 ----HDC---- D:\WINDOWS\$NtUninstallKB970430$
2010-01-19 19:31:53 ----HDC---- D:\WINDOWS\$NtUninstallKB961118$
2010-01-19 19:31:41 ----HDC---- D:\WINDOWS\$NtUninstallKB971737$
2010-01-19 19:31:37 ----D---- D:\Program Files\MSXML 4.0
2010-01-19 18:50:21 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Macromedia
2010-01-19 18:50:21 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Adobe
2010-01-19 18:45:48 ----SHD---- D:\WINDOWS\ftpcache
2010-01-19 18:30:40 ----D---- D:\WINDOWS\system32\XPSViewer
2010-01-19 18:30:39 ----D---- D:\Program Files\MSBuild
2010-01-19 18:30:38 ----D---- D:\WINDOWS\system32\en-US
2010-01-19 18:30:36 ----D---- D:\Program Files\Reference Assemblies
2010-01-19 18:30:24 ----N---- D:\WINDOWS\system32\xpssvcs.dll
2010-01-19 18:30:24 ----N---- D:\WINDOWS\system32\xpsshhdr.dll
2010-01-19 18:30:24 ----N---- D:\WINDOWS\system32\prntvpt.dll
2010-01-19 18:30:24 ----D---- D:\b5cb3657f4ad4dc082483711ffd5
2010-01-19 18:27:13 ----D---- D:\Program Files\CCleaner
2010-01-19 16:35:14 ----RHD---- D:\Documents and Settings\Kuba\Data aplikací\SecuROM
2010-01-19 16:35:14 ----A---- D:\WINDOWS\system32\CmdLineExt.dll
2010-01-19 16:18:50 ----A---- D:\WINDOWS\system32\xinput1_3.dll
2010-01-19 16:18:50 ----A---- D:\WINDOWS\system32\d3dx9_31.dll
2010-01-19 16:18:00 ----D---- D:\WINDOWS\system32\AGEIA
2010-01-19 16:18:00 ----D---- D:\Program Files\AGEIA Technologies
2010-01-19 16:17:50 ----D---- D:\Program Files\Common Files\Wise Installation Wizard
2010-01-19 16:11:54 ----HDC---- D:\WINDOWS\$NtUninstallKB951376-v2$
2010-01-19 16:11:52 ----HDC---- D:\WINDOWS\$NtUninstallKB952954$
2010-01-19 16:11:49 ----HDC---- D:\WINDOWS\$NtUninstallKB959426$
2010-01-19 16:11:46 ----HDC---- D:\WINDOWS\$NtUninstallKB946648$
2010-01-19 16:11:43 ----HDC---- D:\WINDOWS\$NtUninstallKB956803$
2010-01-19 16:11:41 ----HDC---- D:\WINDOWS\$NtUninstallKB960859$
2010-01-19 16:11:39 ----HDC---- D:\WINDOWS\$NtUninstallKB958869$
2010-01-19 16:11:36 ----HDC---- D:\WINDOWS\$NtUninstallKB976098-v2$
2010-01-19 16:11:33 ----HDC---- D:\WINDOWS\$NtUninstallKB955759$
2010-01-19 16:11:32 ----D---- D:\WINDOWS\system32\KB905474
2010-01-19 16:11:28 ----HDC---- D:\WINDOWS\$NtUninstallKB974318$
2010-01-19 16:11:25 ----HDC---- D:\WINDOWS\$NtUninstallKB951978$
2010-01-19 16:11:22 ----HDC---- D:\WINDOWS\$NtUninstallKB969059$
2010-01-19 16:11:19 ----HDC---- D:\WINDOWS\$NtUninstallKB968816_WM9$
2010-01-19 16:10:47 ----HDC---- D:\WINDOWS\$NtUninstallKB950974$
2010-01-19 16:10:41 ----HDC---- D:\WINDOWS\$NtUninstallKB971657$
2010-01-19 16:10:38 ----HDC---- D:\WINDOWS\$NtUninstallKB971557$
2010-01-19 16:10:36 ----HDC---- D:\WINDOWS\$NtUninstallKB954155_WM9$
2010-01-19 16:10:33 ----HDC---- D:\WINDOWS\$NtUninstallKB960225$
2010-01-19 16:10:31 ----HDC---- D:\WINDOWS\$NtUninstallKB972270$
2010-01-19 16:10:28 ----HDC---- D:\WINDOWS\$NtUninstallKB956744$
2010-01-19 16:10:25 ----HDC---- D:\WINDOWS\$NtUninstallKB974112$
2010-01-19 16:10:21 ----HDC---- D:\WINDOWS\$NtUninstallKB956572$
2010-01-19 16:10:17 ----HDC---- D:\WINDOWS\$NtUninstallKB956844$
2010-01-19 16:10:14 ----HDC---- D:\WINDOWS\$NtUninstallKB961501$
2010-01-19 16:10:11 ----HDC---- D:\WINDOWS\$NtUninstallKB971633$
2010-01-19 16:10:08 ----HDC---- D:\WINDOWS\$NtUninstallKB973869$
2010-01-19 16:10:06 ----HDC---- D:\WINDOWS\$NtUninstallKB975025$
2010-01-19 16:10:02 ----HDC---- D:\WINDOWS\$NtUninstallKB952004$
2010-01-19 16:09:58 ----HDC---- D:\WINDOWS\$NtUninstallKB974571$
2010-01-19 16:09:56 ----HDC---- D:\WINDOWS\$NtUninstallKB973507$
2010-01-19 16:09:53 ----HDC---- D:\WINDOWS\$NtUninstallKB941569$
2010-01-19 16:09:25 ----A---- D:\WINDOWS\system32\MRT.exe
2010-01-19 16:09:20 ----HDC---- D:\WINDOWS\$NtUninstallKB973687$
2010-01-19 16:09:17 ----HDC---- D:\WINDOWS\$NtUninstallKB950762$
2010-01-19 16:09:14 ----HDC---- D:\WINDOWS\$NtUninstallKB957097$
2010-01-19 16:09:12 ----HDC---- D:\WINDOWS\$NtUninstallKB958687$
2010-01-19 16:09:09 ----HDC---- D:\WINDOWS\$NtUninstallKB952287$
2010-01-19 16:09:06 ----HDC---- D:\WINDOWS\$NtUninstallKB973354$
2010-01-19 16:09:03 ----HDC---- D:\WINDOWS\$NtUninstallKB973904$
2010-01-19 16:08:59 ----HDC---- D:\WINDOWS\$NtUninstallKB967715$
2010-01-19 16:08:54 ----HDC---- D:\WINDOWS\$NtUninstallKB973540_WM9$
2010-01-19 16:08:50 ----HDC---- D:\WINDOWS\$NtUninstallKB929399$
2010-01-19 16:08:45 ----HDC---- D:\WINDOWS\$NtUninstallKB939683$
2010-01-19 16:08:35 ----HDC---- D:\WINDOWS\$NtUninstallKB951066$
2010-01-19 16:08:33 ----HDC---- D:\WINDOWS\$NtUninstallKB974392$
2010-01-19 16:08:29 ----HDC---- D:\WINDOWS\$NtUninstallKB954459$
2010-01-19 16:08:26 ----HDC---- D:\WINDOWS\$NtUninstallKB951748$
2010-01-19 16:08:23 ----HDC---- D:\WINDOWS\$NtUninstallKB970238$
2010-01-19 16:08:18 ----HDC---- D:\WINDOWS\$NtUninstallKB971486$
2010-01-19 16:08:16 ----HDC---- D:\WINDOWS\$NtUninstallKB960803$
2010-01-19 16:08:13 ----HDC---- D:\WINDOWS\$NtUninstallKB973815$
2010-01-19 16:08:10 ----HDC---- D:\WINDOWS\$NtUninstallKB973525$
2010-01-19 16:08:07 ----HDC---- D:\WINDOWS\$NtUninstallKB958644$
2010-01-19 16:08:04 ----HDC---- D:\WINDOWS\$NtUninstallKB956802$
2010-01-19 16:07:57 ----HDC---- D:\WINDOWS\$NtUninstallKB954154_WM11$
2010-01-19 16:07:54 ----HDC---- D:\WINDOWS\$NtUninstallKB923561$
2010-01-19 16:07:51 ----HDC---- D:\WINDOWS\$NtUninstallKB971961$
2010-01-19 16:07:48 ----HDC---- D:\WINDOWS\$NtUninstallKB975467$
2010-01-19 16:07:44 ----HDC---- D:\WINDOWS\$NtUninstallKB968389$
2010-01-19 16:07:39 ----HDC---- D:\WINDOWS\$NtUninstallKB969947$
2010-01-19 15:42:48 ----A---- D:\WINDOWS\War3Unin.exe
2010-01-19 15:41:13 ----SHD---- D:\RECYCLER
2010-01-19 15:39:29 ----D---- D:\Program Files\Hry
2010-01-19 15:38:49 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Ahead
2010-01-19 15:38:47 ----D---- D:\Documents and Settings\All Users\Data aplikací\LightScribe
2010-01-19 15:38:25 ----D---- D:\Program Files\Common Files\LightScribe
2010-01-19 15:37:21 ----D---- D:\Program Files\Nero
2010-01-19 15:37:21 ----D---- D:\Program Files\Common Files\Ahead
2010-01-19 15:37:21 ----D---- D:\Documents and Settings\All Users\Data aplikací\Nero
2010-01-19 15:37:12 ----A---- D:\WINDOWS\system32\d3dx9_30.dll
2010-01-19 15:37:12 ----A---- D:\WINDOWS\system32\d3dx9_28.dll
2010-01-19 15:26:17 ----D---- D:\Documents and Settings\Kuba\Data aplikací\skypePM
2010-01-19 15:22:59 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Skype
2010-01-19 15:22:46 ----D---- D:\Program Files\Common Files\Skype
2010-01-19 15:22:44 ----RD---- D:\Program Files\Skype
2010-01-19 15:22:42 ----D---- D:\Documents and Settings\All Users\Data aplikací\Skype
2010-01-19 15:21:52 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Mozilla
2010-01-19 15:21:51 ----D---- D:\Program Files\QIP
2010-01-19 15:21:40 ----D---- D:\Program Files\Mozilla Firefox
2010-01-19 15:10:41 ----D---- D:\WINDOWS\ie7updates
2010-01-19 15:10:02 ----HDC---- D:\WINDOWS\$NtUninstallKB952069_WM9$
2010-01-18 23:30:31 ----A---- D:\WINDOWS\system32\h323log.txt
2010-01-18 23:29:05 ----A---- D:\WINDOWS\system32\hidserv.dll
2010-01-18 23:27:49 ----A---- D:\WINDOWS\system32\usbui.dll
2010-01-18 23:26:57 ----SHD---- D:\WINDOWS\Installer
2010-01-18 23:26:57 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2010-01-18 23:26:56 ----D---- D:\Program Files\Common Files\ODBC
2010-01-18 23:26:56 ----A---- D:\WINDOWS\ODBCINST.INI
2010-01-18 23:26:54 ----D---- D:\Program Files\Common Files\SpeechEngines
2010-01-18 23:26:53 ----RD---- D:\Program Files
2010-01-18 23:26:53 ----D---- D:\Program Files\Common Files\Microsoft Shared
2010-01-18 23:26:53 ----D---- D:\Program Files\Common Files
2010-01-18 23:26:51 ----RA---- D:\WINDOWS\system32\kbdtuq.dll
2010-01-18 23:26:51 ----RA---- D:\WINDOWS\system32\kbdtuf.dll
2010-01-18 23:26:51 ----RA---- D:\WINDOWS\system32\kbdazel.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdycc.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbduzb.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdur.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdtat.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdru1.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdru.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdmon.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdkyr.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdkaz.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdbu.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdblr.dll
2010-01-18 23:26:49 ----RA---- D:\WINDOWS\system32\kbdaze.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhept.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhela3.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhela2.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhe319.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhe220.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdhe.dll
2010-01-18 23:26:47 ----RA---- D:\WINDOWS\system32\kbdgkl.dll
2010-01-18 23:26:46 ----RA---- D:\WINDOWS\system32\kbdlv1.dll
2010-01-18 23:26:46 ----RA---- D:\WINDOWS\system32\kbdlv.dll
2010-01-18 23:26:46 ----RA---- D:\WINDOWS\system32\kbdlt1.dll
2010-01-18 23:26:46 ----RA---- D:\WINDOWS\system32\kbdlt.dll
2010-01-18 23:26:46 ----RA---- D:\WINDOWS\system32\kbdest.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdycl.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdsl1.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdsl.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdro.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdpl1.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdpl.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdhu1.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdhu.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\kbdcr.dll
2010-01-18 23:26:42 ----RA---- D:\WINDOWS\system32\KBDAL.DLL
2010-01-18 23:26:40 ----A---- D:\WINDOWS\system32\spxcoins.dll
2010-01-18 23:26:40 ----A---- D:\WINDOWS\system32\irclass.dll
2010-01-18 23:26:40 ----A---- D:\WINDOWS\system32\EqnClass.Dll
2010-01-18 23:26:40 ----A---- D:\WINDOWS\system32\dgsetup.dll
2010-01-18 23:26:40 ----A---- D:\WINDOWS\system32\dgrpsetu.dll
2010-01-18 23:26:38 ----N---- D:\WINDOWS\system32\CONFIG.TMP
2010-01-18 23:26:38 ----A---- D:\WINDOWS\TASKMAN.EXE
2010-01-18 23:26:37 ----A---- D:\WINDOWS\system32\storprop.dll
2010-01-18 23:26:37 ----A---- D:\WINDOWS\system32\batt.dll
2010-01-18 23:26:37 ----A---- D:\WINDOWS\NOTEPAD.EXE
2010-01-18 23:26:31 ----ASH---- D:\Documents and Settings\All Users\Data aplikací\desktop.ini
2010-01-18 23:25:13 ----RA---- D:\WINDOWS\SET8.tmp
2010-01-18 23:25:11 ----RA---- D:\WINDOWS\SET4.tmp
2010-01-18 23:25:09 ----RA---- D:\WINDOWS\SET3.tmp
2010-01-18 23:25:05 ----D---- D:\WINDOWS\system32\CatRoot2
2010-01-18 23:25:05 ----D---- D:\WINDOWS\system32\CatRoot
2010-01-18 23:24:59 ----SD---- D:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-01-18 23:24:41 ----SHD---- D:\System Volume Information
2010-01-18 23:24:41 ----D---- D:\Documents and Settings
2010-01-18 23:19:26 ----SD---- D:\WINDOWS\Downloaded Program Files
2010-01-18 23:19:26 ----RSHDC---- D:\WINDOWS\system32\dllcache
2010-01-18 23:19:26 ----RSD---- D:\WINDOWS\Fonts
2010-01-18 23:19:26 ----RD---- D:\WINDOWS\Web
2010-01-18 23:19:26 ----HD---- D:\WINDOWS\inf
2010-01-18 23:19:26 ----D---- D:\WINDOWS\WinSxS
2010-01-18 23:19:26 ----D---- D:\WINDOWS\WBEM
2010-01-18 23:19:26 ----D---- D:\WINDOWS\twain_32
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Temp
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\wins
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\wbem
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\usmt
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\spool
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\ShellExt
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\Setup
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\ras
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\oobe
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\npp
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\mui
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\inetsrv
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\IME
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\icsxml
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\ias
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\export
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\drivers
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\dhcp
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\cs-cz
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\cs
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\config
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\3com_dmi
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\3076
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\2052
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1054
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1042
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1041
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1037
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1033
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1031
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1029
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1028
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32\1025
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system32
2010-01-18 23:19:26 ----D---- D:\WINDOWS\system
2010-01-18 23:19:26 ----D---- D:\WINDOWS\security
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Resources
2010-01-18 23:19:26 ----D---- D:\WINDOWS\repair
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Provisioning
2010-01-18 23:19:26 ----D---- D:\WINDOWS\pchealth
2010-01-18 23:19:26 ----D---- D:\WINDOWS\PeerNet
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Offline Web Pages
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Network Diagnostic
2010-01-18 23:19:26 ----D---- D:\WINDOWS\mui
2010-01-18 23:19:26 ----D---- D:\WINDOWS\msapps
2010-01-18 23:19:26 ----D---- D:\WINDOWS\msagent
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Media
2010-01-18 23:19:26 ----D---- D:\WINDOWS\L2Schemas
2010-01-18 23:19:26 ----D---- D:\WINDOWS\java
2010-01-18 23:19:26 ----D---- D:\WINDOWS\ime
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Help
2010-01-18 23:19:26 ----D---- D:\WINDOWS\ehome
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Driver Cache
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Debug
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Cursors
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Connection Wizard
2010-01-18 23:19:26 ----D---- D:\WINDOWS\Config
2010-01-18 23:19:26 ----D---- D:\WINDOWS\AppPatch
2010-01-18 23:19:26 ----D---- D:\WINDOWS\addins
2010-01-18 23:19:26 ----D---- D:\WINDOWS
2010-01-18 23:12:37 ----D---- D:\WINDOWS\system32\PreInstall
2010-01-18 23:12:36 ----N---- D:\WINDOWS\system32\spmsg.dll
2010-01-18 23:12:36 ----A---- D:\WINDOWS\system32\spupdsvc.exe
2010-01-18 23:12:35 ----HDC---- D:\WINDOWS\$NtUninstallKB898461$
2010-01-18 23:12:35 ----HD---- D:\WINDOWS\$hf_mig$
2010-01-18 23:05:02 ----RA---- D:\WINDOWS\system32\AsIO.dll
2010-01-18 23:05:00 ----D---- D:\Program Files\ASUS
2010-01-18 23:03:23 ----D---- D:\WINDOWS\system32\SoftwareDistribution
2010-01-18 23:03:02 ----D---- D:\WINDOWS\system32\Atheros_L1e
2010-01-18 23:00:50 ----DC---- D:\WINDOWS\system32\DRVSTORE
2010-01-18 23:00:31 ----HDC---- D:\Documents and Settings\All Users\Data aplikací\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2010-01-18 23:00:27 ----D---- D:\Program Files\Lavasoft
2010-01-18 23:00:27 ----D---- D:\Documents and Settings\All Users\Data aplikací\Lavasoft
2010-01-18 22:55:28 ----A---- D:\WINDOWS\system32\MSVCR71.dll
2010-01-18 22:55:28 ----A---- D:\WINDOWS\system32\MSVCP71.dll
2010-01-18 22:55:28 ----A---- D:\WINDOWS\system32\MFC71.dll
2010-01-18 22:55:28 ----A---- D:\WINDOWS\system32\aswBoot.exe
2010-01-18 22:55:26 ----D---- D:\Program Files\Alwil Software
2010-01-18 22:53:19 ----D---- D:\WINDOWS\system32\Lang
2010-01-18 22:51:48 ----D---- D:\WINDOWS\system32\RTCOM
2010-01-18 22:51:40 ----A---- D:\WINDOWS\vncutil.exe
2010-01-18 22:51:40 ----A---- D:\WINDOWS\SOUNDMAN.EXE
2010-01-18 22:51:39 ----A---- D:\WINDOWS\system32\RtkCoInstXP.dll
2010-01-18 22:51:39 ----A---- D:\WINDOWS\SkyTel.exe
2010-01-18 22:51:39 ----A---- D:\WINDOWS\RtlUpd.exe
2010-01-18 22:51:39 ----A---- D:\WINDOWS\RtkAudioService.exe
2010-01-18 22:51:38 ----A---- D:\WINDOWS\RTLCPL.EXE
2010-01-18 22:51:30 ----A---- D:\WINDOWS\RTHDCPL.EXE
2010-01-18 22:51:29 ----A---- D:\WINDOWS\MicCal.exe
2010-01-18 22:51:26 ----A---- D:\WINDOWS\ALCMTR.EXE
2010-01-18 22:51:25 ----A---- D:\WINDOWS\ALCWZRD.EXE
2010-01-18 22:51:24 ----D---- D:\Program Files\Realtek
2010-01-18 22:51:20 ----R---- D:\WINDOWS\RtlExUpd.dll
2010-01-18 22:50:50 ----A---- D:\WINDOWS\Ascd_tmp.ini
2010-01-18 22:49:53 ----D---- D:\Documents and Settings\Kuba\Data aplikací\ATI
2010-01-18 22:49:53 ----D---- D:\Documents and Settings\All Users\Data aplikací\ATI
2010-01-18 22:46:37 ----D---- D:\Program Files\Common Files\ATI Technologies
2010-01-18 22:46:22 ----D---- D:\WINDOWS\RegisteredPackages
2010-01-18 22:46:14 ----A---- D:\WINDOWS\system32\psisdecd.dll
2010-01-18 22:46:13 ----A---- D:\WINDOWS\system32\dxdllreg.exe
2010-01-18 22:45:05 ----RSD---- D:\WINDOWS\assembly
2010-01-18 22:44:56 ----D---- D:\WINDOWS\Microsoft.NET
2010-01-18 22:43:31 ----A---- D:\WINDOWS\system32\ksuser.dll
2010-01-18 22:43:02 ----N---- D:\WINDOWS\system32\ati2sgag.exe
2010-01-18 22:43:00 ----RA---- D:\WINDOWS\system32\atiiiexx.dll
2010-01-18 22:42:56 ----RA---- D:\WINDOWS\system32\ATIDEMGX.dll
2010-01-18 22:42:36 ----D---- D:\Program Files\ATI Technologies
2010-01-18 22:42:35 ----HD---- D:\Program Files\InstallShield Installation Information
2010-01-18 22:42:10 ----D---- D:\Program Files\Common Files\InstallShield
2010-01-18 22:38:35 ----D---- D:\Documents and Settings\Kuba\Data aplikací\Identities
2010-01-18 22:38:34 ----HD---- D:\Program Files\Uninstall Information
2010-01-18 22:38:30 ----SD---- D:\Documents and Settings\Kuba\Data aplikací\Microsoft
2010-01-18 22:38:30 ----ASH---- D:\Documents and Settings\Kuba\Data aplikací\desktop.ini
2010-01-18 22:37:19 ----D---- D:\WINDOWS\SoftwareDistribution
2010-01-18 22:37:17 ----SD---- D:\WINDOWS\system32\Microsoft
2010-01-18 22:37:17 ----D---- D:\WINDOWS\Prefetch
2010-01-18 22:37:17 ----A---- D:\WINDOWS\SchedLgU.Txt
2010-01-18 22:34:55 ----D---- D:\WINDOWS\system32\xircom
2010-01-18 22:34:55 ----D---- D:\Program Files\xerox
2010-01-18 22:34:55 ----D---- D:\Program Files\microsoft frontpage
2010-01-18 22:34:37 ----A---- D:\WINDOWS\control.ini
2010-01-18 22:34:25 ----A---- D:\WINDOWS\system32\mapi32.dll
2010-01-18 22:33:55 ----RAH---- D:\WINDOWS\system32\logonui.exe.manifest
2010-01-18 22:33:53 ----RAH---- D:\WINDOWS\system32\cdplayer.exe.manifest
2010-01-18 22:33:50 ----HD---- D:\Program Files\WindowsUpdate
2010-01-18 22:33:48 ----D---- D:\Program Files\Online Services
2010-01-18 22:33:38 ----D---- D:\WINDOWS\system32\DirectX
2010-01-18 22:33:31 ----A---- D:\WINDOWS\system32\atrace.dll
2010-01-18 22:33:29 ----A---- D:\WINDOWS\system32\desktop.ini
2010-01-18 22:33:29 ----A---- D:\WINDOWS\desktop.ini
2010-01-18 22:33:23 ----A---- D:\WINDOWS\system32\nmevtmsg.dll
2010-01-18 22:33:22 ----A---- D:\WINDOWS\system32\acctres.dll
2010-01-18 22:33:21 ----D---- D:\Program Files\Common Files\Services
2010-01-18 22:33:19 ----SD---- D:\WINDOWS\Tasks
2010-01-18 22:33:19 ----A---- D:\WINDOWS\system32\icfgnt5.dll
2010-01-18 22:33:18 ----D---- D:\Program Files\Common Files\MSSoap
2010-01-18 22:33:15 ----D---- D:\WINDOWS\srchasst
2010-01-18 22:33:14 ----D---- D:\WINDOWS\system32\Macromed
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuweb.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wups.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wucltui.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuauserv.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuaueng1.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuaueng.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuauclt1.exe
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuauclt.exe
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\wuapi.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\bitsprx4.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\bitsprx3.dll
2010-01-18 22:33:12 ----A---- D:\WINDOWS\system32\bitsprx2.dll
2010-01-18 22:33:11 ----A---- D:\WINDOWS\system32\qmgrprxy.dll
2010-01-18 22:33:11 ----A---- D:\WINDOWS\system32\qmgr.dll
2010-01-18 22:33:08 ----D---- D:\Program Files\Movie Maker
2010-01-18 22:32:54 ----A---- D:\WINDOWS\system32\safrslv.dll
2010-01-18 22:32:54 ----A---- D:\WINDOWS\system32\safrdm.dll
2010-01-18 22:32:54 ----A---- D:\WINDOWS\system32\safrcdlg.dll
2010-01-18 22:32:54 ----A---- D:\WINDOWS\system32\racpldlg.dll
2010-01-18 22:32:51 ----A---- D:\WINDOWS\system32\fltMc.exe
2010-01-18 22:32:51 ----A---- D:\WINDOWS\system32\fltlib.dll
2010-01-18 22:32:50 ----D---- D:\WINDOWS\system32\Restore
2010-01-18 22:32:50 ----A---- D:\WINDOWS\system32\srsvc.dll
2010-01-18 22:32:50 ----A---- D:\WINDOWS\system32\srrstr.dll
2010-01-18 22:32:50 ----A---- D:\WINDOWS\system32\srclient.dll
2010-01-18 22:32:50 ----A---- D:\WINDOWS\system32\isrdbg32.dll
2010-01-18 22:32:50 ----A---- D:\WINDOWS\system32\ils.dll
2010-01-18 22:32:49 ----A---- D:\WINDOWS\system32\nmmkcert.dll
2010-01-18 22:32:49 ----A---- D:\WINDOWS\system32\msconf.dll
2010-01-18 22:32:49 ----A---- D:\WINDOWS\system32\mnmsrvc.exe
2010-01-18 22:32:49 ----A---- D:\WINDOWS\system32\mnmdd.dll
2010-01-18 22:32:47 ----D---- D:\Program Files\NetMeeting
2010-01-18 22:32:47 ----A---- D:\WINDOWS\system32\msoert2.dll
2010-01-18 22:32:46 ----A---- D:\WINDOWS\system32\msoeacct.dll
2010-01-18 22:32:46 ----A---- D:\WINDOWS\system32\inetres.dll
2010-01-18 22:32:45 ----A---- D:\WINDOWS\system32\inetcomm.dll
2010-01-18 22:32:44 ----D---- D:\Program Files\Outlook Express
2010-01-18 22:32:44 ----A---- D:\WINDOWS\system32\schedsvc.dll
2010-01-18 22:32:44 ----A---- D:\WINDOWS\system32\mstinit.exe
2010-01-18 22:32:44 ----A---- D:\WINDOWS\system32\mstask.dll
2010-01-18 22:32:43 ----A---- D:\WINDOWS\system32\isign32.dll
2010-01-18 22:32:43 ----A---- D:\WINDOWS\system32\inetcfg.dll
2010-01-18 22:32:43 ----A---- D:\WINDOWS\system32\icwphbk.dll
2010-01-18 22:32:43 ----A---- D:\WINDOWS\system32\icwdial.dll
2010-01-18 22:32:39 ----D---- D:\Program Files\Common Files\System
2010-01-18 22:32:38 ----D---- D:\Program Files\Internet Explorer
2010-01-18 22:32:12 ----D---- D:\Program Files\ComPlus Applications
2010-01-18 22:32:10 ----A---- D:\WINDOWS\vbaddin.ini
2010-01-18 22:32:10 ----A---- D:\WINDOWS\vb.ini
2010-01-18 22:32:07 ----D---- D:\WINDOWS\Registration
2010-01-18 22:31:53 ----D---- D:\Program Files\Windows Media Connect 2
2010-01-18 22:31:52 ----D---- D:\Program Files\Windows Media Player
2010-01-18 22:31:51 ----D---- D:\Program Files\Messenger
2010-01-18 22:31:48 ----D---- D:\Program Files\MSN Gaming Zone
2010-01-18 22:31:48 ----A---- D:\WINDOWS\system32\write.exe
2010-01-18 22:31:42 ----A---- D:\WINDOWS\system32\sndvol32.exe
2010-01-18 22:31:41 ----A---- D:\WINDOWS\system32\winchat.exe
2010-01-18 22:31:41 ----A---- D:\WINDOWS\system32\hticons.dll
2010-01-18 22:31:41 ----A---- D:\WINDOWS\system32\avwav.dll
2010-01-18 22:31:41 ----A---- D:\WINDOWS\system32\avtapi.dll
2010-01-18 22:31:41 ----A---- D:\WINDOWS\system32\avmeter.dll
2010-01-18 22:31:35 ----A---- D:\WINDOWS\system32\sol.exe
2010-01-18 22:31:35 ----A---- D:\WINDOWS\system32\charmap.exe
2010-01-18 22:31:35 ----A---- D:\WINDOWS\system32\getuname.dll
2010-01-18 22:31:35 ----A---- D:\WINDOWS\system32\calc.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\winmine.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\usrlogon.cmd
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\tsshutdn.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\tslabels.ini
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\tskill.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\tsdiscon.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\tscon.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\shadow.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\reset.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\mshearts.exe
2010-01-18 22:31:34 ----A---- D:\WINDOWS\system32\freecell.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\rwinsta.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\regini.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\rdpcfgex.dll
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\qwinsta.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\qappsrv.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\msg.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\msdtcprf.ini
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\logoff.exe
2010-01-18 22:31:33 ----A---- D:\WINDOWS\system32\cdmodem.dll
2010-01-18 22:31:28 ----A---- D:\WINDOWS\system32\wmimgmt.msc
2010-01-18 22:31:28 ----A---- D:\WINDOWS\system32\accwiz.exe
2010-01-18 22:31:27 ----D---- D:\Program Files\Windows NT
2010-01-18 22:31:27 ----A---- D:\WINDOWS\system32\sndrec32.exe
2010-01-18 22:31:27 ----A---- D:\WINDOWS\system32\mplay32.exe
2010-01-18 22:31:27 ----A---- D:\WINDOWS\system32\hypertrm.dll
2010-01-18 22:31:26 ----A---- D:\WINDOWS\system32\spider.exe
2010-01-18 22:31:26 ----A---- D:\WINDOWS\system32\mspaint.exe
2010-01-18 22:31:26 ----A---- D:\WINDOWS\system32\clipbrd.exe
2010-01-18 22:31:25 ----A---- D:\WINDOWS\system32\tsgqec.dll
2010-01-18 22:31:25 ----A---- D:\WINDOWS\system32\tscfgwmi.dll
2010-01-18 22:31:25 ----A---- D:\WINDOWS\system32\rhttpaa.dll
2010-01-18 22:31:25 ----A---- D:\WINDOWS\system32\aaclient.dll
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\sessmgr.exe
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\remotepg.dll
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\rdshost.exe
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\rdsaddin.exe
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\rdchost.dll
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\mstscax.dll
2010-01-18 22:31:24 ----A---- D:\WINDOWS\system32\mstsc.exe
2010-01-18 22:31:23 ----D---- D:\WINDOWS\system32\MsDtc
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\termsrv.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\rdpwsx.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\rdpsnd.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\rdpclip.exe
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\qprocess.exe
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\mtxoci.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\msdtcuiu.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\icaapi.dll
2010-01-18 22:31:23 ----A---- D:\WINDOWS\system32\cfgbkend.dll
2010-01-18 22:31:22 ----A---- D:\WINDOWS\system32\xolehlp.dll
2010-01-18 22:31:22 ----A---- D:\WINDOWS\system32\msdtctm.dll
2010-01-18 22:31:22 ----A---- D:\WINDOWS\system32\msdtcprx.dll
2010-01-18 22:31:22 ----A---- D:\WINDOWS\system32\msdtclog.dll
2010-01-18 22:31:22 ----A---- D:\WINDOWS\system32\msdtc.exe
2010-01-18 22:31:21 ----D---- D:\WINDOWS\system32\Com
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\stclient.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\mtxlegih.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\mtxex.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\mtxdm.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\dcomcnfg.exe
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\comrepl.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\comaddin.dll
2010-01-18 22:31:21 ----A---- D:\WINDOWS\system32\colbact.dll
2010-01-18 22:31:20 ----A---- D:\WINDOWS\system32\comsvcs.dll
2010-01-18 22:31:20 ----A---- D:\WINDOWS\system32\clbcatex.dll
2010-01-18 22:31:20 ----A---- D:\WINDOWS\system32\catsrvut.dll
2010-01-18 22:31:20 ----A---- D:\WINDOWS\system32\catsrvps.dll
2010-01-18 22:31:20 ----A---- D:\WINDOWS\system32\catsrv.dll
2010-01-18 22:31:19 ----A---- D:\WINDOWS\system32\comuid.dll
2010-01-18 22:31:19 ----A---- D:\WINDOWS\system32\comsnap.dll
2010-01-18 22:31:19 ----A---- D:\WINDOWS\system32\clbcatq.dll
2010-01-18 22:31:14 ----A---- D:\WINDOWS\system32\servdeps.dll
2010-01-18 22:31:14 ----A---- D:\WINDOWS\system32\mmfutil.dll
2010-01-18 22:31:14 ----A---- D:\WINDOWS\system32\licwmi.dll
2010-01-18 22:31:14 ----A---- D:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2010-01-18 23:26:52 ----A---- D:\WINDOWS\system.ini
2010-01-18 22:34:35 ----A---- D:\WINDOWS\win.ini
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\wininet.dll
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\webcheck.dll
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\urlmon.dll
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\url.dll
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\pngfilt.dll
2010-01-05 10:58:03 ----A---- D:\WINDOWS\system32\occache.dll
2010-01-05 10:58:02 ----A---- D:\WINDOWS\system32\mstime.dll
2010-01-05 10:58:02 ----A---- D:\WINDOWS\system32\msrating.dll
2010-01-05 10:58:02 ----A---- D:\WINDOWS\system32\mshtmled.dll
2010-01-05 10:58:02 ----A---- D:\WINDOWS\system32\mshtml.dll
2010-01-05 10:58:01 ----A---- D:\WINDOWS\system32\msfeedsbs.dll
2010-01-05 10:58:01 ----A---- D:\WINDOWS\system32\msfeeds.dll
2010-01-05 10:58:00 ----A---- D:\WINDOWS\system32\jsproxy.dll
2010-01-05 10:58:00 ----A---- D:\WINDOWS\system32\iertutil.dll
2010-01-05 10:58:00 ----A---- D:\WINDOWS\system32\iernonce.dll
2010-01-05 10:58:00 ----A---- D:\WINDOWS\system32\iepeers.dll
2010-01-05 10:58:00 ----A---- D:\WINDOWS\system32\ieframe.dll
2010-01-05 10:57:59 ----A---- D:\WINDOWS\system32\ieencode.dll
2010-01-05 10:57:59 ----A---- D:\WINDOWS\system32\iedkcs32.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\ieapfltr.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\ieaksie.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\ieakeng.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\icardie.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\extmgr.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\dxtrans.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\dxtmsft.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\corpol.dll
2010-01-05 10:57:58 ----A---- D:\WINDOWS\system32\advpack.dll
2009-12-31 16:32:19 ----A---- D:\WINDOWS\system32\ieudinit.exe
2009-12-31 16:32:19 ----A---- D:\WINDOWS\system32\ie4uinit.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; D:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AsIO;AsIO; D:\WINDOWS\system32\drivers\AsIO.sys [2007-12-17 12400]
R1 aswSP;avast! Self Protection; D:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; D:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 intelppm;Řadič procesoru Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; D:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 aswRdr;aswRdr; D:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ati2mtag;ati2mtag; D:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-04-29 3643904]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; D:\WINDOWS\system32\drivers\AtiHdmi.sys [2009-04-01 93184]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-11-25 4952576]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; D:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-09-23 38400]
R3 mouhid;Ovladač myši standardu HID; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; D:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NdisIP;Microsoft TV/Video Connection; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
R3 usbaudio;Ovladač zvukové karty USB (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VX1000;VX-1000; D:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 1963680]
S3 CCDECODE;Dekodér Closed Caption; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 GarenaPEngine;GarenaPEngine; \??\D:\DOCUME~1\Kuba\LOCALS~1\Temp\HCA47.tmp []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; D:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 SLIP;BDA Slip De-Framer; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;World Standard Teletext Codec; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-08-08 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-08-08 82944]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; D:\WINDOWS\system32\Ati2evxx.exe [2009-04-29 602112]
R2 avast! Antivirus;avast! Antivirus; D:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; D:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-07-30 73728]
R2 PnkBstrA;PnkBstrA; D:\WINDOWS\system32\PnkBstrA.exe [2010-01-22 66872]
R2 PnkBstrB;PnkBstrB; D:\WINDOWS\system32\PnkBstrB.exe [2010-01-22 107832]
R3 avast! Mail Scanner;avast! Mail Scanner; D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; D:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 ATI Smart;ATI Smart; D:\WINDOWS\system32\ati2sgag.exe [2009-04-28 593920]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-09-24 1169232]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; d:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; d:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; D:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; d:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Unlimited_Killer

Jakási breberka tam je, pustíme na ni ComboFix.

~~~

Vložte sem log z ComboFix.

Stáhněte a uložte na Plochu ComboFix, poté ho spusťte s administrátorským oprávněním.
Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'. Budete také dotázán na instalaci konzole pro zotavení, klikněte na 'Ano'.
Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat. Váš PC bude pravděpodobně restartován, tak se toho neděste. Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
Po skončení skenu na Vás vypadne log, který vkopírujete sem.

Rolandman · #3 Příspěvek od **Rolandman** » 24 led 2010 08:57

Tady je log z Combofixu

ComboFix 10-01-23.03 - Kuba 24.01.2010 8:49.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2840 [GMT 1:00]
Spuštěný z: d:\documents and settings\Kuba\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100123-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-24 do 2010-01-24 )))))))))))))))))))))))))))))))
.

2010-01-23 19:52 . 2010-01-24 07:43 -------- d-----w- d:\program files\Steam
2010-01-23 15:40 . 2010-01-23 15:40 -------- d-----w- d:\program files\Cenega Czech
2010-01-23 13:55 . 2010-01-23 13:55 -------- d-----w- d:\program files\trend micro
2010-01-23 13:55 . 2010-01-23 13:55 -------- d-----w- D:\rsit
2010-01-23 12:30 . 2008-04-13 23:15 60032 -c--a-w- d:\windows\system32\dllcache\usbaudio.sys
2010-01-23 12:30 . 2008-04-13 23:15 60032 ----a-w- d:\windows\system32\drivers\USBAUDIO.sys
2010-01-23 12:29 . 2006-12-05 23:38 199456 ----a-r- d:\windows\system32\LCCoin13.dll
2010-01-23 12:29 . 2006-12-05 23:37 183072 ----a-r- d:\windows\system32\cVX1000.dll
2010-01-23 12:29 . 2006-12-05 23:38 707360 ----a-r- d:\windows\vVX1000.exe
2010-01-23 12:29 . 2006-12-05 23:38 473888 ----a-r- d:\windows\vVX1000.dll
2010-01-23 12:29 . 2006-12-05 23:37 109344 ----a-r- d:\windows\VX1000.dll
2010-01-23 12:28 . 2006-12-05 23:39 1963680 ----a-r- d:\windows\system32\drivers\VX1000.sys
2010-01-23 12:28 . 2008-04-14 07:52 54272 -c--a-w- d:\windows\system32\dllcache\vfwwdm32.dll
2010-01-23 12:28 . 2008-04-14 07:52 54272 ----a-w- d:\windows\system32\vfwwdm32.dll
2010-01-22 17:02 . 2010-01-22 17:02 -------- d-----w- d:\windows\Logs
2010-01-22 17:02 . 2010-01-22 17:02 22328 ----a-w- d:\windows\system32\drivers\PnkBstrK.sys
2010-01-22 17:02 . 2010-01-22 17:02 107832 ----a-w- d:\windows\system32\PnkBstrB.exe
2010-01-22 17:02 . 2010-01-22 17:02 66872 ----a-w- d:\windows\system32\PnkBstrA.exe
2010-01-22 17:02 . 2010-01-22 17:02 2250024 ----a-w- d:\windows\system32\pbsvc.exe
2010-01-22 17:02 . 2010-01-22 17:02 -------- d-----w- d:\windows\system32\LogFiles
2010-01-21 20:55 . 2007-05-16 15:45 3497832 ----a-w- d:\windows\system32\d3dx9_34.dll
2010-01-21 16:58 . 2009-09-03 09:17 15688 ----a-w- d:\windows\system32\lsdelete.exe
2010-01-21 16:34 . 2010-01-21 16:34 -------- d-----w- d:\program files\VideoLAN
2010-01-19 18:54 . 2010-01-21 16:37 -------- d-----w- d:\program files\Webteh
2010-01-19 18:31 . 2010-01-19 18:31 -------- d-----w- d:\program files\MSXML 4.0
2010-01-19 17:45 . 2010-01-19 17:45 -------- d-sh--w- d:\windows\ftpcache
2010-01-19 17:27 . 2010-01-19 17:27 -------- d-----w- d:\program files\CCleaner
2010-01-19 15:35 . 2010-01-22 17:06 107888 ----a-w- d:\windows\system32\CmdLineExt.dll
2010-01-19 15:18 . 2007-04-04 17:53 81768 ----a-w- d:\windows\system32\xinput1_3.dll
2010-01-19 15:18 . 2006-09-28 15:05 2414360 ----a-w- d:\windows\system32\d3dx9_31.dll
2010-01-19 15:18 . 2010-01-19 15:18 -------- d-----w- d:\program files\AGEIA Technologies
2010-01-19 15:18 . 2010-01-19 15:18 -------- d-----w- d:\windows\system32\AGEIA
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2010-01-19 14:42 . 2010-01-23 09:23 111799 ----a-w- d:\windows\War3Unin.dat
2010-01-19 14:42 . 2010-01-19 14:46 2829 ----a-w- d:\windows\War3Unin.pif
2010-01-19 14:42 . 2010-01-19 14:46 139264 ----a-w- d:\windows\War3Unin.exe
2010-01-19 14:39 . 2010-01-23 19:43 -------- d-----w- d:\program files\Hry
2010-01-19 14:38 . 2010-01-19 14:38 -------- d-----w- d:\program files\Common Files\LightScribe
2010-01-19 14:37 . 2010-01-19 14:37 -------- d-----w- d:\program files\Common Files\Ahead
2010-01-19 14:37 . 2010-01-19 14:37 -------- d-----w- d:\program files\Nero
2010-01-19 14:26 . 2010-01-19 14:26 56 ---ha-w- d:\windows\system32\ezsidmv.dat
2010-01-19 14:22 . 2010-01-19 14:22 -------- d-----w- d:\program files\Common Files\Skype
2010-01-19 14:22 . 2010-01-19 14:22 -------- d-----r- d:\program files\Skype
2010-01-19 14:21 . 2010-01-19 14:22 -------- d-----w- d:\program files\QIP
2010-01-19 14:12 . 2008-06-14 17:35 272128 -c----w- d:\windows\system32\dllcache\bthport.sys
2010-01-19 14:12 . 2008-06-14 17:35 272128 ------w- d:\windows\system32\drivers\bthport.sys
2010-01-19 14:11 . 2008-10-24 11:21 455296 -c----w- d:\windows\system32\dllcache\mrxsmb.sys
2010-01-19 14:11 . 2009-08-04 17:29 2147328 -c----w- d:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-19 14:11 . 2009-08-04 17:29 2068224 -c----w- d:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-19 14:11 . 2009-08-04 17:29 2025984 -c----w- d:\windows\system32\dllcache\ntkrpamp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-24 07:43 . 2001-10-25 12:00 78052 ----a-w- d:\windows\system32\perfc005.dat
2010-01-24 07:43 . 2001-10-25 12:00 429024 ----a-w- d:\windows\system32\perfh005.dat
2010-01-23 21:46 . 2010-01-18 21:42 -------- d--h--w- d:\program files\InstallShield Installation Information
2010-01-19 17:46 . 2010-01-18 21:42 -------- d-----w- d:\program files\Common Files\InstallShield
2010-01-19 17:30 . 2010-01-19 17:30 -------- d-----w- d:\program files\MSBuild
2010-01-19 17:30 . 2010-01-19 17:30 -------- d-----w- d:\program files\Reference Assemblies
2010-01-19 14:33 . 2010-01-18 22:05 -------- d-----w- d:\program files\ASUS
2010-01-18 22:00 . 2010-01-18 22:00 -------- d-----w- d:\program files\Lavasoft
2010-01-18 21:55 . 2010-01-18 21:55 -------- d-----w- d:\program files\Alwil Software
2010-01-18 21:51 . 2010-01-18 21:51 -------- d-----w- d:\program files\Realtek
2010-01-18 21:49 . 2010-01-18 21:49 0 ----a-w- d:\windows\ativpsrm.bin
2010-01-18 21:47 . 2010-01-18 21:42 -------- d-----w- d:\program files\ATI Technologies
2010-01-18 21:46 . 2010-01-18 21:46 -------- d-----w- d:\program files\Common Files\ATI Technologies
2010-01-18 21:34 . 2010-01-18 21:34 -------- d-----w- d:\program files\microsoft frontpage
2010-01-18 21:34 . 2010-01-18 21:34 8738 ----a-w- d:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-18 21:34 . 2010-01-18 21:34 2112 ----a-w- d:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-18 21:34 . 2010-01-18 21:34 86327 ----a-w- d:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-18 21:32 . 2010-01-18 21:32 21812 ----a-w- d:\windows\system32\emptyregdb.dat
2010-01-18 21:31 . 2010-01-18 21:31 -------- d-----w- d:\program files\Windows Media Connect 2
2010-01-05 09:58 . 2008-08-08 15:43 832512 ----a-w- d:\windows\system32\wininet.dll
2010-01-05 09:57 . 2008-08-08 15:43 78336 ----a-w- d:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2008-08-08 15:43 17408 ----a-w- d:\windows\system32\corpol.dll
2009-11-24 23:54 . 2010-01-18 21:55 1280480 ----a-w- d:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2010-01-18 21:55 93424 ----a-w- d:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2010-01-18 21:55 48560 ----a-w- d:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2010-01-18 21:55 23120 ----a-w- d:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2010-01-18 21:55 27408 ----a-w- d:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2010-01-18 21:55 97480 ----a-w- d:\windows\system32\AvastSS.scr
2009-11-21 16:03 . 2008-04-14 06:51 471552 ----a-w- d:\windows\AppPatch\aclayers.dll
.

------- Sigcheck -------

[-] 2008-08-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . d:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"= "d:\documents and settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll" [2009-07-14 150768]

[HKEY_CLASSES_ROOT\clsid\{a55f9c95-2bb1-4ea2-bc77-dfaab78832ce}]
[HKEY_CLASSES_ROOT\qipbar.QIPBHO.1]
[HKEY_CLASSES_ROOT\TypeLib\{45FF696B-5284-4781-B2CA-ECF3A742A17B}]
[HKEY_CLASSES_ROOT\qipbar.QIPBHO]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
2009-07-14 16:14 150768 ----a-w- d:\documents and settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="d:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="d:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-07-14 570664]
"VX1000"="d:\windows\vVX1000.exe" [2006-12-05 707360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Garena\\Garena.exe"=
"d:\\Program Files\\QIP\\qip.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Hry\\Warcraft III\\Warcraft III.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\Hry\\Left4Dead\\hl2.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Hry\\Left4Dead\\left4dead.exe"=
"d:\\Program Files\\Cenega Czech\\VIETCONG\\vietcong.exe"=

R0 Lbd;Lbd;d:\windows\system32\drivers\Lbd.sys [18.1.2010 23:00 64288]
R0 mv61xx;mv61xx;d:\windows\system32\drivers\mv61xx.sys [8.8.2008 17:06 143360]
R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [18.1.2010 22:55 114768]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [18.1.2010 22:55 20560]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [24.9.2009 12:17 1169232]
S3 GarenaPEngine;GarenaPEngine;\??\d:\docume~1\Kuba\LOCALS~1\Temp\WEM548.tmp --> d:\docume~1\Kuba\LOCALS~1\Temp\WEM548.tmp [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 09:39 451872 ----a-w- d:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-01-24 d:\windows\Tasks\Ad-Aware Update (Weekly).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 13:06]

2010-01-24 d:\windows\Tasks\WGASetup.job
- d:\windows\system32\KB905474\wgasetup.exe [2010-01-19 21:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
FF - ProfilePath - d:\documents and settings\Kuba\Data aplikací\Mozilla\Firefox\Profiles\F861DC2F.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - component: d:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\d:\docume~1\Kuba\LOCALS~1\Temp\WEM548.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-616249376-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:bf,4a,c1,5e,3f,af,ce,d1,01,f9,4d,d9,40,a1,e5,64,d7,e1,4e,cc,60,
29,e8,c9,83,e4,0c,7d,e7,5a,71,7e,ac,7d,de,d4,8b,45,e5,9c,12,81,6f,2d,91,7d,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(732)
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1536)
d:\progra~1\WINDOW~2\wmpband.dll
d:\windows\system32\wpdshserviceobj.dll
d:\windows\system32\portabledevicetypes.dll
d:\windows\system32\portabledeviceapi.dll
.
Celkový čas: 2010-01-24 08:51:52
ComboFix-quarantined-files.txt 2010-01-24 07:51

Před spuštěním: Volných bajtů: 466 482 814 976
Po spuštění: Volných bajtů: 466 489 982 976

- - End Of File - - 41B26F1D9561F6FFD7E3FCA8A29861D4

Unlimited_Killer

Jdeme na to.
Asi jsem se překoukl, protože tam nic nevidím. Kde konkrétně Vám to Ad-Aware hlásí?

~~~

Otevřete si Poznámkový blok a vkopírujte do něj

Kód: Vybrat vše

KillAll::

File::
d:\documents and settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"=-
[-HKEY_CLASSES_ROOT\clsid\{a55f9c95-2bb1-4ea2-bc77-dfaab78832ce}]
[-HKEY_CLASSES_ROOT\qipbar.QIPBHO.1]
[-HKEY_CLASSES_ROOT\TypeLib\{45FF696B-5284-4781-B2CA-ECF3A742A17B}]
[-HKEY_CLASSES_ROOT\qipbar.QIPBHO]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]

Extra::
DDS::
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
FireFox::
FF - ProfilePath - d:\documents and settings\Kuba\Data aplikací\Mozilla\Firefox\Profiles\F861DC2F.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=

uložte to na Plochu jako CFScript.txt Pak jej myší přetáhněte nad ComboFix (musí být na Ploše) a pusťte (vizte obrázek).

ComboFix vykoná příkazy ze skriptu, PC může být opět restartován.
Po skončení mi sem vložte log, který na Vás po dočistění vybafne.

~~~

Stáhněte SystemLook.
Dvojklikem spusťte soubor SystemLook.exe
Do bílého textového pole vkopírujte tento skript:

Kód: Vybrat vše

:filefind
sfcfiles.dll

Nyní klikněte na 'Look'.
Poté se Vám otevře Poznámkový blok, jehož obsah vkopírujte sem do tématu.

~~~

Otestujte na VirusTotal soubory:

Kód: Vybrat vše

d:\windows\vVX1000.exe
d:\windows\system32\sfcfiles.dll

Jednoduše tam vkopírujete cesty, co jsem napsal do code, když Vám to napíše, že soubor byl testován, dejte otestovat znovu. Poté jsem vložíte linky (odkazy) na jednotlivé testy.

~~~

Stáhněte MbAM a postupujte podle popisu. Zatím nic nemažte, MbAM má občas falešné detekce.
Potom mi sem vložte log.

Rolandman · #5 Příspěvek od **Rolandman** » 24 led 2010 18:41

Updatoval jsem ad aware a už to ten malware smazalo tak snad to bude už v pohodě kdyby ne tak sem vložím ty logy zatím děkuji

Unlimited_Killer

Stejně bych to chtěl vidět.

Rolandman · #7 Příspěvek od **Rolandman** » 25 led 2010 15:33

Malware se furt vrací takže tady je zatím log z combofixu,jdu na další

ComboFix 10-01-24.05 - Kuba 25.01.2010 15:27:41.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2730 [GMT 1:00]
Spuštěný z: d:\documents and settings\Kuba\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Kuba\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100125-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
"d:\documents and settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\Kuba\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
d:\windows\system32\dr_reg.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-25 do 2010-01-25 )))))))))))))))))))))))))))))))
.

2010-01-24 14:15 . 2010-01-24 14:15 -------- d-----w- d:\program files\DAEMON Tools Toolbar
2010-01-24 14:15 . 2010-01-24 14:15 691696 ----a-w- d:\windows\system32\drivers\sptd.sys
2010-01-24 14:15 . 2010-01-24 14:17 -------- d-----w- d:\program files\DAEMON Tools Lite
2010-01-24 14:14 . 2010-01-24 14:14 -------- d-----w- d:\program files\Radek Hemelik
2010-01-23 19:52 . 2010-01-24 07:43 -------- d-----w- d:\program files\Steam
2010-01-23 15:40 . 2010-01-23 15:40 -------- d-----w- d:\program files\Cenega Czech
2010-01-23 13:55 . 2010-01-23 13:55 -------- d-----w- d:\program files\trend micro
2010-01-23 13:55 . 2010-01-23 13:55 -------- d-----w- D:\rsit
2010-01-23 12:30 . 2008-04-13 23:15 60032 -c--a-w- d:\windows\system32\dllcache\usbaudio.sys
2010-01-23 12:30 . 2008-04-13 23:15 60032 ----a-w- d:\windows\system32\drivers\USBAUDIO.sys
2010-01-23 12:29 . 2006-12-05 23:38 199456 ----a-r- d:\windows\system32\LCCoin13.dll
2010-01-23 12:29 . 2006-12-05 23:37 183072 ----a-r- d:\windows\system32\cVX1000.dll
2010-01-23 12:29 . 2006-12-05 23:38 707360 ----a-r- d:\windows\vVX1000.exe
2010-01-23 12:29 . 2006-12-05 23:38 473888 ----a-r- d:\windows\vVX1000.dll
2010-01-23 12:29 . 2006-12-05 23:37 109344 ----a-r- d:\windows\VX1000.dll
2010-01-23 12:28 . 2006-12-05 23:39 1963680 ----a-r- d:\windows\system32\drivers\VX1000.sys
2010-01-23 12:28 . 2008-04-14 07:52 54272 -c--a-w- d:\windows\system32\dllcache\vfwwdm32.dll
2010-01-23 12:28 . 2008-04-14 07:52 54272 ----a-w- d:\windows\system32\vfwwdm32.dll
2010-01-22 17:02 . 2010-01-22 17:02 -------- d-----w- d:\windows\Logs
2010-01-22 17:02 . 2010-01-22 17:02 22328 ----a-w- d:\windows\system32\drivers\PnkBstrK.sys
2010-01-22 17:02 . 2010-01-22 17:02 107832 ----a-w- d:\windows\system32\PnkBstrB.exe
2010-01-22 17:02 . 2010-01-22 17:02 66872 ----a-w- d:\windows\system32\PnkBstrA.exe
2010-01-22 17:02 . 2010-01-22 17:02 2250024 ----a-w- d:\windows\system32\pbsvc.exe
2010-01-22 17:02 . 2010-01-22 17:02 -------- d-----w- d:\windows\system32\LogFiles
2010-01-21 20:55 . 2007-05-16 15:45 3497832 ----a-w- d:\windows\system32\d3dx9_34.dll
2010-01-21 16:58 . 2010-01-24 10:30 15880 ----a-w- d:\windows\system32\lsdelete.exe
2010-01-21 16:34 . 2010-01-21 16:34 -------- d-----w- d:\program files\VideoLAN
2010-01-19 18:54 . 2010-01-21 16:37 -------- d-----w- d:\program files\Webteh
2010-01-19 18:31 . 2010-01-19 18:31 -------- d-----w- d:\program files\MSXML 4.0
2010-01-19 17:45 . 2010-01-19 17:45 -------- d-sh--w- d:\windows\ftpcache
2010-01-19 17:27 . 2010-01-19 17:27 -------- d-----w- d:\program files\CCleaner
2010-01-19 15:35 . 2010-01-22 17:06 107888 ----a-w- d:\windows\system32\CmdLineExt.dll
2010-01-19 15:18 . 2007-04-04 17:53 81768 ----a-w- d:\windows\system32\xinput1_3.dll
2010-01-19 15:18 . 2006-09-28 15:05 2414360 ----a-w- d:\windows\system32\d3dx9_31.dll
2010-01-19 15:18 . 2010-01-19 15:18 -------- d-----w- d:\program files\AGEIA Technologies
2010-01-19 15:18 . 2010-01-19 15:18 -------- d-----w- d:\windows\system32\AGEIA
2010-01-19 15:17 . 2010-01-19 15:17 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2010-01-19 14:42 . 2010-01-23 09:23 111799 ----a-w- d:\windows\War3Unin.dat
2010-01-19 14:42 . 2010-01-19 14:46 2829 ----a-w- d:\windows\War3Unin.pif
2010-01-19 14:42 . 2010-01-19 14:46 139264 ----a-w- d:\windows\War3Unin.exe
2010-01-19 14:39 . 2010-01-24 14:46 -------- d-----w- d:\program files\Hry
2010-01-19 14:38 . 2010-01-19 14:38 -------- d-----w- d:\program files\Common Files\LightScribe
2010-01-19 14:37 . 2010-01-19 14:37 -------- d-----w- d:\program files\Common Files\Ahead
2010-01-19 14:37 . 2010-01-19 14:37 -------- d-----w- d:\program files\Nero
2010-01-19 14:26 . 2010-01-19 14:26 56 ---ha-w- d:\windows\system32\ezsidmv.dat
2010-01-19 14:22 . 2010-01-19 14:22 -------- d-----w- d:\program files\Common Files\Skype
2010-01-19 14:22 . 2010-01-19 14:22 -------- d-----r- d:\program files\Skype
2010-01-19 14:21 . 2010-01-19 14:22 -------- d-----w- d:\program files\QIP
2010-01-19 14:12 . 2008-06-14 17:35 272128 -c----w- d:\windows\system32\dllcache\bthport.sys
2010-01-19 14:12 . 2008-06-14 17:35 272128 ------w- d:\windows\system32\drivers\bthport.sys
2010-01-19 14:11 . 2008-10-24 11:21 455296 -c----w- d:\windows\system32\dllcache\mrxsmb.sys
2010-01-19 14:11 . 2009-08-04 17:29 2147328 -c----w- d:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-19 14:11 . 2009-08-04 17:29 2068224 -c----w- d:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-19 14:11 . 2009-08-04 17:29 2025984 -c----w- d:\windows\system32\dllcache\ntkrpamp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-25 08:48 . 2001-10-25 12:00 78052 ----a-w- d:\windows\system32\perfc005.dat
2010-01-25 08:48 . 2001-10-25 12:00 429024 ----a-w- d:\windows\system32\perfh005.dat
2010-01-24 14:22 . 2010-01-18 21:42 -------- d--h--w- d:\program files\InstallShield Installation Information
2010-01-19 17:46 . 2010-01-18 21:42 -------- d-----w- d:\program files\Common Files\InstallShield
2010-01-19 17:30 . 2010-01-19 17:30 -------- d-----w- d:\program files\MSBuild
2010-01-19 17:30 . 2010-01-19 17:30 -------- d-----w- d:\program files\Reference Assemblies
2010-01-19 14:33 . 2010-01-18 22:05 -------- d-----w- d:\program files\ASUS
2010-01-18 22:00 . 2010-01-18 22:00 -------- d-----w- d:\program files\Lavasoft
2010-01-18 21:55 . 2010-01-18 21:55 -------- d-----w- d:\program files\Alwil Software
2010-01-18 21:51 . 2010-01-18 21:51 -------- d-----w- d:\program files\Realtek
2010-01-18 21:49 . 2010-01-18 21:49 0 ----a-w- d:\windows\ativpsrm.bin
2010-01-18 21:47 . 2010-01-18 21:42 -------- d-----w- d:\program files\ATI Technologies
2010-01-18 21:46 . 2010-01-18 21:46 -------- d-----w- d:\program files\Common Files\ATI Technologies
2010-01-18 21:34 . 2010-01-18 21:34 -------- d-----w- d:\program files\microsoft frontpage
2010-01-18 21:34 . 2010-01-18 21:34 8738 ----a-w- d:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-18 21:34 . 2010-01-18 21:34 2112 ----a-w- d:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-18 21:34 . 2010-01-18 21:34 86327 ----a-w- d:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-18 21:32 . 2010-01-18 21:32 21812 ----a-w- d:\windows\system32\emptyregdb.dat
2010-01-18 21:31 . 2010-01-18 21:31 -------- d-----w- d:\program files\Windows Media Connect 2
2010-01-05 09:58 . 2008-08-08 15:43 832512 ------w- d:\windows\system32\wininet.dll
2010-01-05 09:57 . 2008-08-08 15:43 78336 ----a-w- d:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2008-08-08 15:43 17408 ----a-w- d:\windows\system32\corpol.dll
2009-11-24 23:54 . 2010-01-18 21:55 1280480 ----a-w- d:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2010-01-18 21:55 93424 ----a-w- d:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2010-01-18 21:55 48560 ----a-w- d:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2010-01-18 21:55 23120 ----a-w- d:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2010-01-18 21:55 27408 ----a-w- d:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2010-01-18 21:55 97480 ----a-w- d:\windows\system32\AvastSS.scr
2009-11-21 16:03 . 2008-04-14 06:51 471552 ----a-w- d:\windows\AppPatch\aclayers.dll
.

------- Sigcheck -------

[-] 2008-08-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . d:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-01-24_07.51.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-25 14:30 . 2010-01-25 14:30 22436 d:\windows\Temp\Turkish.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 17090 d:\windows\Temp\TradChin.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 22149 d:\windows\Temp\Thai.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 24270 d:\windows\Temp\SWEDISH.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 27968 d:\windows\Temp\Spanish.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 24100 d:\windows\Temp\Slovenian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 16540 d:\windows\Temp\SimChin.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 26314 d:\windows\Temp\Russian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 26464 d:\windows\Temp\Portuguese.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 25276 d:\windows\Temp\Portuguese(Brazil).bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 24428 d:\windows\Temp\Polish.bin
+ 2010-01-25 14:26 . 2010-01-25 14:26 16384 d:\windows\Temp\Perflib_Perfdata_5ec.dat
+ 2010-01-25 14:30 . 2010-01-25 14:30 16384 d:\windows\Temp\Perflib_Perfdata_5c4.dat
+ 2010-01-25 14:30 . 2010-01-25 14:30 22142 d:\windows\Temp\Norwegian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 25712 d:\windows\Temp\Lithuanian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 20307 d:\windows\Temp\Korean.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 24523 d:\windows\Temp\Japanese.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 27665 d:\windows\Temp\Italian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 26282 d:\windows\Temp\Hungarian.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 19700 d:\windows\Temp\Hebrew.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 25278 d:\windows\Temp\Greek.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 25927 d:\windows\Temp\German.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 27425 d:\windows\Temp\French.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 23040 d:\windows\Temp\Finnish.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 22118 d:\windows\Temp\English.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 25943 d:\windows\Temp\Dutch.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 22970 d:\windows\Temp\Danish.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 24504 d:\windows\Temp\Czech.bin
+ 2010-01-25 14:30 . 2010-01-25 14:30 53248 d:\windows\Temp\catchme.dll
+ 2010-01-25 14:30 . 2010-01-25 14:30 21150 d:\windows\Temp\Arabic.bin
- 2001-10-25 12:00 . 2010-01-24 07:43 67448 d:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-01-25 08:48 67448 d:\windows\system32\perfc009.dat
- 2010-01-18 21:37 . 2010-01-18 21:37 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-18 21:37 . 2010-01-24 10:30 32768 d:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2010-01-18 21:37 . 2010-01-18 21:37 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-01-18 21:37 . 2010-01-24 10:30 32768 d:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-01-18 21:37 . 2010-01-18 21:37 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-01-24 10:29 . 2010-01-24 10:30 16384 d:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2001-10-25 12:00 . 2010-01-25 08:48 432492 d:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-01-24 07:43 432492 d:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="d:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="d:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-07-14 570664]
"VX1000"="d:\windows\vVX1000.exe" [2006-12-05 707360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Garena\\Garena.exe"=
"d:\\Program Files\\QIP\\qip.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Hry\\Far cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Hry\\Warcraft III\\Warcraft III.exe"=
"d:\\Program Files\\Hry\\Left4Dead\\hl2.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Hry\\Left4Dead\\left4dead.exe"=
"d:\\Program Files\\Cenega Czech\\VIETCONG\\vietcong.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;d:\windows\system32\drivers\Lbd.sys [18.1.2010 23:00 64288]
R0 mv61xx;mv61xx;d:\windows\system32\drivers\mv61xx.sys [8.8.2008 17:06 143360]
R0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [24.1.2010 15:15 691696]
R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [18.1.2010 22:55 114768]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [18.1.2010 22:55 20560]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [24.9.2009 12:17 1181328]
S3 GarenaPEngine;GarenaPEngine;\??\d:\windows\TEMP\SML20.tmp --> d:\windows\TEMP\SML20.tmp [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 09:39 451872 ----a-w- d:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-01-25 d:\windows\Tasks\Ad-Aware Update (Daily 1).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 10:30]

2010-01-25 d:\windows\Tasks\Ad-Aware Update (Daily 2).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 10:30]

2010-01-25 d:\windows\Tasks\Ad-Aware Update (Daily 3).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 10:30]

2010-01-25 d:\windows\Tasks\Ad-Aware Update (Daily 4).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 10:30]

2010-01-25 d:\windows\Tasks\Ad-Aware Update (Weekly).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 10:30]

2010-01-25 d:\windows\Tasks\WGASetup.job
- d:\windows\system32\KB905474\wgasetup.exe [2010-01-19 21:18]
.
.
------- Doplňkový sken -------
.
uStart Page = About:Blank
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
FF - ProfilePath - d:\documents and settings\Kuba\Data aplikací\Mozilla\Firefox\Profiles\F861DC2F.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: d:\documents and settings\Kuba\Data aplikací\Mozilla\Firefox\Profiles\F861DC2F.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - component: d:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-25 15:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spve.sys >>UNKNOWN [0x8A6BA938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9e74cb8
\Driver\atapi -> atapi.sys @ 0xb9e09b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9cd3bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9cc2a0d
SendHandler -> NDIS.sys @ 0xb9cd6b40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\d:\windows\TEMP\SML20.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-616249376-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:bf,4a,c1,5e,3f,af,ce,d1,01,f9,4d,d9,40,a1,e5,64,d7,e1,4e,cc,60,
29,e8,c9,83,e4,0c,7d,e7,5a,71,7e,ac,7d,de,d4,8b,45,e5,9c,12,81,6f,2d,91,7d,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(576)
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2952)
d:\progra~1\WINDOW~2\wmpband.dll
d:\windows\system32\wpdshserviceobj.dll
d:\windows\system32\portabledevicetypes.dll
d:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\Ati2evxx.exe
d:\program files\Alwil Software\Avast4\aswUpdSv.exe
d:\program files\Alwil Software\Avast4\ashServ.exe
d:\program files\Common Files\LightScribe\LSSrvc.exe
d:\windows\system32\PnkBstrA.exe
d:\windows\system32\PnkBstrB.exe
d:\program files\Alwil Software\Avast4\ashMaiSv.exe
d:\windows\system32\wbem\unsecapp.exe
d:\program files\Alwil Software\Avast4\ashWebSv.exe
d:\windows\RTHDCPL.EXE
d:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
d:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
d:\program files\Lavasoft\Ad-Aware\AAWTray.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\imapi.exe
.
**************************************************************************
.
Celkový čas: 2010-01-25 15:31:38 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-25 14:31
ComboFix2.txt 2010-01-24 07:51

Před spuštěním: Volných bajtů: 466 417 201 152
Po spuštění: Volných bajtů: 466 381 541 376

- - End Of File - - DFD957B7E9279B18C1B076058E5D1331

Unlimited_Killer

Rolandman · #9 Příspěvek od **Rolandman** » 25 led 2010 15:44

system look nejde nevim proč...k tomu druhému tady je odkaz k prvnímu souboru http://www.virustotal.com/cs/analisis/2 ... 1264430306

a tady k druhému http://www.virustotal.com/cs/analisis/7 ... 1264430553

Unlimited_Killer

To je divné, že nefunguje. SystemLook pro jistotu ještě zkuste v Nouzovém režimu. Jestli by ani tam nefungoval, jedeme dál.

~~~

Odinstalujte všechny virtuální mechaniky (Daemon, Alcohol atp.)

~~~
Stáhněte SPTD

Vyberte verzi podle svého operačního systému. SPTD for Windows - 32 bit nebo 64b.
Uložte soubor na Plochu a spusťte.
Zvolte možnost Uninstall
Restartujte PC.

~~~

Stáhněte MBR.exe
Uložte tuto utilitu na Plochu.
Stiskněte Start -> Spustit [Win+R] -> zadejte / vkopírujte následující:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

a stiskněte Enter.
Na ploše se vytvoří textový soubor s názvem mbr.log, jehož obsah mi sem vkopírujete.

~~~

Stáhněte GMER a dvojklikem spusťte.
Několik sekund bude skenovat. Poté klikněte na 'Save' v pravém dolním rohu a uložte první log - ten vložte sem do fóra.
Poté vytvořte druhý log, přičemž se budete řídit tímto návodem. Tento log sem také vložte.

Rolandman · #11 Příspěvek od **Rolandman** » 25 led 2010 16:03

tady je log z Mbam

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

25.1.2010 16:03:02
mbam-log-2010-01-25 (16-02-57).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 142374
Uplynulý čas: 10 minute(s), 34 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
D:\System Volume Information\_restore{76737340-F6D4-474D-95D4-2F8B1620CC81}\RP1\A0000100.sys (Malware.Trace) -> No action taken.
D:\System Volume Information\_restore{76737340-F6D4-474D-95D4-2F8B1620CC81}\RP4\A0000535.sys (Malware.Trace) -> No action taken.

Unlimited_Killer

Položky smažte. Poté další kroky.

Rolandman · #13 Příspěvek od **Rolandman** » 25 led 2010 17:55

log z mbr

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
kernel: MBR read successfully
user & kernel MBR OK

Unlimited_Killer

Super, dál.

Rolandman · #15 Příspěvek od **Rolandman** » 25 led 2010 18:27

prvni log z gmer

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-01-25 17:57:32
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: D:\WINDOWS\TEMP\kxtdypog.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

a druhy log z gmer

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-25 18:27:29
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: D:\WINDOWS\TEMP\kxtdypog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xACD486B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xACD48574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xACD48A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xACD4814C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xACD4864E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xACD4808C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xACD480F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xACD4876E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xACD4872E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xACD488AE]

---- Kernel code sections - GMER 1.0.15 ----

.text D:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9986000, 0x1CBE76, 0xE8000020]
? D:\WINDOWS\TEMP\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT D:\WINDOWS\system32\services.exe[772] @ D:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT D:\WINDOWS\system32\services.exe[772] @ D:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAC 0xD7 0x99 0xB6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAC 0xD7 0x99 0xB6 ...

---- EOF - GMER 1.0.15 ----

VIRY.CZ

Malware

Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware

Re: Malware