Total XP Security - Jak ho zničit!??
Napsal: 22 bře 2010 22:25
Dobrý den,
mám tu notas ASUS Eee PC 1000H, WIN XP HOME, po záruce na opravu pod původní záminkou, že je zaneřáděný a že ho chce uživatel vyčistit a líp zabezpečit. Po spuštění PC vyhodil 2x modrou smrt, potřetí najel až do OS, přičemž se spustil zmíněny Total XP Security, který jsem doteď neznal a domníval jsem se, že je to nějaký rádobyprogram od Microsoftu. Ale bylo mi divný, že jsem o něm neslyšel. No každopádně dělá slušnej bordýlek a nenechá mě nainstalovat nic, co by mohlo vést k jeho odstranění, blokuje použití flashky a neustále hází hlášení až do zaseknutí PC.
Něco jsem tu četl, stáhl jsem si RSIT i Combofix, víc nic jsem zatím nedělal. Poradíte co s tím dále??
Děkuji mnohokrát.
Výpis logu:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-03-22 22:23:22
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 71 GB (87%) free of 82 GB
Total RAM: 1015 MB (57% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:30, on 22.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\reader_s.exe
c:\windows\system32\wuaucldt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\syre32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logon.exe
C:\WINDOWS\System32\reader_s.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\210.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\364.exe
C:\Documents and Settings\Administrator\reader_s.exe
C:\WINDOWS\cidrive32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eeepc.asus.com/global
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.weathertalkz.com/web.php?q=4 ... b.1.922390
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 1.2.3.4 13iii.com
O1 - Hosts: 1.2.3.4 2-spyware.com
O1 - Hosts: 1.2.3.4 247fixes.com
O1 - Hosts: 1.2.3.4 360.cn
O1 - Hosts: 1.2.3.4 360.com
O1 - Hosts: 1.2.3.4 360safe.cn
O1 - Hosts: 1.2.3.4 360safe.com
O1 - Hosts: 1.2.3.4 4-gsmteam.com
O1 - Hosts: 1.2.3.4 51nb.com
O1 - Hosts: 1.2.3.4 Merijn.org
O1 - Hosts: 1.2.3.4 abgenis.net
O1 - Hosts: 1.2.3.4 acs.pandasoftware.com
O1 - Hosts: 1.2.3.4 acs.pandasoftware.com
O1 - Hosts: 1.2.3.4 ad-aware-se.uptodown.com
O1 - Hosts: 1.2.3.4 ad13.geekstogo.com
O1 - Hosts: 1.2.3.4 aknow.prevx.com
O1 - Hosts: 1.2.3.4 alabamawomen.org
O1 - Hosts: 1.2.3.4 alerta-antivirus.inteco.es
O1 - Hosts: 1.2.3.4 alerta-antivirus.inteco.es
O1 - Hosts: 1.2.3.4 alerta-antivirus.red.es
O1 - Hosts: 1.2.3.4 alfrasha.maktoob.com
O1 - Hosts: 1.2.3.4 analysis.seclab.tuwien.ac.at
O1 - Hosts: 1.2.3.4 andymanchesta.com
O1 - Hosts: 1.2.3.4 andymanchesta.com
O1 - Hosts: 1.2.3.4 angui123.cn
O1 - Hosts: 1.2.3.4 anti-virus-softwarereview.
O1 - Hosts: 1.2.3.4 toptenreviews.com
O1 - Hosts: 1.2.3.4 antirootkit.com
O1 - Hosts: 1.2.3.4 antitrick.com
O1 - Hosts: 1.2.3.4 antivir.es
O1 - Hosts: 1.2.3.4 antivirus.about.com
O1 - Hosts: 1.2.3.4 antivirus.comodo.com
O1 - Hosts: 1.2.3.4 ar.answers.yahoo.com
O1 - Hosts: 1.2.3.4 arenajunkies.com
O1 - Hosts: 1.2.3.4 ariefew.com
O1 - Hosts: 1.2.3.4 arswp.com
O1 - Hosts: 1.2.3.4 askmehelpdesk.com
O1 - Hosts: 1.2.3.4 atazita.blogspot.com
O1 - Hosts: 1.2.3.4 auditmypc.com
O1 - Hosts: 1.2.3.4 avast-home.uptodown.com
O1 - Hosts: 1.2.3.4 avast.com
O1 - Hosts: 1.2.3.4 avg-antivirus.net
O1 - Hosts: 1.2.3.4 avast.com
O1 - Hosts: 1.2.3.4 avg-antivirus.net
O1 - Hosts: 1.2.3.4 avg.vo.llnwd.net
O1 - Hosts: 1.2.3.4 avira.com
O1 - Hosts: 1.2.3.4 avp.com
O1 - Hosts: 1.2.3.4 avpclub.ddns.info
O1 - Hosts: 1.2.3.4 avsoft.ru
O1 - Hosts: 1.2.3.4 babooforum.com.br
O1 - Hosts: 1.2.3.4 baike.360.cn
O1 - Hosts: 1.2.3.4 baike.360.com
O1 - Hosts: 1.2.3.4 bakunos.com
O1 - Hosts: 1.2.3.4 bb1.th3kings.net
O1 - Hosts: 1.2.3.4 bbs.360safe.cn
O1 - Hosts: 1.2.3.4 bbs.360safe.cn
O1 - Hosts: 1.2.3.4 bbs.360safe.com
O1 - Hosts: 1.2.3.4 bbs.360safe.com
O1 - Hosts: 1.2.3.4 bbs.cfan.com.cn
O1 - Hosts: 1.2.3.4 bbs.duba.net
O1 - Hosts: 1.2.3.4 bbs.ikaka.com
O1 - Hosts: 1.2.3.4 bbs.kafan.cn
O1 - Hosts: 1.2.3.4 bbs.kafan.com
O1 - Hosts: 1.2.3.4 bbs.kaspersky.com.cn
O1 - Hosts: 1.2.3.4 bbs.kpfans.com
O1 - Hosts: 1.2.3.4 bbs.s-sos.net
O1 - Hosts: 1.2.3.4 bbs.taisha.org
O1 - Hosts: 1.2.3.4 bbs.winzheng.com
O1 - Hosts: 1.2.3.4 beniono.wordpress.com
O1 - Hosts: 1.2.3.4 beta.eset.com
O1 - Hosts: 1.2.3.4 betterantivirus.com
O1 - Hosts: 1.2.3.4 bitdefender.com
O1 - Hosts: 1.2.3.4 bitdefender.es
O1 - Hosts: 1.2.3.4 bleedingthreats.net
O1 - Hosts: 1.2.3.4 bleepingcomputer.com
O1 - Hosts: 1.2.3.4 blindedbytech.com
O1 - Hosts: 1.2.3.4 blog.hispasec.com
O1 - Hosts: 1.2.3.4 blog.rnsafe.com
O1 - Hosts: 1.2.3.4 blog.threatfire.com
O1 - Hosts: 1.2.3.4 blogs.icerocket.com
O1 - Hosts: 1.2.3.4 blogschapines.com
O1 - Hosts: 1.2.3.4 blokvesti.net
O1 - Hosts: 1.2.3.4 board.softpedia.com
O1 - Hosts: 1.2.3.4 blokvesti.net
O1 - Hosts: 1.2.3.4 board.softpedia.com
O1 - Hosts: 1.2.3.4 boardreader.com
O1 - Hosts: 1.2.3.4 box.net
O1 - Hosts: 1.2.3.4 bub.th3kings.net
O1 - Hosts: 1.2.3.4 ca.com
O1 - Hosts: 1.2.3.4 cairopt.net
O1 - Hosts: 1.2.3.4 cairopt.net
O1 - Hosts: 1.2.3.4 castlecops.com
O1 - Hosts: 1.2.3.4 castlecrops.com
O1 - Hosts: 1.2.3.4 cddchiangmai.net
O1 - Hosts: 1.2.3.4 cddchiangmai.net
O1 - Hosts: 1.2.3.4 cert.inteco.es
O1 - Hosts: 1.2.3.4 cfan.com.cn
O1 - Hosts: 1.2.3.4 changedetection.com
O1 - Hosts: 1.2.3.4 changelog.fr
O1 - Hosts: 1.2.3.4 chkrootkit.org
O1 - Hosts: 1.2.3.4 cisrt.org
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [9298] C:\DOCUME~1\Kacka\LOCALS~1\Temp\abhhqq.exe
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [syncman] c:\windows\system32\wuaucldt.exe
O4 - HKLM\..\Run: [Calc32] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ocdglhq.exe
O4 - HKLM\..\Run: [syre32] C:\WINDOWS\system32\syre32.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\system32\logon.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\system32\.exe
O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\cidrive32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Administrator\reader_s.exe
O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
O4 - HKCU\..\Run: [syncman] c:\documents and settings\administrator\wuaucldt.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\cidrive32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: ihaupd32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: winesm32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: zipdkg32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: ihaupd32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: winesm32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: zipdkg32.exe (User 'Kacka')
O4 - Startup: ihaupd32.exe
O4 - Startup: zipdkg32.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: SuperHybridEngine.lnk = ?
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: app_dll.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED FREE\a2service.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: IpSec service (darkness) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
--
End of file - 12087 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-02-12 1372160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}]
Hotbar - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll [2009-09-15 537904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416]
{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - Hotbar - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll [2009-09-15 537904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Regedit32"=C:\WINDOWS\system32\regedit.exe [2010-03-19 165376]
"9298"=C:\DOCUME~1\Kacka\LOCALS~1\Temp\abhhqq.exe [2010-03-22 23040]
"reader_s"=C:\WINDOWS\System32\reader_s.exe [2010-03-22 28672]
"syncman"=c:\windows\system32\wuaucldt.exe [2010-03-22 27648]
"Calc32"=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ocdglhq.exe []
"syre32"=C:\WINDOWS\system32\syre32.exe [2010-03-22 208896]
"Windows Logon Application"=C:\WINDOWS\system32\logon.exe [2008-04-14 146432]
""=C:\WINDOWS\system32\.exe [2010-03-22 208896]
"Microsoft Driver Setup"=C:\WINDOWS\cidrive32.exe [2010-03-22 135168]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Microsoft Driver Setup"=C:\WINDOWS\cidrive32.exe [2010-03-22 135168]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2010-03-22 27648]
"reader_s"=C:\Documents and Settings\Administrator\reader_s.exe [2010-03-22 28672]
"12CFG214-K641-12SF-N85P"=C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe [2010-03-22 102400]
"syncman"=c:\documents and settings\administrator\wuaucldt.exe [2010-03-22 27648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
SuperHybridEngine.lnk - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
ihaupd32.exe
zipdkg32.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="app_dll.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe"="C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\WINDOWS\Temp\~TM57.tmp"="C:\WINDOWS\Temp\~TM57.tmp:*:Enabled:services"
"C:\WINDOWS\Temp\~TMC.tmp"="C:\WINDOWS\Temp\~TMC.tmp:*:Enabled:services"
"C:\WINDOWS\system32\Sysinfo.exe"="C:\WINDOWS\system32\Sysinfo.exe:*:Enabled:sysupdate"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"\"="C:\WINDOWS\system\svchost.exe:*:Enabled:KL"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\setupSNK.exe
======File associations======
.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2013-08-25 23:27:58 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2013-08-25 23:27:58 ----A---- C:\WINDOWS\SkyTel.exe
2013-08-25 23:27:58 ----A---- C:\WINDOWS\RtlUpd.exe
2013-08-25 23:27:57 ----A---- C:\WINDOWS\RTLCPL.EXE
2013-08-25 23:27:55 ----A---- C:\WINDOWS\RTHDCPL.EXE
2013-08-25 23:27:55 ----A---- C:\WINDOWS\MicCal.exe
2013-08-25 23:27:54 ----D---- C:\Program Files\Realtek
2013-08-25 23:27:54 ----A---- C:\WINDOWS\ALCWZRD.EXE
2013-08-25 23:27:54 ----A---- C:\WINDOWS\ALCMTR.EXE
2013-08-25 23:27:39 ----A---- C:\WINDOWS\RtlExUpd.dll
2013-08-17 21:22:50 ----A---- C:\WINDOWS\system32\DetectDevice.txt
2013-08-11 23:14:29 ----A---- C:\WINDOWS\system32\wmpns.dll
2013-08-11 23:12:48 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2012-09-18 09:11:00 ----A---- C:\WINDOWS\system32\btw_ci.dll
2012-09-18 09:10:54 ----D---- C:\Program Files\WIDCOMM
2011-09-11 16:59:53 ----D---- C:\Program Files\EeePC
2011-09-11 16:17:29 ----D---- C:\Program Files\Elantech
2010-03-22 22:23:22 ----D---- C:\rsit
2010-03-22 22:03:41 ----RSH---- C:\WINDOWS\cidrive32.exe
2010-03-22 21:56:01 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
2010-03-22 21:54:56 ----A---- C:\WINDOWS\system32\.exe
2010-03-22 21:52:32 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-22 21:52:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-03-22 21:52:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2010-03-22 21:49:08 ----A---- C:\WINDOWS\system32\app_dll.dll
2010-03-22 21:47:39 ----A---- C:\WINDOWS\fn0oxom410fpdatx5xx447ni.ini
2010-03-22 21:47:05 ----A---- C:\WINDOWS\system32\syre32.exe
2010-03-22 21:46:49 ----A---- C:\WINDOWS\system32\reader_s.exe
2010-03-22 21:46:49 ----A---- C:\WINDOWS\system32\reader_s .exe
2010-03-22 21:25:00 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Mozilla
2010-03-22 21:20:57 ----D---- C:\Program Files\Mozilla Firefox
2010-03-22 21:19:17 ----D---- C:\Program Files\Trend Micro
2010-03-22 20:58:56 ----D---- C:\Program Files\CCleaner
2010-03-22 20:01:18 ----A---- C:\WINDOWS\system32\MRT.INI
2010-03-22 19:51:16 ----A---- C:\WINDOWS\system32\MRT.exe
2010-03-22 19:44:06 ----D---- C:\Program Files\a-squared Free
2010-03-22 18:38:32 ----ASH---- C:\Documents and Settings\Administrator\Data aplikací\desktop.ini
2010-03-22 18:38:26 ----D---- C:\Documents and Settings\Administrator\Data aplikací\InstallShield
2010-03-22 18:38:26 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Identities
2010-03-22 18:38:25 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2010-03-22 18:38:25 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Sun
2010-03-22 18:38:25 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2010-03-22 18:37:31 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-21 01:15:53 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-19 20:57:35 ----SHD---- C:\Config.Msi
2010-03-19 06:12:38 ----A---- C:\WINDOWS\system32\regedit.exe
2010-03-19 05:04:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\21773727
2010-03-19 05:04:21 ----A---- C:\WINDOWS\system32\wuaucldt.exe
2010-03-19 05:04:21 ----A---- C:\WINDOWS\system32\wuaucldt .exe
2010-03-17 22:44:53 ----A---- C:\WINDOWS\system32\nethlp.dll
2010-03-11 03:01:03 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-02-25 11:08:12 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
======List of files/folders modified in the last 1 months======
2013-08-25 23:28:10 ----D---- C:\WINDOWS\system32\RTCOM
2013-08-25 23:27:39 ----A---- C:\WINDOWS\HideWin.exe
2013-08-13 03:29:47 ----D---- C:\WINDOWS\system32\ReinstallBackups
2012-09-18 10:32:30 ----D---- C:\WINDOWS\repair
2012-09-18 10:32:29 ----D---- C:\WINDOWS\system32\Restore
2012-09-18 09:18:16 ----A---- C:\WINDOWS\oemver.txt
2011-09-11 16:59:53 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-03-22 22:22:57 ----RD---- C:\Program Files
2010-03-22 22:14:21 ----D---- C:\WINDOWS\system32\drivers
2010-03-22 22:07:47 ----D---- C:\WINDOWS\Temp
2010-03-22 22:03:41 ----D---- C:\WINDOWS
2010-03-22 22:03:36 ----RSHD---- C:\RECYCLER
2010-03-22 21:55:02 ----D---- C:\WINDOWS\system32
2010-03-22 21:49:09 ----D---- C:\Program Files\Adobe
2010-03-22 21:49:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-22 21:47:48 ----A---- C:\WINDOWS\system32\ctfmon.exe
2010-03-22 21:47:39 ----HD---- C:\WINDOWS\inf
2010-03-22 21:47:31 ----D---- C:\Program Files\Internet Explorer
2010-03-22 21:12:28 ----D---- C:\Program Files\KaM - The Peasants Rebellion
2010-03-22 21:07:06 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-22 21:01:31 ----D---- C:\WINDOWS\Debug
2010-03-22 20:00:12 ----D---- C:\WINDOWS\Prefetch
2010-03-22 19:44:54 ----SD---- C:\WINDOWS\Tasks
2010-03-22 18:38:21 ----D---- C:\Documents and Settings
2010-03-19 20:57:49 ----SHD---- C:\WINDOWS\Installer
2010-03-19 20:06:21 ----SHD---- C:\System Volume Information
2010-03-19 20:05:57 ----D---- C:\WINDOWS\system
2010-03-19 20:05:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-18 20:10:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\HotbarSA
2010-03-11 03:02:45 ----A---- C:\WINDOWS\win.ini
2010-03-11 03:01:04 ----D---- C:\Program Files\Movie Maker
2010-03-11 03:00:43 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-06 11:56:39 ----D---- C:\WINDOWS\Help
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2008-04-08 10752]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 Ktp;Elantech Smart-Pad; C:\WINDOWS\system32\DRIVERS\ETD.sys [2008-08-25 26112]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-03-11 36864]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 cdfss;cdfss; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cdfss []
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
S1 KGootkit;KGootkit; C:\WINDOWS\System32\drivers\KGootkit.sys [2010-03-22 69120]
S1 wcscd;wcscd; C:\WINDOWS\system32\drivers\wcscd.sys [2010-03-22 29536]
S2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
S2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2008-04-14 63232]
S2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2008-04-14 55936]
S3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-05-03 546976]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2008-05-30 534568]
S3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-02-04 37160]
S3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-08-19 991656]
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-07-24 182656]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-08-19 47272]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-22 21568]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-12-19 5854688]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-08-12 4751360]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 RT80x86;Ralink 802.11n Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2860.sys [2008-03-28 625024]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 uxkx1;ASUS My Cinema U3100 Mini DVBT; C:\WINDOWS\system32\DRIVERS\uxkx1.sys [2008-02-15 459264]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
S2 a2free;a-squared Free Service; C:\PROGRAM FILES\A-SQUARED FREE\a2service.exe [2009-10-01 1858144]
S2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2009-09-28 109056]
S2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-09-02 346720]
S2 darkness;IpSec service; C:\WINDOWS\system\svchost.exe []
S2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Služba Čtení deníku USN sdílených složek programu Messenger; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
-----------------EOF-----------------
mám tu notas ASUS Eee PC 1000H, WIN XP HOME, po záruce na opravu pod původní záminkou, že je zaneřáděný a že ho chce uživatel vyčistit a líp zabezpečit. Po spuštění PC vyhodil 2x modrou smrt, potřetí najel až do OS, přičemž se spustil zmíněny Total XP Security, který jsem doteď neznal a domníval jsem se, že je to nějaký rádobyprogram od Microsoftu. Ale bylo mi divný, že jsem o něm neslyšel. No každopádně dělá slušnej bordýlek a nenechá mě nainstalovat nic, co by mohlo vést k jeho odstranění, blokuje použití flashky a neustále hází hlášení až do zaseknutí PC.
Něco jsem tu četl, stáhl jsem si RSIT i Combofix, víc nic jsem zatím nedělal. Poradíte co s tím dále??
Děkuji mnohokrát.
Výpis logu:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-03-22 22:23:22
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 71 GB (87%) free of 82 GB
Total RAM: 1015 MB (57% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:30, on 22.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\reader_s.exe
c:\windows\system32\wuaucldt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\syre32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logon.exe
C:\WINDOWS\System32\reader_s.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\210.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\364.exe
C:\Documents and Settings\Administrator\reader_s.exe
C:\WINDOWS\cidrive32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eeepc.asus.com/global
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.weathertalkz.com/web.php?q=4 ... b.1.922390
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 1.2.3.4 13iii.com
O1 - Hosts: 1.2.3.4 2-spyware.com
O1 - Hosts: 1.2.3.4 247fixes.com
O1 - Hosts: 1.2.3.4 360.cn
O1 - Hosts: 1.2.3.4 360.com
O1 - Hosts: 1.2.3.4 360safe.cn
O1 - Hosts: 1.2.3.4 360safe.com
O1 - Hosts: 1.2.3.4 4-gsmteam.com
O1 - Hosts: 1.2.3.4 51nb.com
O1 - Hosts: 1.2.3.4 Merijn.org
O1 - Hosts: 1.2.3.4 abgenis.net
O1 - Hosts: 1.2.3.4 acs.pandasoftware.com
O1 - Hosts: 1.2.3.4 acs.pandasoftware.com
O1 - Hosts: 1.2.3.4 ad-aware-se.uptodown.com
O1 - Hosts: 1.2.3.4 ad13.geekstogo.com
O1 - Hosts: 1.2.3.4 aknow.prevx.com
O1 - Hosts: 1.2.3.4 alabamawomen.org
O1 - Hosts: 1.2.3.4 alerta-antivirus.inteco.es
O1 - Hosts: 1.2.3.4 alerta-antivirus.inteco.es
O1 - Hosts: 1.2.3.4 alerta-antivirus.red.es
O1 - Hosts: 1.2.3.4 alfrasha.maktoob.com
O1 - Hosts: 1.2.3.4 analysis.seclab.tuwien.ac.at
O1 - Hosts: 1.2.3.4 andymanchesta.com
O1 - Hosts: 1.2.3.4 andymanchesta.com
O1 - Hosts: 1.2.3.4 angui123.cn
O1 - Hosts: 1.2.3.4 anti-virus-softwarereview.
O1 - Hosts: 1.2.3.4 toptenreviews.com
O1 - Hosts: 1.2.3.4 antirootkit.com
O1 - Hosts: 1.2.3.4 antitrick.com
O1 - Hosts: 1.2.3.4 antivir.es
O1 - Hosts: 1.2.3.4 antivirus.about.com
O1 - Hosts: 1.2.3.4 antivirus.comodo.com
O1 - Hosts: 1.2.3.4 ar.answers.yahoo.com
O1 - Hosts: 1.2.3.4 arenajunkies.com
O1 - Hosts: 1.2.3.4 ariefew.com
O1 - Hosts: 1.2.3.4 arswp.com
O1 - Hosts: 1.2.3.4 askmehelpdesk.com
O1 - Hosts: 1.2.3.4 atazita.blogspot.com
O1 - Hosts: 1.2.3.4 auditmypc.com
O1 - Hosts: 1.2.3.4 avast-home.uptodown.com
O1 - Hosts: 1.2.3.4 avast.com
O1 - Hosts: 1.2.3.4 avg-antivirus.net
O1 - Hosts: 1.2.3.4 avast.com
O1 - Hosts: 1.2.3.4 avg-antivirus.net
O1 - Hosts: 1.2.3.4 avg.vo.llnwd.net
O1 - Hosts: 1.2.3.4 avira.com
O1 - Hosts: 1.2.3.4 avp.com
O1 - Hosts: 1.2.3.4 avpclub.ddns.info
O1 - Hosts: 1.2.3.4 avsoft.ru
O1 - Hosts: 1.2.3.4 babooforum.com.br
O1 - Hosts: 1.2.3.4 baike.360.cn
O1 - Hosts: 1.2.3.4 baike.360.com
O1 - Hosts: 1.2.3.4 bakunos.com
O1 - Hosts: 1.2.3.4 bb1.th3kings.net
O1 - Hosts: 1.2.3.4 bbs.360safe.cn
O1 - Hosts: 1.2.3.4 bbs.360safe.cn
O1 - Hosts: 1.2.3.4 bbs.360safe.com
O1 - Hosts: 1.2.3.4 bbs.360safe.com
O1 - Hosts: 1.2.3.4 bbs.cfan.com.cn
O1 - Hosts: 1.2.3.4 bbs.duba.net
O1 - Hosts: 1.2.3.4 bbs.ikaka.com
O1 - Hosts: 1.2.3.4 bbs.kafan.cn
O1 - Hosts: 1.2.3.4 bbs.kafan.com
O1 - Hosts: 1.2.3.4 bbs.kaspersky.com.cn
O1 - Hosts: 1.2.3.4 bbs.kpfans.com
O1 - Hosts: 1.2.3.4 bbs.s-sos.net
O1 - Hosts: 1.2.3.4 bbs.taisha.org
O1 - Hosts: 1.2.3.4 bbs.winzheng.com
O1 - Hosts: 1.2.3.4 beniono.wordpress.com
O1 - Hosts: 1.2.3.4 beta.eset.com
O1 - Hosts: 1.2.3.4 betterantivirus.com
O1 - Hosts: 1.2.3.4 bitdefender.com
O1 - Hosts: 1.2.3.4 bitdefender.es
O1 - Hosts: 1.2.3.4 bleedingthreats.net
O1 - Hosts: 1.2.3.4 bleepingcomputer.com
O1 - Hosts: 1.2.3.4 blindedbytech.com
O1 - Hosts: 1.2.3.4 blog.hispasec.com
O1 - Hosts: 1.2.3.4 blog.rnsafe.com
O1 - Hosts: 1.2.3.4 blog.threatfire.com
O1 - Hosts: 1.2.3.4 blogs.icerocket.com
O1 - Hosts: 1.2.3.4 blogschapines.com
O1 - Hosts: 1.2.3.4 blokvesti.net
O1 - Hosts: 1.2.3.4 board.softpedia.com
O1 - Hosts: 1.2.3.4 blokvesti.net
O1 - Hosts: 1.2.3.4 board.softpedia.com
O1 - Hosts: 1.2.3.4 boardreader.com
O1 - Hosts: 1.2.3.4 box.net
O1 - Hosts: 1.2.3.4 bub.th3kings.net
O1 - Hosts: 1.2.3.4 ca.com
O1 - Hosts: 1.2.3.4 cairopt.net
O1 - Hosts: 1.2.3.4 cairopt.net
O1 - Hosts: 1.2.3.4 castlecops.com
O1 - Hosts: 1.2.3.4 castlecrops.com
O1 - Hosts: 1.2.3.4 cddchiangmai.net
O1 - Hosts: 1.2.3.4 cddchiangmai.net
O1 - Hosts: 1.2.3.4 cert.inteco.es
O1 - Hosts: 1.2.3.4 cfan.com.cn
O1 - Hosts: 1.2.3.4 changedetection.com
O1 - Hosts: 1.2.3.4 changelog.fr
O1 - Hosts: 1.2.3.4 chkrootkit.org
O1 - Hosts: 1.2.3.4 cisrt.org
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [9298] C:\DOCUME~1\Kacka\LOCALS~1\Temp\abhhqq.exe
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [syncman] c:\windows\system32\wuaucldt.exe
O4 - HKLM\..\Run: [Calc32] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ocdglhq.exe
O4 - HKLM\..\Run: [syre32] C:\WINDOWS\system32\syre32.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\system32\logon.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\system32\.exe
O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\cidrive32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Administrator\reader_s.exe
O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
O4 - HKCU\..\Run: [syncman] c:\documents and settings\administrator\wuaucldt.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\cidrive32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: ihaupd32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: winesm32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 Startup: zipdkg32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: ihaupd32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: winesm32.exe (User 'Kacka')
O4 - S-1-5-21-3086602011-2446779318-483012309-1006 User Startup: zipdkg32.exe (User 'Kacka')
O4 - Startup: ihaupd32.exe
O4 - Startup: zipdkg32.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: SuperHybridEngine.lnk = ?
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: app_dll.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED FREE\a2service.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: IpSec service (darkness) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
--
End of file - 12087 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-02-12 1372160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}]
Hotbar - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll [2009-09-15 537904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416]
{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - Hotbar - C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll [2009-09-15 537904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Regedit32"=C:\WINDOWS\system32\regedit.exe [2010-03-19 165376]
"9298"=C:\DOCUME~1\Kacka\LOCALS~1\Temp\abhhqq.exe [2010-03-22 23040]
"reader_s"=C:\WINDOWS\System32\reader_s.exe [2010-03-22 28672]
"syncman"=c:\windows\system32\wuaucldt.exe [2010-03-22 27648]
"Calc32"=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ocdglhq.exe []
"syre32"=C:\WINDOWS\system32\syre32.exe [2010-03-22 208896]
"Windows Logon Application"=C:\WINDOWS\system32\logon.exe [2008-04-14 146432]
""=C:\WINDOWS\system32\.exe [2010-03-22 208896]
"Microsoft Driver Setup"=C:\WINDOWS\cidrive32.exe [2010-03-22 135168]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Microsoft Driver Setup"=C:\WINDOWS\cidrive32.exe [2010-03-22 135168]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2010-03-22 27648]
"reader_s"=C:\Documents and Settings\Administrator\reader_s.exe [2010-03-22 28672]
"12CFG214-K641-12SF-N85P"=C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe [2010-03-22 102400]
"syncman"=c:\documents and settings\administrator\wuaucldt.exe [2010-03-22 27648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
SuperHybridEngine.lnk - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
ihaupd32.exe
zipdkg32.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="app_dll.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe"="C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\WINDOWS\Temp\~TM57.tmp"="C:\WINDOWS\Temp\~TM57.tmp:*:Enabled:services"
"C:\WINDOWS\Temp\~TMC.tmp"="C:\WINDOWS\Temp\~TMC.tmp:*:Enabled:services"
"C:\WINDOWS\system32\Sysinfo.exe"="C:\WINDOWS\system32\Sysinfo.exe:*:Enabled:sysupdate"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"\"="C:\WINDOWS\system\svchost.exe:*:Enabled:KL"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\setupSNK.exe
======File associations======
.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2013-08-25 23:27:58 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2013-08-25 23:27:58 ----A---- C:\WINDOWS\SkyTel.exe
2013-08-25 23:27:58 ----A---- C:\WINDOWS\RtlUpd.exe
2013-08-25 23:27:57 ----A---- C:\WINDOWS\RTLCPL.EXE
2013-08-25 23:27:55 ----A---- C:\WINDOWS\RTHDCPL.EXE
2013-08-25 23:27:55 ----A---- C:\WINDOWS\MicCal.exe
2013-08-25 23:27:54 ----D---- C:\Program Files\Realtek
2013-08-25 23:27:54 ----A---- C:\WINDOWS\ALCWZRD.EXE
2013-08-25 23:27:54 ----A---- C:\WINDOWS\ALCMTR.EXE
2013-08-25 23:27:39 ----A---- C:\WINDOWS\RtlExUpd.dll
2013-08-17 21:22:50 ----A---- C:\WINDOWS\system32\DetectDevice.txt
2013-08-11 23:14:29 ----A---- C:\WINDOWS\system32\wmpns.dll
2013-08-11 23:12:48 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2012-09-18 09:11:00 ----A---- C:\WINDOWS\system32\btw_ci.dll
2012-09-18 09:10:54 ----D---- C:\Program Files\WIDCOMM
2011-09-11 16:59:53 ----D---- C:\Program Files\EeePC
2011-09-11 16:17:29 ----D---- C:\Program Files\Elantech
2010-03-22 22:23:22 ----D---- C:\rsit
2010-03-22 22:03:41 ----RSH---- C:\WINDOWS\cidrive32.exe
2010-03-22 21:56:01 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
2010-03-22 21:54:56 ----A---- C:\WINDOWS\system32\.exe
2010-03-22 21:52:32 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-22 21:52:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-03-22 21:52:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2010-03-22 21:49:08 ----A---- C:\WINDOWS\system32\app_dll.dll
2010-03-22 21:47:39 ----A---- C:\WINDOWS\fn0oxom410fpdatx5xx447ni.ini
2010-03-22 21:47:05 ----A---- C:\WINDOWS\system32\syre32.exe
2010-03-22 21:46:49 ----A---- C:\WINDOWS\system32\reader_s.exe
2010-03-22 21:46:49 ----A---- C:\WINDOWS\system32\reader_s .exe
2010-03-22 21:25:00 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Mozilla
2010-03-22 21:20:57 ----D---- C:\Program Files\Mozilla Firefox
2010-03-22 21:19:17 ----D---- C:\Program Files\Trend Micro
2010-03-22 20:58:56 ----D---- C:\Program Files\CCleaner
2010-03-22 20:01:18 ----A---- C:\WINDOWS\system32\MRT.INI
2010-03-22 19:51:16 ----A---- C:\WINDOWS\system32\MRT.exe
2010-03-22 19:44:06 ----D---- C:\Program Files\a-squared Free
2010-03-22 18:38:32 ----ASH---- C:\Documents and Settings\Administrator\Data aplikací\desktop.ini
2010-03-22 18:38:26 ----D---- C:\Documents and Settings\Administrator\Data aplikací\InstallShield
2010-03-22 18:38:26 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Identities
2010-03-22 18:38:25 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2010-03-22 18:38:25 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Sun
2010-03-22 18:38:25 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2010-03-22 18:37:31 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-21 01:15:53 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-19 20:57:35 ----SHD---- C:\Config.Msi
2010-03-19 06:12:38 ----A---- C:\WINDOWS\system32\regedit.exe
2010-03-19 05:04:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\21773727
2010-03-19 05:04:21 ----A---- C:\WINDOWS\system32\wuaucldt.exe
2010-03-19 05:04:21 ----A---- C:\WINDOWS\system32\wuaucldt .exe
2010-03-17 22:44:53 ----A---- C:\WINDOWS\system32\nethlp.dll
2010-03-11 03:01:03 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-02-25 11:08:12 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
======List of files/folders modified in the last 1 months======
2013-08-25 23:28:10 ----D---- C:\WINDOWS\system32\RTCOM
2013-08-25 23:27:39 ----A---- C:\WINDOWS\HideWin.exe
2013-08-13 03:29:47 ----D---- C:\WINDOWS\system32\ReinstallBackups
2012-09-18 10:32:30 ----D---- C:\WINDOWS\repair
2012-09-18 10:32:29 ----D---- C:\WINDOWS\system32\Restore
2012-09-18 09:18:16 ----A---- C:\WINDOWS\oemver.txt
2011-09-11 16:59:53 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-03-22 22:22:57 ----RD---- C:\Program Files
2010-03-22 22:14:21 ----D---- C:\WINDOWS\system32\drivers
2010-03-22 22:07:47 ----D---- C:\WINDOWS\Temp
2010-03-22 22:03:41 ----D---- C:\WINDOWS
2010-03-22 22:03:36 ----RSHD---- C:\RECYCLER
2010-03-22 21:55:02 ----D---- C:\WINDOWS\system32
2010-03-22 21:49:09 ----D---- C:\Program Files\Adobe
2010-03-22 21:49:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-22 21:47:48 ----A---- C:\WINDOWS\system32\ctfmon.exe
2010-03-22 21:47:39 ----HD---- C:\WINDOWS\inf
2010-03-22 21:47:31 ----D---- C:\Program Files\Internet Explorer
2010-03-22 21:12:28 ----D---- C:\Program Files\KaM - The Peasants Rebellion
2010-03-22 21:07:06 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-22 21:01:31 ----D---- C:\WINDOWS\Debug
2010-03-22 20:00:12 ----D---- C:\WINDOWS\Prefetch
2010-03-22 19:44:54 ----SD---- C:\WINDOWS\Tasks
2010-03-22 18:38:21 ----D---- C:\Documents and Settings
2010-03-19 20:57:49 ----SHD---- C:\WINDOWS\Installer
2010-03-19 20:06:21 ----SHD---- C:\System Volume Information
2010-03-19 20:05:57 ----D---- C:\WINDOWS\system
2010-03-19 20:05:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-18 20:10:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\HotbarSA
2010-03-11 03:02:45 ----A---- C:\WINDOWS\win.ini
2010-03-11 03:01:04 ----D---- C:\Program Files\Movie Maker
2010-03-11 03:00:43 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-06 11:56:39 ----D---- C:\WINDOWS\Help
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2008-04-08 10752]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 Ktp;Elantech Smart-Pad; C:\WINDOWS\system32\DRIVERS\ETD.sys [2008-08-25 26112]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-03-11 36864]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 cdfss;cdfss; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cdfss []
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
S1 KGootkit;KGootkit; C:\WINDOWS\System32\drivers\KGootkit.sys [2010-03-22 69120]
S1 wcscd;wcscd; C:\WINDOWS\system32\drivers\wcscd.sys [2010-03-22 29536]
S2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
S2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2008-04-14 63232]
S2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2008-04-14 55936]
S3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-05-03 546976]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2008-05-30 534568]
S3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-02-04 37160]
S3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-08-19 991656]
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-07-24 182656]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-08-19 47272]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-22 21568]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-12-19 5854688]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-08-12 4751360]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 RT80x86;Ralink 802.11n Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2860.sys [2008-03-28 625024]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 uxkx1;ASUS My Cinema U3100 Mini DVBT; C:\WINDOWS\system32\DRIVERS\uxkx1.sys [2008-02-15 459264]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
S2 a2free;a-squared Free Service; C:\PROGRAM FILES\A-SQUARED FREE\a2service.exe [2009-10-01 1858144]
S2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2009-09-28 109056]
S2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-09-02 346720]
S2 darkness;IpSec service; C:\WINDOWS\system\svchost.exe []
S2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Služba Čtení deníku USN sdílených složek programu Messenger; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
-----------------EOF-----------------