Restartování místo vypnutí Win XP

[welbern]

Zdravim. Mam problem, když chcivypnout PC tak se mi jen zrastartuje. Zakazal sem restart v nastaveni a skače na mě teď modrá obrazovka s touto hláškou:

STOP: c000021a
Proces Windows logon Process neočekávaně skončil se stavem 0x00000000(0x00000000 0x00000000)
Zavažná chyba systemu
System byl vypnut

nevim jestli je to chyba softwaru ci hardwaru tak přikládám log. Díky moc za pomoc

Logfile of random's system information tool 1.06 (written by random/random)
Run by uživatel at 2010-03-24 16:51:54
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (7%) free of 153 GB
Total RAM: 2047 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51:57, on 24.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
E:\Programy\RSIT.exe
C:\Program Files\trend micro\uživatel.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Cm112Sound] RunDll32 cm112.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: wingew32 - C:\WINDOWS\SYSTEM32\wingew32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

--
End of file - 6952 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-08 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-12-08 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-10-30 16269312]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"Cm112Sound"=RunDll32 cm112.cpl,CMICtrlWnd []
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-06-19 570664]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe /background []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wingew32]
C:\WINDOWS\system32\wingew32.dll [2010-03-21 39936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"E:\Games\Wotlk\Repair.exe"="E:\Games\Wotlk\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"c:\program files\skype\phone\skype .exe"="c:\program files\skype\phone\skype .exe:*:Enabled:skype "
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-21 19:25:21 ----A---- C:\WINDOWS\system32\wingew32.dll
2010-03-16 12:47:48 ----D---- C:\Documents and Settings\uživatel\Data aplikací\Recruitment Viewer
2010-03-05 22:44:41 ----D---- C:\Program Files\Common Files\Blizzard Entertainment

======List of files/folders modified in the last 1 months======

2010-03-24 16:51:55 ----D---- C:\Program Files\trend micro
2010-03-24 16:47:13 ----D---- C:\Program Files\Mozilla Firefox
2010-03-24 16:46:51 ----D---- C:\WINDOWS\Temp
2010-03-24 16:46:23 ----D---- C:\Documents and Settings\uživatel\Data aplikací\Skype
2010-03-24 16:43:34 ----RD---- C:\Program Files
2010-03-24 16:43:33 ----SHD---- C:\RECYCLER
2010-03-24 16:41:37 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-24 16:28:32 ----D---- C:\WINDOWS\system32\drivers
2010-03-24 16:16:52 ----D---- C:\WINDOWS\Prefetch
2010-03-24 16:01:37 ----D---- C:\Documents and Settings\uživatel\Data aplikací\skypePM
2010-03-23 23:12:30 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-22 19:30:31 ----D---- C:\FOTO
2010-03-22 01:50:20 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-21 19:38:48 ----D---- C:\WINDOWS\system32
2010-03-21 19:38:46 ----D---- C:\WINDOWS
2010-03-21 19:38:36 ----HD---- C:\WINDOWS\inf
2010-03-20 18:08:33 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-16 12:48:16 ----RSD---- C:\WINDOWS\Fonts
2010-03-15 22:34:20 ----SHD---- C:\WINDOWS\Installer
2010-03-14 19:46:16 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-14 16:28:59 ----RD---- C:\DOKUMENTY
2010-03-05 22:44:41 ----D---- C:\Program Files\Common Files
2010-02-28 18:54:37 ----D---- C:\Documents and Settings\uživatel\Data aplikací\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2009-12-15 43672]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-11-16 96408]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SbFw;SbFw; C:\WINDOWS\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-03-18 51088]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-03-18 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-03-18 21744]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-03 4394496]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-03-06 58752]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-03-06 19968]
R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 ahhjmmnt;ahhjmmnt; C:\WINDOWS\system32\drivers\ahhjmmnt.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\UIVATE~1\LOCALS~1\Temp\catchme.sys []
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-09-28 7168]
S3 USBADVAU;USB Advance Audio Interface; C:\WINDOWS\system32\drivers\cm112.sys [2007-07-20 1312768]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-30 602112]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-11-16 735960]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-08 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2009-09-06 71096]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S2 P1C1394;Phase One 1394 Camera Driver; C:\WINDOWS\System32\Drivers\p1c1394.sys []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-11-16 20680]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-12-11 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[welbern]

ComboFix 10-03-24.01 - uživatel 24.03.2010 20:18:45.10.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1650 [GMT 1:00]
Spuštěný z: c:\documents and settings\uživatel\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Drivers\ljqirvlh.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-24 do 2010-03-24 )))))))))))))))))))))))))))))))
.

2010-03-21 18:25 . 2010-03-21 18:25 39936 ----a-w- c:\windows\system32\wingew32.dll
2010-03-05 21:44 . 2010-03-05 21:44 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-24 15:51 . 2010-01-24 17:56 -------- d-----w- c:\program files\trend micro
2010-03-14 18:46 . 2009-12-01 11:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-07 17:11 . 2010-02-07 17:09 -------- d-----w- c:\program files\Common Files\Nero
2010-02-07 17:09 . 2010-02-07 17:09 -------- d-----w- c:\program files\Nero
2010-02-03 18:35 . 2009-12-05 09:43 -------- d-----r- c:\program files\Skype
2010-01-27 02:41 . 2010-01-24 20:01 -------- d-----w- c:\program files\Spyware Terminator
2010-01-27 00:08 . 2010-01-27 00:08 -------- d-----w- c:\program files\ESET
2010-01-26 23:26 . 2010-01-26 22:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-26 23:25 . 2009-12-05 16:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-26 02:47 . 2010-01-26 02:47 -------- d-----w- c:\program files\Sunbelt Software
2010-01-25 22:59 . 2001-10-25 14:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2010-01-25 22:59 . 2001-10-25 14:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2010-01-07 15:07 . 2010-01-26 23:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-26 23:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
.

Kód: Vybrat vše

<pre>
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Adobe\Updater5\adobeupdater .exe
c:\program files\ESET\ESET NOD32 Antivirus\egui .exe
c:\program files\HP\hpcoretech\hpcmpmgr .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\Microsoft Office\Office12\groovemonitor .exe
c:\program files\Skype\Phone\skype .exe
c:\program files\Spyware Terminator\spywareterminatorupdate .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb09 .exe
</pre>

((((((((((((((((((((((((((((( SnapShot@2010-01-24_21.03.36 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-07 17:14 . 2010-02-07 17:14 82432 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2010-03-24 19:16 . 2010-03-24 19:16 16384 c:\windows\Temp\Perflib_Perfdata_1c0.dat
+ 2004-08-11 00:45 . 2004-08-11 00:45 10752 c:\windows\system32\wpdtrace.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 66560 c:\windows\system32\wpdmtpus.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 61952 c:\windows\system32\wpdconns.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 38912 c:\windows\system32\wpd_ci.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 34304 c:\windows\system32\WMDMPS.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 30208 c:\windows\system32\WMDMLOG.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 38912 c:\windows\system32\wdfmgr.exe
+ 2004-08-11 00:45 . 2004-08-11 00:45 15872 c:\windows\system32\wdfapi.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 47104 c:\windows\system32\uwdf.exe
- 2001-10-25 14:00 . 2010-01-17 16:45 67448 c:\windows\system32\perfc009.dat
+ 2001-10-25 14:00 . 2010-01-25 22:59 67448 c:\windows\system32\perfc009.dat
+ 2008-06-06 13:54 . 2008-06-06 13:54 95600 c:\windows\system32\NeroCo.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 25088 c:\windows\system32\MsPMSNSv.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 96768 c:\windows\system32\logagent.exe
+ 2006-12-19 09:30 . 2006-12-19 09:30 81920 c:\windows\system32\IoctlSvc.exe
+ 2004-08-17 13:49 . 2004-08-11 00:45 95232 c:\windows\system32\drmstor.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 18944 c:\windows\system32\drivers\wpdusb.sys
+ 2008-06-21 03:54 . 2008-06-21 03:54 66600 c:\windows\system32\drivers\sbhips.sys
+ 2010-01-26 02:47 . 2008-06-21 03:54 65576 c:\windows\system32\drivers\SbFwIm.sys
+ 2008-06-08 08:37 . 2008-06-08 08:37 11304 c:\windows\system32\drivers\imagedrv.sys
+ 2009-11-16 08:06 . 2009-11-16 08:06 96408 c:\windows\system32\drivers\epfwtdir.sys
+ 2004-08-17 13:49 . 2004-08-11 00:45 34304 c:\windows\system32\dllcache\wmdmps.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 30208 c:\windows\system32\dllcache\wmdmlog.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 33792 c:\windows\system32\dllcache\tabletoc.dll
+ 2004-08-17 13:48 . 2008-04-13 21:13 62976 c:\windows\system32\dllcache\spgrmr.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 69632 c:\windows\system32\dllcache\oledb32r.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 17408 c:\windows\system32\dllcache\ocmsn.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 15872 c:\windows\system32\dllcache\ocgen.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 62976 c:\windows\system32\dllcache\ntoc.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 77312 c:\windows\system32\dllcache\netoc.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 57344 c:\windows\system32\dllcache\ndisnpp.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 24576 c:\windows\system32\dllcache\msxactps.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 25088 c:\windows\system32\dllcache\mspmsnsv.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 39936 c:\windows\system32\dllcache\mslwvtts.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 15360 c:\windows\system32\dllcache\msgrocm.dll
+ 2001-10-25 14:00 . 2008-04-14 07:51 90112 c:\windows\system32\dllcache\msdtcstp.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 36864 c:\windows\system32\dllcache\msdfmap.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 20480 c:\windows\system32\dllcache\msdatt.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 94208 c:\windows\system32\dllcache\msdatl3.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msdasqlr.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msdaremr.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msdaprsr.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 77824 c:\windows\system32\dllcache\msdaosp.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msdaorar.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 57344 c:\windows\system32\dllcache\msadrh15.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 57344 c:\windows\system32\dllcache\msador15.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 28672 c:\windows\system32\dllcache\msader15.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 24576 c:\windows\system32\dllcache\msaddsr.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 53248 c:\windows\system32\dllcache\msadcs.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msadcor.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 16384 c:\windows\system32\dllcache\msadcfr.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 61440 c:\windows\system32\dllcache\msadcf.dll
+ 2009-12-01 16:02 . 2007-03-28 17:23 20480 c:\windows\system32\dllcache\msadcer.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 16896 c:\windows\system32\dllcache\medctroc.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 96768 c:\windows\system32\dllcache\logagent.exe
+ 2004-08-17 13:49 . 2008-04-14 07:51 19968 c:\windows\system32\dllcache\log.dll
+ 2009-12-01 16:02 . 2008-04-14 07:52 20480 c:\windows\system32\dllcache\inetwiz.exe
+ 2009-12-01 16:02 . 2008-04-14 07:52 93184 c:\windows\system32\dllcache\iexplore.exe
+ 2009-12-01 16:02 . 2008-04-14 07:52 18432 c:\windows\system32\dllcache\iedw.exe
+ 2009-12-01 16:02 . 2008-04-14 07:52 24576 c:\windows\system32\dllcache\icwrmind.exe
+ 2009-12-01 16:02 . 2008-04-14 07:51 32768 c:\windows\system32\dllcache\icwdl.dll
+ 2009-12-01 16:02 . 2008-04-14 07:52 86016 c:\windows\system32\dllcache\icwconn2.exe
+ 2009-12-01 16:02 . 2008-04-14 07:51 38912 c:\windows\system32\dllcache\hmmapi.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 32828 c:\windows\system32\dllcache\fp40ext.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 95232 c:\windows\system32\dllcache\drmstor.dll
+ 2009-12-01 11:25 . 2008-04-13 21:14 17920 c:\windows\system32\dllcache\cobramsg.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 24064 c:\windows\system32\dllcache\agtintl.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 20480 c:\windows\system32\dllcache\agt0c0a.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 20992 c:\windows\system32\dllcache\agt0816.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt041f.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt041d.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt0419.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 20480 c:\windows\system32\dllcache\agt0416.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt0415.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt0414.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 20992 c:\windows\system32\dllcache\agt0413.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 20992 c:\windows\system32\dllcache\agt0410.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 19968 c:\windows\system32\dllcache\agt040e.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 21504 c:\windows\system32\dllcache\agt040c.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt040b.dll
+ 2001-10-25 14:00 . 2008-04-13 22:02 19968 c:\windows\system32\dllcache\agt0409.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 22016 c:\windows\system32\dllcache\agt0408.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 21504 c:\windows\system32\dllcache\agt0407.dll
+ 2001-10-25 14:00 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt0406.dll
+ 2009-12-01 16:52 . 2007-04-02 22:56 19456 c:\windows\system32\dllcache\agt0405.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 44032 c:\windows\system32\dllcache\agentsr.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 49152 c:\windows\system32\dllcache\agentmpx.dll
+ 2006-10-02 16:20 . 2008-04-14 07:51 57344 c:\windows\system32\dllcache\agentdpv.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 24064 c:\windows\system32\dllcache\agentanm.dll
+ 2010-01-25 12:30 . 2010-01-25 13:05 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010012520100126\index.dat
+ 2010-01-25 12:30 . 2010-01-25 12:30 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010011820100125\index.dat
+ 2009-12-01 16:14 . 2010-01-26 17:52 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-12-01 16:14 . 2010-01-24 20:47 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-01-25 12:47 . 2010-01-25 12:47 16384 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Microsoft\Internet Explorer\MSIMGSIZ.DAT
+ 2010-02-07 17:07 . 2004-08-11 00:45 95232 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmstor.dll
+ 2010-02-07 17:07 . 2008-04-14 07:51 87040 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmstor.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 96768 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe
+ 2010-02-07 17:08 . 2004-08-11 00:45 18944 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdusb.sys
+ 2010-02-07 17:08 . 2004-08-11 00:45 10752 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdtrace.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 66560 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpus.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 61952 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdconns.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 38912 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpd_ci.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 38912 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe
+ 2010-02-07 17:08 . 2004-08-11 00:45 15872 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfapi.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 47104 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe
+ 2010-02-07 17:08 . 2004-08-11 00:45 34304 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMPS.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 30208 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMLOG.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 25088 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 23552 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMPS.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 27136 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMLOG.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 52224 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
+ 2010-01-26 02:47 . 2010-01-26 02:47 57344 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
+ 2010-01-26 02:47 . 2010-01-26 02:47 18718 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
+ 2010-01-26 02:47 . 2010-01-26 02:47 18718 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\ARPPRODUCTICON.exe
+ 2010-01-27 00:09 . 2010-01-27 00:09 10134 c:\windows\Installer\{621EB5F7-B871-47C0-AB53-E1376E71D858}\callmsi.exe
+ 2004-08-17 13:49 . 2004-08-11 00:45 6656 c:\windows\system32\laprxy.dll
- 2004-08-17 13:49 . 2008-04-14 07:51 6656 c:\windows\system32\laprxy.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 5632 c:\windows\system32\dllcache\wmm2res2.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 7680 c:\windows\system32\dllcache\wmm2ext.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 4096 c:\windows\system32\dllcache\wmm2eres.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 4096 c:\windows\system32\dllcache\msdaurl.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 4096 c:\windows\system32\dllcache\msdasc.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 4096 c:\windows\system32\dllcache\msdaer.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 4096 c:\windows\system32\dllcache\msdaenum.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 4096 c:\windows\system32\dllcache\msdadc.dll
- 2004-08-17 13:49 . 2008-04-14 07:51 6656 c:\windows\system32\dllcache\laprxy.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 6656 c:\windows\system32\dllcache\laprxy.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 6656 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\laprxy.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 6656 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\laprxy.dll
+ 2010-03-15 21:34 . 2010-03-15 21:34 3262 c:\windows\Installer\{29BA43D8-07F9-4D78-A682-91BAAA98A302}\ARPPRODUCTICON.exe
+ 2008-06-06 13:54 . 2008-06-06 13:54 972072 c:\windows\UNRecode.exe
+ 2007-03-21 20:02 . 2007-03-21 20:02 972336 c:\windows\UNNeroVision.exe
+ 2007-02-28 15:41 . 2007-02-28 15:41 972336 c:\windows\UNNeroShowTime.exe
+ 2008-06-24 15:06 . 2008-06-24 15:06 972072 c:\windows\UNNeroMediaHome.exe
+ 2007-03-20 20:22 . 2007-03-20 20:22 972336 c:\windows\UNNeroBackItUp.exe
+ 2004-08-11 00:45 . 2004-08-11 00:45 327680 c:\windows\system32\wpdsp.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 331776 c:\windows\system32\wpdmtpdr.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 114176 c:\windows\system32\wpdmtp.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 999424 c:\windows\system32\wmvdmoe2.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 871160 c:\windows\system32\wmvdmod.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 936960 c:\windows\system32\wmspdmoe.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 531192 c:\windows\system32\wmspdmod.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 773368 c:\windows\system32\wmsdmod.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 150016 c:\windows\system32\wmidx.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 290816 c:\windows\system32\WMDRMNet.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 344064 c:\windows\system32\WMDRMdev.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 229376 c:\windows\system32\wmasf.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 712704 c:\windows\system32\wmadmoe.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 380144 c:\windows\system32\wmadmod.dll
+ 2006-03-17 14:49 . 2006-03-17 14:49 368640 c:\windows\system32\TwnLib4.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 221184 c:\windows\system32\qasf.dll
- 2001-10-25 14:00 . 2010-01-17 16:45 432492 c:\windows\system32\perfh009.dat
+ 2001-10-25 14:00 . 2010-01-25 22:59 432492 c:\windows\system32\perfh009.dat
+ 2004-08-17 13:49 . 2004-08-11 00:45 311296 c:\windows\system32\MSWMDM.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 360176 c:\windows\system32\MSSCP.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 169472 c:\windows\system32\MsPMSP.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 141312 c:\windows\system32\msnetobj.dll
+ 2006-03-17 11:45 . 2006-03-17 11:45 802816 c:\windows\system32\imagXRA7.dll
+ 2006-03-17 11:45 . 2006-03-17 11:45 258048 c:\windows\system32\imagXR7.dll
+ 2006-03-17 11:45 . 2006-03-17 11:45 497296 c:\windows\system32\imagXpr7.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 527360 c:\windows\system32\drmv2clt.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 253688 c:\windows\system32\drmclien.dll
+ 2010-01-26 02:47 . 2008-10-31 06:09 270888 c:\windows\system32\drivers\SbFw.sys
+ 2008-06-08 08:37 . 2008-06-08 08:37 132904 c:\windows\system32\drivers\imagesrv.sys
+ 2009-11-16 08:03 . 2009-11-16 08:03 108792 c:\windows\system32\drivers\ehdrv.sys
+ 2009-11-16 07:56 . 2009-11-16 07:56 116520 c:\windows\system32\drivers\eamon.sys
+ 2004-08-17 13:49 . 2004-08-11 00:45 999424 c:\windows\system32\dllcache\wmvdmoe2.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 871160 c:\windows\system32\dllcache\wmvdmod.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 936960 c:\windows\system32\dllcache\wmspdmoe.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 531192 c:\windows\system32\dllcache\wmspdmod.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 773368 c:\windows\system32\dllcache\wmsdmod.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 325632 c:\windows\system32\dllcache\wmm2fxb.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 502272 c:\windows\system32\dllcache\wmm2fxa.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 402432 c:\windows\system32\dllcache\wmm2filt.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 167936 c:\windows\system32\dllcache\wmm2ae.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 150016 c:\windows\system32\dllcache\wmidx.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 229376 c:\windows\system32\dllcache\wmasf.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 712704 c:\windows\system32\dllcache\wmadmoe.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 380144 c:\windows\system32\dllcache\wmadmod.dll
+ 2009-12-01 16:03 . 2008-04-14 07:52 851968 c:\windows\system32\dllcache\vgx.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 131072 c:\windows\system32\dllcache\tsoc.dll
+ 2009-12-01 16:02 . 2008-04-14 07:52 153088 c:\windows\system32\dllcache\triedit.dll
+ 2009-12-01 11:25 . 2008-04-14 07:52 173568 c:\windows\system32\dllcache\sysmoda.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 193536 c:\windows\system32\dllcache\sysmod.dll
+ 2009-12-01 16:02 . 2008-04-14 07:52 217088 c:\windows\system32\dllcache\sqlxmlx.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 110592 c:\windows\system32\dllcache\sqlse20.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 462848 c:\windows\system32\dllcache\sqlqp20.dll
+ 2004-08-17 13:49 . 2008-04-14 07:52 151552 c:\windows\system32\dllcache\sqldb20.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 130048 c:\windows\system32\dllcache\softkbd.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 101888 c:\windows\system32\dllcache\setupqry.dll
+ 2009-12-01 11:25 . 2008-04-14 07:51 199680 c:\windows\system32\dllcache\scripta.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 216576 c:\windows\system32\dllcache\script.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 221184 c:\windows\system32\dllcache\qasf.dll
+ 2009-12-01 16:01 . 2008-04-14 07:52 282112 c:\windows\system32\dllcache\pinball.exe
+ 2009-12-01 16:03 . 2008-04-14 07:51 102912 c:\windows\system32\dllcache\pchshell.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 311296 c:\windows\system32\dllcache\mswmdm.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 360176 c:\windows\system32\dllcache\msscp.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 169472 c:\windows\system32\dllcache\mspmsp.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 141312 c:\windows\system32\dllcache\msnetobj.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 170496 c:\windows\system32\dllcache\msmqocm.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 102400 c:\windows\system32\dllcache\msjro.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 315392 c:\windows\system32\dllcache\msdasql.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 118784 c:\windows\system32\dllcache\msdarem.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 204800 c:\windows\system32\dllcache\msdaps.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 200704 c:\windows\system32\dllcache\msdaprst.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 233472 c:\windows\system32\dllcache\msdaora.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 220160 c:\windows\system32\dllcache\mscandui.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 180224 c:\windows\system32\dllcache\msadomd.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 155648 c:\windows\system32\dllcache\msadds.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 143360 c:\windows\system32\dllcache\msadco.dll
+ 2009-12-01 16:02 . 2008-04-14 07:51 331776 c:\windows\system32\dllcache\msadce.dll
+ 2009-12-01 11:25 . 2008-04-14 07:51 261120 c:\windows\system32\dllcache\migisma.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 274432 c:\windows\system32\dllcache\migism.dll
+ 2001-10-25 14:00 . 2008-04-14 07:51 124928 c:\windows\system32\dllcache\imsinsnt.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 506880 c:\windows\system32\dllcache\iis.dll
+ 2009-12-01 11:25 . 2008-04-14 07:51 115200 c:\windows\system32\dllcache\guitrna.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 133632 c:\windows\system32\dllcache\guitrn.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 132608 c:\windows\system32\dllcache\fxsocm.dll
+ 2009-12-01 16:06 . 2008-04-14 07:51 618605 c:\windows\system32\dllcache\fp4autl.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 527360 c:\windows\system32\dllcache\drmv2clt.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 253688 c:\windows\system32\dllcache\drmclien.dll
+ 2009-12-01 16:02 . 2008-01-19 15:34 554008 c:\windows\system32\dllcache\dao360.dll
+ 2001-10-25 14:00 . 2008-04-14 07:51 274944 c:\windows\system32\dllcache\comsetup.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 161792 c:\windows\system32\dllcache\cewmdm.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 233472 c:\windows\system32\dllcache\blackbox.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 214016 c:\windows\system32\dllcache\agentctl.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 116224 c:\windows\system32\dllcache\acxtrnal.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 245248 c:\windows\system32\dllcache\acspecfc.dll
+ 2004-08-17 13:49 . 2008-04-14 07:51 141312 c:\windows\system32\dllcache\aclua.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 161792 c:\windows\system32\cewmdm.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 233472 c:\windows\system32\blackbox.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 141312 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\msnetobj.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 527360 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmv2clt.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 253688 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmclien.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 233472 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\blackbox.dll
+ 2010-02-07 17:07 . 2008-04-14 07:53 259072 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\msnetobj.dll
+ 2010-02-07 17:07 . 2008-04-14 07:53 695808 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmv2clt.dll
+ 2010-02-07 17:07 . 2008-04-14 07:53 299520 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmclien.dll
+ 2010-02-07 17:07 . 2008-04-14 07:51 286720 c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\blackbox.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 999424 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvdmoe2.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 936960 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmspdmoe.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 150016 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmidx.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 290816 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMNet.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 344064 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMdev.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 229376 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmasf.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 712704 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmadmoe.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 221184 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\qasf.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 897024 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmspdmoe.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 151552 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmidx.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 230912 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmasf.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 670720 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmadmoe.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 237568 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\qasf.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 103936 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe
+ 2010-02-07 17:07 . 2004-08-11 00:45 871160 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvdmod.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 531192 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmspdmod.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 773368 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmsdmod.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 380144 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmadmod.dll
+ 2010-02-07 17:07 . 2008-04-14 07:52 809984 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmvdmod.dll
+ 2010-02-07 17:07 . 2008-04-14 07:52 485376 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmspdmod.dll
+ 2010-02-07 17:07 . 2008-04-14 07:52 759296 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmsdmod.dll
+ 2010-02-07 17:07 . 2008-04-14 07:52 408064 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmadmod.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 327680 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdsp.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 331776 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpdr.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 114176 c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtp.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 311296 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSWMDM.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 360176 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSSCP.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 169472 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSP.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 161792 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\cewmdm.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 245760 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSWMDM.dll
+ 2010-02-07 17:08 . 2008-04-14 07:53 356352 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSSCP.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 201728 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSP.dll
+ 2010-02-07 17:08 . 2008-04-14 07:51 159232 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\cewmdm.dll
+ 2010-01-26 02:47 . 2010-01-26 02:47 481280 c:\windows\Installer\249c24.msi
+ 2010-02-21 22:59 . 2010-02-21 22:59 651264 c:\windows\Installer\2323c81.msi
+ 2010-02-07 17:14 . 2010-02-07 17:14 100352 c:\windows\Installer\1ca88a0.msi
- 2009-12-05 09:43 . 2009-12-05 09:43 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2010-02-05 18:29 . 2010-02-05 18:29 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2010-01-27 00:09 . 2010-01-27 00:09 101480 c:\windows\Installer\{621EB5F7-B871-47C0-AB53-E1376E71D858}\egui.exe
+ 2010-02-07 17:14 . 2010-02-07 17:14 1233920 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 2362104 c:\windows\system32\wmvcore.dll
+ 2004-08-11 00:45 . 2004-08-11 00:45 1509376 c:\windows\system32\WMVADVE.DLL
+ 2004-08-11 00:45 . 2004-08-11 00:45 1181944 c:\windows\system32\wmvadvd.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 1116160 c:\windows\system32\wmsdmoe2.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 1027072 c:\windows\system32\wmnetmgr.dll
+ 2003-04-18 15:46 . 2003-04-18 15:46 1233920 c:\windows\system32\msxml4.dll
+ 2006-03-17 11:45 . 2006-03-17 11:45 1757184 c:\windows\system32\imagX7.dll
+ 2009-12-01 16:49 . 2010-03-16 13:51 1550104 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-17 13:49 . 2004-08-11 00:45 2362104 c:\windows\system32\dllcache\wmvcore.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 1116160 c:\windows\system32\dllcache\wmsdmoe2.dll
+ 2004-08-17 13:49 . 2004-08-11 00:45 1027072 c:\windows\system32\dllcache\wmnetmgr.dll
+ 2009-12-01 11:25 . 2008-04-14 07:51 2134528 c:\windows\system32\dllcache\smtpsnap.dll
+ 2009-12-01 16:03 . 2008-04-14 07:51 3166208 c:\windows\system32\dllcache\msgr3en.dll
+ 2010-02-07 17:06 . 2006-03-31 11:40 2388176 c:\windows\system32\d3dx9_30.dll
+ 2010-02-07 17:06 . 2005-12-05 17:09 2323664 c:\windows\system32\d3dx9_28.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 2362104 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvcore.dll
+ 2010-02-07 17:08 . 2004-08-11 00:45 1509376 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMVADVE.DLL
+ 2010-02-07 17:07 . 2004-08-11 00:45 1116160 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmsdmoe2.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 1027072 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmnetmgr.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 1001472 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvdmoe2.dll
+ 2010-02-07 17:08 . 2008-04-14 07:53 2109440 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvcore.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 1119744 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmsdmoe2.dll
+ 2010-02-07 17:08 . 2008-04-14 07:52 1053184 c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmnetmgr.dll
+ 2010-02-07 17:07 . 2004-08-11 00:45 1181944 c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvadvd.dll
+ 2010-01-27 00:09 . 2010-01-27 00:09 1138176 c:\windows\Installer\21769.msi
+ 2010-02-07 17:11 . 2010-02-07 17:11 7782400 c:\windows\Installer\1ca8899.msi
+ 2010-03-15 21:34 . 2010-03-15 21:34 2564096 c:\windows\Installer\1020173.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"Cm112Sound"="cm112.cpl" [N/A]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide3"="rundll32 advpack.dll" [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingew32]
2010-03-21 18:25 39936 ----a-w- c:\windows\system32\wingew32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Games\\Wotlk\\Repair.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\program files\\skype\\phone\\skype .exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16.11.2009 9:06 96408]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [26.1.2010 3:47 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 4:54 66600]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16.11.2009 9:04 735960]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 7:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 7:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [26.1.2010 3:47 65576]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1.12.2009 13:52 721904]
S2 P1C1394;Phase One 1394 Camera Driver;c:\windows\system32\Drivers\p1c1394.sys --> c:\windows\system32\Drivers\p1c1394.sys [?]
S3 USBADVAU;USB Advance Audio Interface;c:\windows\system32\drivers\cm112.sys [5.12.2009 11:05 1312768]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\*
FF - ProfilePath - c:\documents and settings\uživatel\Data aplikací\Mozilla\Firefox\Profiles\d63ma1qq.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=971163&p=

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-24 20:25
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1072)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\wingew32.dll
.
Celkový čas: 2010-03-24 20:28:22
ComboFix-quarantined-files.txt 2010-03-24 19:28
ComboFix2.txt 2010-02-01 18:55
ComboFix3.txt 2010-01-27 01:42
ComboFix4.txt 2010-01-26 23:06
ComboFix5.txt 2010-03-24 19:17

Před spuštěním: Volných bajtů: 11 714 990 080
Po spuštění: Volných bajtů: 11 810 951 168

- - End Of File - - 85D2D8A142A611AF6C643E0D583D56B4

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\wingew32.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingew32]

RenV::
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe
c:\program files\AVG\AVG8\avgtray .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Adobe\Updater5\adobeupdater .exe
c:\program files\ESET\ESET NOD32 Antivirus\egui .exe
c:\program files\HP\hpcoretech\hpcmpmgr .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\Microsoft Office\Office12\groovemonitor .exe
c:\program files\Skype\Phone\skype .exe
c:\program files\Spyware Terminator\spywareterminatorupdate .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb09 .exe

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[welbern]

ComboFix 10-03-24.01 - uživatel 24.03.2010 22:00:03.11.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1567 [GMT 1:00]
Spuštěný z: c:\documents and settings\uživatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\uživatel\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Sunbelt Personal Firewall *enabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}

file zipped: c:\windows\system32\wingew32.dll
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\wingew32.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-24 do 2010-03-24 )))))))))))))))))))))))))))))))
.

2010-03-05 21:44 . 2010-03-05 21:44 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-24 20:59 . 2010-01-24 20:01 -------- d-----w- c:\program files\Spyware Terminator
2010-03-24 15:51 . 2010-01-24 17:56 -------- d-----w- c:\program files\trend micro
2010-03-14 18:46 . 2009-12-01 11:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-07 17:11 . 2010-02-07 17:09 -------- d-----w- c:\program files\Common Files\Nero
2010-02-07 17:09 . 2010-02-07 17:09 -------- d-----w- c:\program files\Nero
2010-02-03 18:35 . 2009-12-05 09:43 -------- d-----r- c:\program files\Skype
2010-01-27 00:08 . 2010-01-27 00:08 -------- d-----w- c:\program files\ESET
2010-01-26 23:26 . 2010-01-26 22:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-26 23:25 . 2009-12-05 16:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-26 02:47 . 2010-01-26 02:47 -------- d-----w- c:\program files\Sunbelt Software
2010-01-25 22:59 . 2001-10-25 14:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2010-01-25 22:59 . 2001-10-25 14:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2010-01-07 15:07 . 2010-01-26 23:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-26 23:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
.

Kód: Vybrat vše

<pre>
c:\program files\ESET\ESET NOD32 Antivirus\egui .exe
c:\program files\Skype\Phone\skype .exe
</pre>

((((((((((((((((((((((((((((( SnapShot_2010-03-24_19.25.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-24 21:08 . 2010-03-24 21:08 16384 c:\windows\Temp\Perflib_Perfdata_c14.dat
+ 2010-03-24 21:08 . 2010-03-24 21:08 16384 c:\windows\Temp\Perflib_Perfdata_90.dat
+ 2009-12-15 18:13 . 2004-05-04 14:21 176128 c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"Cm112Sound"="cm112.cpl" [N/A]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide3"="rundll32 advpack.dll" [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Games\\Wotlk\\Repair.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\program files\\skype\\phone\\skype .exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1.12.2009 13:52 721904]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16.11.2009 9:06 96408]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [26.1.2010 3:47 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 4:54 66600]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16.11.2009 9:04 735960]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 7:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 7:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [26.1.2010 3:47 65576]
S2 P1C1394;Phase One 1394 Camera Driver;c:\windows\system32\Drivers\p1c1394.sys --> c:\windows\system32\Drivers\p1c1394.sys [?]
S3 USBADVAU;USB Advance Audio Interface;c:\windows\system32\drivers\cm112.sys [5.12.2009 11:05 1312768]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\*
FF - ProfilePath - c:\documents and settings\uživatel\Data aplikací\Mozilla\Firefox\Profiles\d63ma1qq.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=971163&p=

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-24 22:08
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spro.sys >>UNKNOWN [0x8A56F938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9e66cb8
\Driver\atapi -> atapi.sys @ 0xb9dfbb40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578fa2
ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578fa2
ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9d04bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9d11a21
SendHandler -> NDIS.sys @ 0xb9cef87b
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDll32.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2010-03-24 22:13:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-24 21:12
ComboFix2.txt 2010-03-24 19:28
ComboFix3.txt 2010-02-01 18:55
ComboFix4.txt 2010-01-27 01:42
ComboFix5.txt 2010-03-24 20:58

Před spuštěním: Volných bajtů: 11 827 773 440
Po spuštění: Volných bajtů: 11 763 736 576

- - End Of File - - 5F096ADE1CDB31BCCD5ABC59FC264C97

[Rudy]

Vše smazáno. Ještě proveďte kontrolu MBR: http://www2.gmer.net/mbr/mbr.exe a dejte log. Dále vykoušejte, zda máte funkční antivir a Skype. V případě problémů aplikace přeinstalujte.