nejde internet

Zpráva

Janekas · #1 Příspěvek od **Janekas** » 07 dub 2010 14:16

Dobrý den,
prosím o pomoc se zatroleným pc. Je to pecko jednoho pařana, samá gamesa a úklid žádný. Původně byl naistalován jako antivirus AVG free a ten našel nějakou havěť. Následně uživatel vyzkoušel kdejaký antivir a on-line scaner. Každý si něco našel a teď je pc ve stavu rádoby čistém. Antivir už prý nic nenašel. Ale pc se chová tak, že nemůže na internet. Ale podivně. Očividně nefunguje DNS. IP adresu i DNS dostane pc přidělený správně. Ale stránku na netu nezobrazí, jen když zadám ip adresu. To samé ping na jméno ne, na ip ano. Síťové připojení jsem obnovil. Pak i lan kartu přeinstaloval. Nic. Ve službách je DNS spůštěná.

Takže jsem bezradný a tipl bych to na zavirovaný pc, ale v logu jsem mnoho nenašel. Proto prosím o pomoc, jestli máte někdo čas. Děkuji

Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr Hodač at 2010-04-07 14:36:48
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 102 GB (43%) free of 238 GB
Total RAM: 2047 MB (79% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{98C7E519-299A-47F2-A33D-4DDEE70115C5}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2009-05-20 1258808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2009-05-20 1258808]
Locked

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinSys2"=C:\WINDOWS\system32\winsys2.exe [2009-05-18 208896]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-10-23 233472]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-11-08 188416]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-22 116040]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-12-03 1265296]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-02-22 18791456]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-06-10 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
C:\Program Files\EXPERTool\TBPanel.exe [2009-05-12 2181672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]
C:\Program Files\MSI\Live Update 3\LMonitor.exe [2007-01-17 496640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusPortal]
C:\Program Files\Nexus Fire Walker\FireWalker.exe [2005-10-27 1533440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\steam\steam.exe [2010-02-20 1217872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\SweetIM\Messenger\SweetIM.exe [2009-05-20 111928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WRPCAgent]
C:\Program Files\WinSoftMagic\WinRemotePC\WRPCAgent.exe [2009-02-12 56320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DualCoreCenter.lnk]
C:\PROGRA~1\MSI\DUALCO~1\STARTU~1.EXE [2006-09-13 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Petr Hodač^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
C:\PROGRA~1\Hamachi\hamachi.exe [2009-08-25 625952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Petr Hodač^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
C:\PROGRA~1\OPENOF~1.3\program\QUICKS~1.EXE [2007-09-11 393216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Nexus Fire Walker\FireWalker.exe"="C:\Program Files\Nexus Fire Walker\FireWalker.exe:*:Enabled:Fire Walker - Remote Control Software"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com g:
shell\Open\command - G:\resycled\boot.com g:

======List of files/folders created in the last 1 months======

2010-04-07 14:36:49 ----D---- C:\Program Files\trend micro
2010-04-07 14:36:48 ----D---- C:\rsit
2010-04-02 19:35:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-02 19:25:15 ----D---- C:\WINDOWS\pss
2010-04-02 19:18:31 ----D---- C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP
2010-04-02 19:16:07 ----A---- C:\WINDOWS\system32\msvcr80.dll
2010-04-02 17:32:10 ----A---- C:\WINDOWS\vncutil.exe
2010-04-02 17:32:07 ----A---- C:\WINDOWS\system32\RtkCoInstXP.dll
2010-04-02 17:32:07 ----A---- C:\WINDOWS\RtkAudioService.exe
2010-04-02 17:27:33 ----A---- C:\WINDOWS\system32\CSVer.dll
2010-04-02 17:24:29 ----A---- C:\WINDOWS\system32\RTNUninst32.dll
2010-04-02 17:24:29 ----A---- C:\WINDOWS\system32\RtNicProp32.dll
2010-04-02 17:24:17 ----D---- C:\inst
2010-04-02 16:44:58 ----D---- C:\Program Files\Lavalys
2010-03-11 23:40:10 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$

======List of files/folders modified in the last 1 months======

2010-04-07 14:36:49 ----RD---- C:\Program Files
2010-04-07 14:35:30 ----D---- C:\Documents and Settings\Petr Hodač\Data aplikací\Skype
2010-04-07 14:34:13 ----D---- C:\WINDOWS\Temp
2010-04-07 14:33:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-07 14:31:52 ----D---- C:\WINDOWS\Prefetch
2010-04-07 14:29:42 ----D---- C:\WINDOWS\network diagnostic
2010-04-07 13:55:35 ----D---- C:\Documents and Settings\Petr Hodač\Data aplikací\skypePM
2010-04-07 13:55:31 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-07 13:55:30 ----HD---- C:\WINDOWS\inf
2010-04-06 19:17:57 ----D---- C:\WINDOWS
2010-04-06 14:24:15 ----D---- C:\WINDOWS\system32\drivers
2010-04-06 14:24:15 ----D---- C:\WINDOWS\system32
2010-04-06 13:45:41 ----SD---- C:\Documents and Settings\Petr Hodač\Data aplikací\Microsoft
2010-04-06 08:06:01 ----D---- C:\Program Files\Common Files\System
2010-04-03 15:54:49 ----SHD---- C:\WINDOWS\Installer
2010-04-03 15:54:40 ----D---- C:\Config.Msi
2010-04-02 19:26:05 ----SH---- C:\boot.ini
2010-04-02 19:26:05 ----A---- C:\WINDOWS\win.ini
2010-04-02 19:26:05 ----A---- C:\WINDOWS\system.ini
2010-04-02 19:24:44 ----D---- C:\Documents and Settings\Petr Hodač\Data aplikací\Hamachi
2010-04-02 19:24:31 ----D---- C:\Program Files\Steam
2010-04-02 19:24:31 ----D---- C:\Documents and Settings\Petr Hodač\Data aplikací\OpenOffice.org2
2010-04-02 19:19:04 ----D---- C:\WINDOWS\Help
2010-04-02 19:18:29 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-04-02 17:33:19 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-04-02 17:33:10 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-02 17:32:43 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-02 17:32:42 ----D---- C:\WINDOWS\system32\RTCOM
2010-04-02 17:32:04 ----D---- C:\Program Files\Realtek
2010-04-02 11:51:54 ----D---- C:\WINDOWS\system32\config
2010-04-02 10:56:22 ----SHD---- C:\System Volume Information
2010-04-02 10:56:22 ----D---- C:\WINDOWS\system32\Restore
2010-03-20 11:26:13 ----D---- C:\Program Files\Common Files
2010-03-19 16:44:48 ----D---- C:\WINDOWS\WinSxS
2010-03-18 17:51:30 ----RSD---- C:\WINDOWS\Fonts
2010-03-16 16:00:37 ----D---- C:\WINDOWS\system32\DirectX
2010-03-16 16:00:29 ----RSD---- C:\WINDOWS\assembly
2010-03-12 13:05:11 ----D---- C:\Program Files\World of Warcraft
2010-03-12 12:02:48 ----D---- C:\Program Files\Czech Soccer Manager 2002 FE
2010-03-11 23:40:12 ----D---- C:\Program Files\Movie Maker
2010-03-11 23:39:41 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-02-22 5862432]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2010-01-21 202064]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 DualCoreCenter;DualCoreCenter; \??\C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
S3 RushTopDevice2;RushTopDevice2; \??\C:\Program Files\MSI\DualCoreCenter\RushTop.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 07 dub 2010 14:31

Zdravím

Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.

Obrázek

Doporučuji odinstalovat Spybot - Search & Destroy.

Obrázek

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe

Spusťte program, poté klikněte na Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

Janekas · #3 Příspěvek od **Janekas** » 07 dub 2010 15:08

olt:
OTL logfile created on: 7.4.2010 16:03:47 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\Petr Hodač\Plocha
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 78,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 94,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 99,59 Gb Free Space | 42,76% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 232,88 Gb Total Space | 206,38 Gb Free Space | 88,62% Space Free | Partition Type: NTFS
Drive F: | 3,73 Gb Total Space | 1,52 Gb Free Space | 40,69% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PETR-E941A34D83
Current User Name: Petr Hodač
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.07 15:59:50 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Petr Hodač\Plocha\OTL.exe
PRC - [2008.07.22 13:34:50 | 002,772,992 | ---- | M] (Electronic Arts) -- C:\Program Files\Electronic Arts\EADM\Core.exe
PRC - [2008.04.14 08:52:24 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010.04.07 15:59:50 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Petr Hodač\Plocha\OTL.exe

========== Win32 Services (SafeList) ==========

========== Driver Services (SafeList) ==========

DRV - [2010.02.22 17:28:52 | 005,862,432 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2010.01.21 22:11:12 | 000,202,064 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009.11.18 07:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009.11.18 07:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009.04.30 22:02:00 | 008,055,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007.05.19 16:02:54 | 000,049,664 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\DualCoreCenter\RushTop.sys -- (RushTopDevice2)
DRV - [2007.04.17 15:42:00 | 000,028,160 | ---- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys -- (DualCoreCenter)
DRV - [2007.03.16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TBPanel.sys -- (Cardex)
DRV - [2005.01.07 17:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Seznam Search"
FF - prefs.js..browser.search.defaulturl: "http://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://home.sweetim.com"
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.8
FF - prefs.js..keyword.URL: "http://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://www.atlas.cz/?from=icqhp"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.icq.com/search/afe_result ... id=afex&q="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.03.03 08:27:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.03.03 08:27:49 | 000,000,000 | ---D | M]

[2010.03.02 16:53:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Extensions
[2010.04.06 09:19:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\extensions
[2009.09.04 16:09:22 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.08.11 19:28:05 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2009.08.29 19:19:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\extensions\firefox@tvunetworks.com
[2010.02.26 08:21:13 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-1.xml
[2008.07.03 12:04:12 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-2.xml
[2008.07.23 10:39:55 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-3.xml
[2008.09.28 21:52:58 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-4.xml
[2008.11.19 15:30:03 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-5.xml
[2009.01.16 19:47:07 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin-6.xml
[2009.03.01 14:02:44 | 000,000,944 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\icqplugin.xml
[2009.08.11 19:28:03 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\searchplugins\sweetim.xml
[2010.04.07 13:55:50 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.03.09 20:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.01.21 08:19:06 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007.11.20 17:52:00 | 002,884,992 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
[2010.01.16 02:50:40 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.01.16 02:50:40 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.01.16 02:50:40 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.01.16 02:50:40 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.01.16 02:50:40 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2006.03.02 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [WinSys2] C:\WINDOWS\system32\WinSys2.exe ()
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mvadvd.cab (Reg Error: Key error.)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://icq.oberon-media.com/Gameshell/G ... meHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/s ... wflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Petr Hodač\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Petr Hodač\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.01.03 22:15:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\Shell - "" = Autorun
O33 - MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\Shell\Open\command - "" = G:\resycled\boot.com -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.04.07 16:03:35 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Petr Hodač\Plocha\OTL.exe
[2010.04.07 14:36:49 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.04.07 14:36:48 | 000,000,000 | ---D | C] -- C:\rsit
[2010.04.06 14:07:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft
[2010.04.06 13:45:41 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
[2010.04.06 13:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft
[2010.04.06 13:45:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Data aplikací\Microsoft
[2010.04.02 19:36:01 | 000,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.04.02 19:35:59 | 000,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.02 19:35:58 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.04.02 19:25:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010.04.02 19:18:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP
[2010.04.02 19:16:07 | 000,614,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr80.dll
[2010.04.02 17:32:10 | 000,358,944 | ---- | C] (Realtek Semiconductor Crop.) -- C:\WINDOWS\vncutil.exe
[2010.04.02 17:32:07 | 001,395,800 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\Monfilt.sys
[2010.04.02 17:32:07 | 000,129,568 | ---- | C] (Realtek Semiconductor) -- C:\WINDOWS\RtkAudioService.exe
[2010.04.02 17:32:07 | 000,051,232 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\RtkCoInstXP.dll
[2010.04.02 17:32:05 | 001,691,480 | ---- | C] (Creative) -- C:\WINDOWS\System32\drivers\Ambfilt.sys
[2010.04.02 17:27:33 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2010.04.02 17:24:29 | 000,100,896 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\RTNUninst32.dll
[2010.04.02 17:24:17 | 000,000,000 | ---D | C] -- C:\inst
[2010.04.02 16:44:58 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010.03.20 12:24:10 | 003,723,298 | ---- | C] (New IT Solutions) -- C:\Documents and Settings\Petr Hodač\Plocha\4shared_Desktop_3.2.0.exe
[2010.03.19 08:22:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Petr Hodač\Plocha\NTAF 2.0
[2010.03.19 08:13:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Petr Hodač\Dokumenty\Stažené soubory
[2010.03.18 17:50:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Petr Hodač\Plocha\nnk
[2010.03.11 23:35:10 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2008.10.29 13:32:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Apple
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp files -> C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.04.07 15:59:50 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Petr Hodač\Plocha\OTL.exe
[2010.04.07 14:36:19 | 000,000,476 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{98C7E519-299A-47F2-A33D-4DDEE70115C5}.job
[2010.04.07 14:34:08 | 000,235,289 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.04.07 14:34:07 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.04.07 14:34:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.04.07 14:33:02 | 005,767,168 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\NTUSER.DAT
[2010.04.07 14:33:02 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Petr Hodač\ntuser.ini
[2010.04.07 14:30:21 | 000,016,520 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.04.07 14:27:18 | 000,781,909 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\RSIT.exe
[2010.04.06 19:17:47 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.04.05 19:27:10 | 003,184,134 | -H-- | M] () -- C:\Documents and Settings\Petr Hodač\Local Settings\Data aplikací\IconCache.db
[2010.04.02 19:36:01 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.04.02 19:26:05 | 000,000,512 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.04.02 19:26:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.04.02 19:26:05 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010.04.02 17:33:19 | 001,018,292 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.04.02 17:33:19 | 000,432,664 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.04.02 17:33:19 | 000,429,078 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.04.02 17:33:19 | 000,077,984 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.04.02 17:33:19 | 000,067,428 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.04.02 16:45:00 | 000,000,787 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\EVEREST Ultimate Edition.lnk
[2010.03.20 12:34:28 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\eydnhmbo.sys
[2010.03.20 12:24:23 | 003,723,298 | ---- | M] (New IT Solutions) -- C:\Documents and Settings\Petr Hodač\Plocha\4shared_Desktop_3.2.0.exe
[2010.03.20 11:33:25 | 000,079,872 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\HK2002.doc
[2010.03.20 11:19:00 | 000,000,817 | -HS- | M] () -- C:\WINDOWS\System32\mmf.sys
[2010.03.19 08:22:28 | 180,253,172 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\NTAF 2.0.rar
[2010.03.19 08:01:35 | 000,110,192 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.03.18 17:50:38 | 250,401,243 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\2010_01_10_Naruto_Naiteki_Kensei_vol_1.exe
[2010.03.16 16:19:46 | 000,001,810 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\EA Download Manager.lnk
[2010.03.16 16:19:37 | 000,003,028 | ---- | M] () -- C:\WINDOWS\System32\ealregsnapshot1.reg
[2010.03.16 16:19:08 | 000,001,711 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\FIFA 09.lnk
[2010.03.12 12:02:38 | 018,591,058 | ---- | M] () -- C:\Documents and Settings\Petr Hodač\Plocha\csm_podzim09_v5.exe
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp files -> C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.07 14:36:44 | 000,781,909 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\RSIT.exe
[2010.04.02 19:36:01 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.04.02 17:24:29 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010.04.02 16:44:59 | 000,000,787 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\EVEREST Ultimate Edition.lnk
[2010.03.20 11:33:24 | 000,079,872 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\HK2002.doc
[2010.03.19 08:13:41 | 180,253,172 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\NTAF 2.0.rar
[2010.03.18 17:50:34 | 250,401,243 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\2010_01_10_Naruto_Naiteki_Kensei_vol_1.exe
[2010.03.16 16:19:08 | 000,001,711 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\FIFA 09.lnk
[2010.03.12 12:02:38 | 018,591,058 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Plocha\csm_podzim09_v5.exe
[2010.03.01 01:21:34 | 000,000,012 | ---- | C] () -- C:\Documents and Settings\NetworkService\Data aplikací\rbuwzv.dat
[2010.02.28 18:38:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\eydnhmbo.sys
[2010.02.28 18:38:39 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\avdrn.dat
[2009.09.30 08:50:15 | 000,004,597 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\hpzinstall.log
[2009.09.30 08:48:20 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2009.08.01 16:42:18 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\RADMRDX.DLL
[2009.07.03 05:11:18 | 000,007,274 | ---- | C] () -- C:\WINDOWS\cadx2.ini
[2009.06.17 18:18:17 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009.06.10 09:29:34 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.06.10 09:29:34 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.06.10 09:29:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.06.10 09:29:32 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.12.18 17:02:29 | 000,000,037 | ---- | C] () -- C:\WINDOWS\compedia.ini
[2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008.05.17 17:18:45 | 000,000,280 | ---- | C] () -- C:\WINDOWS\game.ini
[2008.04.20 09:22:42 | 000,048,640 | ---- | C] () -- C:\WINDOWS\mmfs.dll
[2008.04.20 09:22:42 | 000,000,817 | -HS- | C] () -- C:\WINDOWS\System32\mmf.sys
[2008.04.19 16:11:31 | 000,137,928 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008.04.19 16:11:31 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Data aplikací\PnkBstrK.sys
[2008.01.16 11:33:03 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.12.31 15:19:49 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2007.12.31 13:53:28 | 000,011,632 | ---- | C] () -- C:\WINDOWS\hpdj5100.ini
[2007.12.31 13:10:26 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\tcusbdrv.dll
[2007.11.17 15:21:48 | 000,000,457 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2007.11.17 14:27:12 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\ezsid.dat
[2007.11.14 00:34:53 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\smdll.dll
[2007.11.14 00:34:52 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\Auxiliary.dll
[2007.11.14 00:34:51 | 000,266,240 | R--- | C] () -- C:\WINDOWS\System32\HookShield.dll
[2007.11.14 00:34:51 | 000,262,144 | R--- | C] () -- C:\WINDOWS\System32\HookMAp.dll
[2007.11.14 00:34:51 | 000,009,728 | R--- | C] () -- C:\WINDOWS\System32\sysinfoX64.sys
[2007.11.14 00:34:51 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\sysinfo.sys
[2007.11.14 00:30:51 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.11.13 23:55:39 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\drivers\FlashSys.sys
[2007.11.13 23:55:09 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll
[2007.11.13 23:33:32 | 000,167,936 | -H-- | C] () -- C:\Documents and Settings\Petr Hodač\ntuser.dat.LOG
[2007.11.13 23:33:32 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\Petr Hodač\ntuser.ini
[2007.11.13 23:33:31 | 005,767,168 | ---- | C] () -- C:\Documents and Settings\Petr Hodač\NTUSER.DAT
[2007.06.28 18:43:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.01.05 02:13:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007.01.03 22:15:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini
[2005.10.14 12:56:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.10.14 12:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 12:56:50 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005.10.14 12:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005.10.14 12:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005.10.14 12:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005.10.14 12:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2005.10.14 12:56:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\MMSwitch.dll
[2001.07.07 03:00:00 | 000,003,165 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:99671BE2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:FD34FE88
< End of report >

a extras
OTL Extras logfile created on: 7.4.2010 16:03:47 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\Petr Hodač\Plocha
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 78,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 94,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 99,59 Gb Free Space | 42,76% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 232,88 Gb Total Space | 206,38 Gb Free Space | 88,62% Space Free | Partition Type: NTFS
Drive F: | 3,73 Gb Total Space | 1,52 Gb Free Space | 40,69% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PETR-E941A34D83
Current User Name: Petr Hodač
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager -- (Electronic Arts)
"C:\Program Files\Nexus Fire Walker\FireWalker.exe" = C:\Program Files\Nexus Fire Walker\FireWalker.exe:*:Enabled:Fire Walker - Remote Control Software -- (Nexus Concepts)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0A2A5039-B37F-489D-B1DC-A5258DF9E697}" = FIFA 08
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{12453E04-9738-4D16-8408-D726532C2C69}" = ASUS VGA Driver
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{15C165F1-1DAE-4476-AFB6-8723729B41E7}" = hp deskjet 5100
"{192E2132-E977-4D3E-90BA-9DBCE1B57F8C}" = Heroes of Might and Magic® IV
"{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
"{519556CC-4382-4B35-80F5-DD8E9460EEAC}" = OpenOffice.org 2.3
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C3017A-6E09-4101-8B35-EAC40DA86A9E}" = Caesar IV Demo
"{5BE3BF62-D432-4D47-A712-CD4DF91CABFB}" = ZyXEL USB ADSL Modem/Router
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo
"{7D1928D2-26FA-45FA-A4DD-A876D7293818}" = FIFA 08 Demo
"{827B97A9-B347-4110-9F89-37AF2B758F94}" = NHL™ 09
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8C13BEE4-E7CE-4E46-BD13-8F41DAD00FEF}" = SweetIM Toolbar for Internet Explorer 3.4
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1029-7B44-A70500000002}" = Adobe Reader 7.0.5 - Czech
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D4006E71-FF32-44FF-AD5A-B5EE4389B825}_is1" = FlatOut2
"{E848C9C0-E6FF-4A3F-9D67-AE53AC3628FE}" = SweetIM for Messenger 2.7
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"µTorrent CZ_is1" = µTorrent CZ 1.8.3 (build 15638)
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2005
"AbiWord2" = AbiWord 2.4.6 (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"Age Of Empires 2 & The Conquerors Expansion - Full Game" = Age Of Empires 2 & The Conquerors Expansion - Full Game
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"Counter-Strike" = Counter-Strike
"Creation Master 09_is1" = Creation Master 09 Beta 4
"Czech Soccer Manager 2002" = Czech Soccer Manager 2002
"Czech Soccer Manager 2002 Final Editionverze 4.0 (31.3.2006)" = Czech Soccer Manager 2002 Final Edition
"DualCoreCenter_is1" = DualCoreCenter
"EADM" = EA Download Manager
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.02
"EXPERTool_is1" = EXPERTool 7.5
"GAMEFORGE Nostale(CZ)_is1" = Nostale Online CZ (Remove)
"GameParkClient_is1" = GamePark
"Glest_is1" = "Glest 2.0.0"
"Hamachi" = Hamachi 1.0.3.0
"HLSW_is1" = HLSW v1.1.6
"HospitalTycoon" = Hospital Tycoon
"HyperCam 2" = HyperCam 2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{1096C4FA-CC07-4BE1-B73F-77BDFF4916B8}" = Hard Truck 18 Wheels of Steel
"InstallShield_{192E2132-E977-4D3E-90BA-9DBCE1B57F8C}" = Heroes of Might and Magic® IV
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"LifeGlobe Sharks, Terrors of the Deep_is1" = LifeGlobe Sharks, Terrors of the Deep
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSI Live Update 3" = MSI Live Update 3
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NNK" = Naruto Naiteki Kensei
"NVIDIA Drivers" = NVIDIA Drivers
"ParadisePoker" = ParadisePoker
"PKR" = PKR
"SereneScreen Marine Aquarium 2_is1" = SereneScreen Marine Aquarium 2
"SpeedFan" = SpeedFan (remove only)
"TeamViewer 5" = TeamViewer 5
"The KMPlayer" = The KMPlayer (remove only)
"TVUPlayer" = TVUPlayer 2.4.5.3
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WinRemotePC 2009_is1" = WinRemotePC 2009 release 2
"World of Warcraft" = World of Warcraft
"Zoo Empire_is1" = Zoo Empire 1.21
"Zoo Tycoon 2" = Zoo Tycoon 2

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GP Vs Superbike" = GP Vs Superbike

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7.3.2010 3:32:21 | Computer Name = PETR-E941A34D83 | Source = Application Error | ID = 1000
Description = Chybující aplikace fifa10.exe, verze 0.0.0.0, chybující modul fifa10.exe,
verze 0.0.0.0, adresa chyby 0x00396e33.

Error - 2.4.2010 9:45:15 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 2.4.2010 10:38:16 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 2.4.2010 11:30:59 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 2.4.2010 12:01:40 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 2.4.2010 13:18:32 | Computer Name = PETR-E941A34D83 | Source = MsiInstaller | ID = 1013
Description = Produkt: NVIDIA PhysX -- Installation terminated

Error - 2.4.2010 13:24:36 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 2.4.2010 13:27:30 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

Error - 5.4.2010 12:11:14 | Computer Name = PETR-E941A34D83 | Source = Windows Update Agent | ID = 16
Description =

Error - 6.4.2010 13:17:53 | Computer Name = PETR-E941A34D83 | Source = PerfNet | ID = 2004
Description = Nelze otevřít službu serveru. Data o výkonu serveru nejsou k dispozici.
Vrácený chybový kód je v datech DWORD 0.

[ System Events ]
Error - 7.4.2010 8:34:08 | Computer Name = PETR-E941A34D83 | Source = Print | ID = 23
Description = Tiskárnu Microsoft XPS Document Writer se nepodařilo inicializovat,
protože potřebný ovladač Microsoft XPS Document Writer nebyl nalezen.

Error - 7.4.2010 8:34:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452689
Description = Klient NTP zprostředkovatele časových údajů: Při vyhledávání DNS ručně
nakonfigurovaného partnera time.windows.com,0x1 došlo k chybě. Klient NTP se pokusí
o vyhledání pomocí služby DNS znovu za 15 minut. Chyba: Došlo k pokusu o operaci
se soketem v okamžiku nedosažitelnosti hostitele. (0x80072751)

Error - 7.4.2010 8:34:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 14 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

Error - 7.4.2010 8:34:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452689
Description = Klient NTP zprostředkovatele časových údajů: Při vyhledávání DNS ručně
nakonfigurovaného partnera time.windows.com,0x1 došlo k chybě. Klient NTP se pokusí
o vyhledání pomocí služby DNS znovu za 15 minut. Chyba: Došlo k pokusu o operaci
se soketem v okamžiku nedosažitelnosti hostitele. (0x80072751)

Error - 7.4.2010 8:34:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 15 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

Error - 7.4.2010 8:34:11 | Computer Name = PETR-E941A34D83 | Source = Service Control Manager | ID = 7000
Description = Služba Ovladač paralelního portu neuspěla při spuštění v důsledku
následující chyby: %%1058

Error - 7.4.2010 8:49:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452689
Description = Klient NTP zprostředkovatele časových údajů: Při vyhledávání DNS ručně
nakonfigurovaného partnera time.windows.com,0x1 došlo k chybě. Klient NTP se pokusí
o vyhledání pomocí služby DNS znovu za 30 minut. Chyba: Došlo k pokusu o operaci
se soketem v okamžiku nedosažitelnosti hostitele. (0x80072751)

Error - 7.4.2010 8:49:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 30 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

Error - 7.4.2010 9:19:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452689
Description = Klient NTP zprostředkovatele časových údajů: Při vyhledávání DNS ručně
nakonfigurovaného partnera time.windows.com,0x1 došlo k chybě. Klient NTP se pokusí
o vyhledání pomocí služby DNS znovu za 60 minut. Chyba: Došlo k pokusu o operaci
se soketem v okamžiku nedosažitelnosti hostitele. (0x80072751)

Error - 7.4.2010 9:19:09 | Computer Name = PETR-E941A34D83 | Source = W32Time | ID = 39452701
Description = Klient NTP zprostředkovatele časových údajů je konfigurován pro získávání
časových údajů z jednoho nebo více zdrojů času. Žádný z těchto zdrojů však není
aktuálně k dispozici. Po dobu 60 minut nebude proveden žádný pokus o kontaktování
zdroje. Klient NTP nemá k dispozici žádný zdroj času.

< End of report >

#4 Příspěvek od **Caroprd111** » 07 dub 2010 15:30

Vložte do PC všechny flash disky, které používáte.

Obrázek

Stáhněte na plochu UsbFix http://pagesperso-orange.fr/NosTools/Ch ... UsbFix.exe

Spusťte, poté zvolte jazyk E - Enter
Zvolte 1 - Enter
Po dokončení na Vás vyskočí log, vložte mi ho sem, případně ho najdete v C:\UsbFix.txt

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [WinSys2] C:\WINDOWS\system32\WinSys2.exe ()
O33 - MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\Shell - "" = Autorun
O33 - MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\Shell\Open\command - "" = G:\resycled\boot.com -- File not found
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp files -> C:\Documents and Settings\Petr Hodač\Dokumenty\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:99671BE2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:FD34FE88

:Commands
[PURITY] 
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[CREATERESTOREPOINT]
[REBOOT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

Obrázek

Tohle otestujte na http://www.virustotal.com/cs/
C:\WINDOWS\System32\drivers\eydnhmbo.sys
C:\WINDOWS\System32\mmf.sys
C:\WINDOWS\System32\RADMRDX.DLL
C:\WINDOWS\System32\BASSMOD.dll
C:\WINDOWS\System32\HookMAp.dll

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

Obrázek

Doporučuji odinstalovat:
µTorrent

P2P sítě a jejich klienti jsou potenciálním bezpečnostním rizikem, prakticky neustále jsou zdrojem virů, zbytečně se vystavujete riziku.

Janekas · #5 Příspěvek od **Janekas** » 07 dub 2010 15:45

Ha, a mohu vědet proč ty usb flash disky?

Janekas · #6 Příspěvek od **Janekas** » 07 dub 2010 15:49

############################## | UsbFix V6.100 |

User : Petr Hodač (Administrators) # PETR-E941A34D83
Update on 18/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 16:47:15 | 7.4.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled

C:\ -> Místní pevný disk # 232,88 Go (99,58 Go free) # NTFS
D:\ -> Disk CD-ROM
E:\ -> Místní pevný disk # 232,88 Go (206,38 Go free) # NTFS
F:\ -> Vyměnitelný disk # 963,7 Mo (815,7 Mo free) [HONZA] # FAT
G:\ -> Vyměnitelný disk # 3,73 Go (1,52 Go free) [Transcend] # FAT32

################## | Files # Infected Folders |

################## | Registry |

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com g:
Shell\Open\command =G:\resycled\boot.com g:

################## | Vaccin |

(!) This computer is not vaccinated!

################## | ! End of report # UsbFix V6.100 ! |

Janekas · #7 Příspěvek od **Janekas** » 07 dub 2010 15:55

log z otl
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinSys2 deleted successfully.
C:\WINDOWS\system32\WinSys2.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{918e266a-e585-11dd-a2d2-0019dbcb4f29}\ not found.
File G:\resycled\boot.com not found.
C:\WINDOWS\002937_.tmp deleted successfully.
C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP folder deleted successfully.
C:\WINDOWS\SET21.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\Documents and Settings\Petr Hodač\Dokumenty\00000001.TMP deleted successfully.
C:\Documents and Settings\Petr Hodač\Dokumenty\00000002.TMP deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:99671BE2 deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:FD34FE88 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Petr Hodač
->Temp folder emptied: 760934003 bytes
->Temporary Internet Files folder emptied: 15573916 bytes
->FireFox cache emptied: 17509362 bytes
->Flash cache emptied: 2100328 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16452 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 30988250 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 789,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Petr Hodač
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.1.0 log created on 04072010_165057

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#8 Příspěvek od **Caroprd111** » 07 dub 2010 15:57

Janekas píše:Ha, a mohu vědet proč ty usb flash disky?

Kvůli smazání infekce na nich.

Jak to vypadá s PC

Janekas · #9 Příspěvek od **Janekas** » 07 dub 2010 16:01

? nosim si havěť na flaskách?

A já myslel že těm kompům pomůžu. Sakra práce.

s pc- požád nejede dns, na net jen podle IP adres.

#10 Příspěvek od **Caroprd111** » 07 dub 2010 16:02

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
Vložte do PC všechny flash disky, které používáte.
Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
Během skenování může být počítač restartován.

Janekas · #11 Příspěvek od **Janekas** » 08 dub 2010 08:11

tady je log z combofixu

ComboFix 10-04-07.01 - Petr Hodač 08.04.2010 8:59.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.2047.1614 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr Hodač\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winsys.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-08 do 2010-04-08 )))))))))))))))))))))))))))))))
.

2010-04-07 14:50 . 2010-04-07 14:50 -------- d-----w- C:\_OTL
2010-04-07 14:46 . 2010-04-07 14:47 -------- d-----w- C:\UsbFix
2010-04-07 12:36 . 2010-04-07 12:36 -------- d-----w- c:\program files\trend micro
2010-04-07 12:36 . 2010-04-07 12:36 -------- d-----w- C:\rsit
2010-04-02 17:36 . 2008-12-03 17:52 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-02 17:35 . 2008-12-03 17:52 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-02 17:35 . 2010-04-02 17:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-02 17:16 . 2009-05-18 09:00 614400 ----a-w- c:\windows\system32\msvcr80.dll
2010-04-02 15:32 . 2010-02-22 15:57 358944 ----a-w- c:\windows\vncutil.exe
2010-04-02 15:32 . 2010-02-22 15:56 51232 ----a-w- c:\windows\system32\RtkCoInstXP.dll
2010-04-02 15:32 . 2010-02-22 15:56 129568 ----a-w- c:\windows\RtkAudioService.exe
2010-04-02 15:32 . 2009-11-18 05:17 1395800 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2010-04-02 15:32 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-04-02 15:27 . 2009-12-14 10:33 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-04-02 15:24 . 2010-01-12 11:35 100896 ----a-w- c:\windows\system32\RTNUninst32.dll
2010-04-02 15:24 . 2010-01-12 11:35 80416 ----a-w- c:\windows\system32\RtNicProp32.dll
2010-04-02 15:24 . 2010-04-02 17:16 -------- d-----w- C:\inst
2010-04-02 14:44 . 2010-04-02 14:44 -------- d-----w- c:\program files\Lavalys
2010-03-11 21:35 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 14:02 . 2009-08-11 11:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-02 17:24 . 2008-05-11 06:52 -------- d-----w- c:\program files\Steam
2010-04-02 17:18 . 2008-10-31 17:16 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-02 15:33 . 2006-03-02 12:00 77984 ----a-w- c:\windows\system32\perfc005.dat
2010-04-02 15:33 . 2006-03-02 12:00 429078 ----a-w- c:\windows\system32\perfh005.dat
2010-04-02 15:32 . 2007-11-13 21:48 -------- d-----w- c:\program files\Realtek
2010-03-20 10:34 . 2010-02-28 16:38 0 ----a-w- c:\windows\system32\drivers\eydnhmbo.sys
2010-03-20 09:19 . 2008-04-20 07:22 817 --sha-w- c:\windows\system32\mmf.sys
2010-03-16 14:19 . 2008-10-05 15:14 3028 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-03-12 11:05 . 2009-10-14 15:59 -------- d-----w- c:\program files\World of Warcraft
2010-03-12 10:02 . 2008-03-05 07:57 -------- d-----w- c:\program files\Czech Soccer Manager 2002 FE
2010-03-06 12:30 . 2009-07-03 06:43 -------- d-----w- c:\program files\Metin2_CZ
2010-03-01 14:27 . 2007-11-13 21:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-01 14:08 . 2008-10-05 15:14 -------- d-----w- c:\program files\Electronic Arts
2010-03-01 13:37 . 2008-01-01 12:14 -------- d-----w- c:\program files\EA Sports
2010-02-22 15:57 . 2007-11-13 21:47 84512 ----a-w- c:\windows\SOUNDMAN.EXE
2010-02-22 15:57 . 2007-11-13 21:47 1833504 ----a-w- c:\windows\SkyTel.exe
2010-02-22 15:57 . 2007-11-13 21:47 1489440 ----a-w- c:\windows\RtlUpd.exe
2010-02-22 15:56 . 2007-11-13 21:47 9721888 ----a-w- c:\windows\RTLCPL.EXE
2010-02-22 15:56 . 2007-11-13 21:47 18791456 ----a-w- c:\windows\RTHDCPL.EXE
2010-02-22 15:56 . 2007-11-13 21:47 2177568 ----a-w- c:\windows\MicCal.exe
2010-02-22 15:56 . 2007-11-13 21:47 64032 ----a-w- c:\windows\ALCMTR.EXE
2010-02-22 15:56 . 2007-11-13 21:47 2815520 ----a-w- c:\windows\ALCWZRD.EXE
2010-02-22 15:28 . 2007-11-13 21:47 5862432 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2010-02-19 13:29 . 2010-02-19 13:29 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-12 17:02 . 2007-11-13 21:48 1247776 ----a-w- c:\windows\RtlExUpd.dll
2010-02-12 10:03 . 2010-03-05 22:54 293376 ------w- c:\windows\system32\browserchoice.exe
2010-01-22 16:26 . 2010-01-22 16:26 7865288 ----a-w- C:\paradisepoker_com_cs_cs.exe
2010-01-21 20:11 . 2007-11-13 21:45 202064 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2009-05-20 12:36 1258808 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-11-08 188416]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2008-12-03 1265296]
"RTHDCPL"="RTHDCPL.EXE" [2010-02-22 18791456]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DualCoreCenter.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\DualCoreCenter.lnk
backup=c:\windows\pss\DualCoreCenter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Petr Hodač^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=c:\documents and settings\Petr Hodač\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=c:\windows\pss\hamachi.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Petr Hodač^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\Petr Hodač\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
2009-05-12 14:43 2181672 ----a-w- c:\program files\EXPERTool\TBPANEL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]
2007-01-17 16:01 496640 ----a-w- c:\program files\MSI\Live Update 3\LMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusPortal]
2005-10-27 21:04 1533440 ----a-w- c:\program files\Nexus Fire Walker\FireWalker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-02-20 10:34 1217872 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
2009-05-20 13:11 111928 ----a-r- c:\program files\SweetIM\Messenger\SweetIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WRPCAgent]
2009-02-12 11:40 56320 ----a-w- c:\program files\WinSoftMagic\WinRemotePC\WRPCAgent.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Nexus Fire Walker\\FireWalker.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2.4.2010 17:32 1691480]
S3 DualCoreCenter;DualCoreCenter;c:\program files\MSI\DualCoreCenter\NTGLM7X.sys [13.11.2007 23:55 28160]
S3 RushTopDevice2;RushTopDevice2;c:\program files\MSI\DualCoreCenter\RushTop.sys [13.11.2007 23:55 49664]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
wmcmgc
.
Obsah adresáře 'Naplánované úlohy'

2009-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2010-04-07 c:\windows\Tasks\User_Feed_Synchronization-{98C7E519-299A-47F2-A33D-4DDEE70115C5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = hxxp://tw.msi.com.tw/autobios/VerChk/LSeries.asp?MSIOCXVersion=3.81&WorkFunction=LMonitor
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Petr Hodač\Data aplikací\Mozilla\Firefox\Profiles\1x90x3iu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://home.sweetim.com
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Notify-AtiExtEvent - (no file)
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
AddRemove-LifeGlobe Sharks, Terrors of the Deep_is1 - c:\program files\Prolific Publishing

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-08 09:02
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-57989841-1957994488-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:4d,e3,82,33,e9,6f,88,69,88,6d,df,39,7b,2f,d8,77,2d,f1,88,14,81,ce,88,
dc,9f,af,35,d0,d5,f9,b1,08,c7,3f,b8,5d,ad,71,d4,18,82,af,c3,4c,7d,63,96,a6,\
"??"=hex:10,d0,5c,81,28,a2,d3,8f,e3,01,46,c7,c9,e5,1b,04

[HKEY_USERS\S-1-5-21-57989841-1957994488-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:aa,7e,ba,fe,0a,aa,dc,2a,f6,85,6e,23,69,25,fb,3c,b6,4c,56,0a,96,
be,d3,08,b4,d0,9f,e7,e2,78,fb,12,74,46,92,f6,19,5b,fc,6b,6f,ff,e8,54,53,65,\
"rkeysecu"=hex:6d,d0,c4,03,a6,8f,8d,d7,da,1c,a7,81,34,48,b4,eb

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
e3
"2"=hex:d7,7a,ea,31,a0,f7,22,dd,b6,43,6f,32,07,8b,4a,0a,e2,6f,a8,1b,53,71,0d,
78,d5,ad,68,1b,c8,4a,9b,03
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,aa,6b,6f,c8,5d,d1,dd,
70,c8,0c,a2,71,14,a4,b5,05,7d,2c,84,8d,ff,2b,de,6d,f8,f2,70,94,19,43,ce,bd,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:47,6d,e8,b1,c6,c5,94,c0
"3"=hex:65,8a,97,58,95,91,fa,cb,ba,75,58,6e,b2,b4,16,21,58,71,ba,4c,7f,ff,ea,
e6,c0,a3,39,bc,5f,3b,63,55,3a,64,39,85,dd,87,a7,4e,a6,79,a6,a9,dc,78,72,2d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,73,7e,45,c6,9f,9e,10,
63,a0,2f,06,c2,a3,e9,62,70,d1,3e,e6,57,b7,98,40,c9,e4,cc,88,e6,39,d6,95,f5,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:44,73,6a,85,de,67,6e,c0
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
Celkový čas: 2010-04-08 09:04:06
ComboFix-quarantined-files.txt 2010-04-08 07:03

Před spuštěním: Volných bajtů: 108 163 305 472
Po spuštění: Volných bajtů: 108 130 357 248

- - End Of File - - C45824AA16BCC5DFC530B9B50F87EEF7

#12 Příspěvek od **Caroprd111** » 08 dub 2010 13:55

Tohle otestujte na http://www.virustotal.com/cs/
c:\windows\system32\drivers\eydnhmbo.sys
c:\windows\system32\mmf.sys

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

Janekas · #13 Příspěvek od **Janekas** » 08 dub 2010 14:39

nj, předpokládám ale , že to má smysl jen z toho pc. A tam je s netem problém. Sice můžu najít virustotal podle IP addresy, ale stejně ten soubor nedokžu otestovat.

#14 Příspěvek od **Caroprd111** » 08 dub 2010 14:41

virustotal zatím vynechte.

#15 Příspěvek od **Caroprd111** » 08 dub 2010 14:46

Pokud nemáte, přesuňte Combofix na plochu

Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Driver::
wmcmgc

NetSvc::
wmcmgc

RegLock::
[HKEY_USERS\S-1-5-21-57989841-1957994488-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[HKEY_USERS\S-1-5-21-57989841-1957994488-839522115-1004\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]

Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

VIRY.CZ

nejde internet

nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet

Re: nejde internet