VIRY.CZ

Prosim o kontolu logu. pocitac je spomaleny.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-04-07 16:56:41
Microsoft Windows XP Professional Service Pack 3
System drive I: has 28 GB (28%) free of 100 GB
Total RAM: 2046 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:56:55, on 7. 4. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\RTHDCPL.EXE
I:\Program Files\Common Files\Java\Java Update\jusched.exe
I:\Program Files\DAEMON Tools Lite\DTLite.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\Skype\Phone\Skype.exe
I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
I:\Program Files\Java\jre6\bin\jqs.exe
I:\WINDOWS\runservice.exe
I:\WINDOWS\system32\PnkBstrA.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\wscntfy.exe
I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
I:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
I:\Program Files\Skype\Plugin Manager\skypePM.exe
I:\Program Files\Opera\opera.exe
I:\WINDOWS\system32\PnkBstrB.exe
I:\Documents and Settings\Administrator\Desktop\RSIT.exe
I:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - I:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] I:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "I:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "I:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [swg] "I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "I:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EA Core] I:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "I:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="I:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="i:\nvidia\displaydriver\195.62\winxp\english\PhysX_9.09.0814_SystemSoftware.exe"
O4 - HKUS\S-1-5-21-1659004503-796845957-725345543-1004\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'postgrespass')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://I:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - I:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - I:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - I:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - I:\WINDOWS\runservice.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - I:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - I:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - I:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 7102 bytes

======Scheduled tasks folder======

I:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
I:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-17 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - I:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-02-17 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - I:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-05 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-05 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - I:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{E0E899AB-F487-11D5-8D29-0050BA6940E3}
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-17 279664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=I:\WINDOWS\RTHDCPL.EXE [2007-08-11 16384000]
"JMB36X IDE Setup"=I:\WINDOWS\RaidTool\xInsIDE.exe [2007-03-20 36864]
"36X Raid Configurer"=I:\WINDOWS\system32\xRaidSetup.exe [2007-05-25 1957888]
"NvMediaCenter"=I:\WINDOWS\system32\NvMcTray.dll [2009-11-20 110184]
"NvCplDaemon"=I:\WINDOWS\system32\NvCpl.dll [2009-11-20 12669544]
"Adobe Reader Speed Launcher"=I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=I:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"NeroFilterCheck"=I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"SunJavaUpdateSched"=I:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=I:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"swg"=I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-01-15 39408]
"Skype"=I:\Program Files\Skype\Phone\Skype.exe [2010-02-22 26101032]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"EA Core"=I:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I I:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI TRANSFORMS=I:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST WISE_SETUP_EXE_PATH=i:\nvidia\displaydriver\195.62\winxp\english\PhysX_9.09.0814_SystemSoftware.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
I:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"I:\Program Files\Skype\Plugin Manager\skypePM.exe"="I:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"I:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="I:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"I:\Program Files\Opera\opera.exe"="I:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"I:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="I:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"I:\Documents and Settings\Administrator\temp\TeamViewer\Version5\TeamViewer.exe"="I:\Documents and Settings\Administrator\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"I:\Program Files\Skype\Phone\Skype.exe"="I:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0238e934-f603-11de-b332-806d6172696f}]
shell\AutoRun\command - D:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a813a381-244e-11df-b340-0015588aac05}]
shell\AutoRun\command - C:\s1.exe
shell\open\command - C:\s1.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{acb7c6ef-002e-11df-b339-0015588aac05}]
shell\AutoRun\command - C:\s1.exe
shell\open\command - C:\s1.exe


======List of files/folders created in the last 1 months======

2010-04-07 14:57:50 ----RHD---- I:\Documents and Settings\Administrator\Application Data\SecuROM
2010-04-07 14:53:10 ----D---- I:\Documents and Settings\Administrator\Application Data\Leadertech
2010-04-07 14:33:18 ----D---- I:\WINDOWS\LastGood
2010-04-06 04:35:55 ----SHD---- I:\found.000
2010-04-05 14:43:32 ----D---- I:\Program Files\QuickTime
2010-04-05 14:43:16 ----D---- I:\Program Files\Common Files\TechSmith Shared
2010-04-05 14:43:15 ----D---- I:\Program Files\TechSmith
2010-04-05 08:56:57 ----D---- I:\WINDOWS\Sun
2010-04-05 08:56:13 ----D---- I:\Program Files\Common Files\Java
2010-04-05 08:56:01 ----A---- I:\WINDOWS\system32\javaws.exe
2010-04-05 08:56:01 ----A---- I:\WINDOWS\system32\javaw.exe
2010-04-05 08:56:01 ----A---- I:\WINDOWS\system32\java.exe
2010-04-05 08:55:50 ----D---- I:\Program Files\Java
2010-04-05 08:49:48 ----D---- I:\Documents and Settings\All Users\Application Data\Sun
2010-04-05 08:49:33 ----A---- I:\WINDOWS\system32\deploytk.dll
2010-04-05 08:48:27 ----D---- I:\Documents and Settings\Administrator\Application Data\Sun
2010-04-03 09:57:58 ----A---- I:\WINDOWS\_MSRSTRT.EXE
2010-04-03 08:52:51 ----D---- I:\Program Files\STDU Viewer
2010-04-03 08:52:51 ----D---- I:\Program Files\Common Files\STDUtility
2010-04-03 08:52:51 ----A---- I:\WINDOWS\system32\msvcr71.dll
2010-04-03 08:32:38 ----D---- I:\Documents and Settings\Administrator\Application Data\UDC Profiles
2010-04-03 08:32:09 ----A---- I:\WINDOWS\system32\udcpm.dll
2010-04-03 08:32:03 ----D---- I:\Program Files\Universal Document Converter
2010-03-31 19:24:06 ----D---- I:\Documents and Settings\All Users\Application Data\TechSmith
2010-03-31 18:32:23 ----D---- I:\Documents and Settings\Administrator\Application Data\Ahead
2010-03-31 18:32:04 ----D---- I:\Documents and Settings\All Users\Application Data\Ahead
2010-03-31 18:30:26 ----D---- I:\Program Files\Common Files\Ahead
2010-03-31 18:29:47 ----D---- I:\WINDOWS\RegisteredPackages
2010-03-31 16:34:22 ----D---- I:\Program Files\WM Converter
2010-03-31 14:31:16 ----A---- I:\WINDOWS\IE4 Error Log.txt
2010-03-25 21:50:39 ----A---- I:\WINDOWS\system32\tsccvid.dll
2010-03-25 21:50:38 ----D---- I:\WINDOWS\system32\QuickTime
2010-03-25 21:49:25 ----D---- I:\Program Files\TechSmith_Camtasia_Studio_6.0.3
2010-03-22 19:12:04 ----A---- I:\WINDOWS\system32\ptpusb.dll
2010-03-22 19:12:03 ----A---- I:\WINDOWS\system32\ptpusd.dll
2010-03-21 22:01:43 ----D---- I:\Program Files\Guitar Pro 5
2010-03-18 16:38:56 ----D---- I:\Program Files\Ubisoft
2010-03-13 10:21:42 ----D---- I:\rsit
2010-03-13 10:21:42 ----D---- I:\Program Files\trend micro
2010-03-10 20:14:47 ----A---- I:\WINDOWS\system32\systeminfo3.dll
2010-03-10 20:14:31 ----D---- I:\Documents and Settings\Administrator\Application Data\Vso
2010-03-10 20:14:31 ----A---- I:\Documents and Settings\Administrator\Application Data\inst.exe
2010-03-10 20:14:25 ----D---- I:\Program Files\CloneDVD5
2010-03-10 20:14:25 ----D---- I:\Documents and Settings\All Users\Application Data\DVDXStudio
2010-03-10 12:18:26 ----SHD---- I:\RECYCLER
2010-03-10 09:59:13 ----D---- I:\Documents and Settings\Administrator\Application Data\Skype
2010-03-10 09:59:09 ----D---- I:\Program Files\Common Files\Skype
2010-03-10 09:59:07 ----RD---- I:\Program Files\Skype
2010-03-09 08:40:09 ----D---- I:\WINDOWS\temp
2010-03-09 08:40:08 ----A---- I:\ComboFix.txt
2010-03-09 08:36:16 ----A---- I:\Boot.bak
2010-03-09 08:36:14 ----RASHD---- I:\cmdcons
2010-03-09 08:28:09 ----A---- I:\WINDOWS\zip.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\SWXCACLS.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\SWSC.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\SWREG.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\sed.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\PEV.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\NIRCMD.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\MBR.exe
2010-03-09 08:28:09 ----A---- I:\WINDOWS\grep.exe
2010-03-09 08:27:57 ----D---- I:\WINDOWS\ERDNT
2010-03-09 08:25:39 ----D---- I:\ComboFix
2010-03-09 08:25:35 ----AD---- I:\Qoobox

======List of files/folders modified in the last 1 months======

2010-04-07 16:56:49 ----D---- I:\WINDOWS\Prefetch
2010-04-07 14:58:11 ----A---- I:\WINDOWS\system32\PnkBstrB.exe
2010-04-07 14:57:32 ----SHD---- I:\WINDOWS\Installer
2010-04-07 14:57:30 ----D---- I:\Program Files\Electronic Arts
2010-04-07 14:53:30 ----D---- I:\WINDOWS\system32
2010-04-07 14:33:42 ----D---- I:\Program Files\EA GAMES
2010-04-07 14:33:40 ----HD---- I:\WINDOWS\inf
2010-04-07 14:33:26 ----RSD---- I:\WINDOWS\assembly
2010-04-07 14:33:18 ----D---- I:\WINDOWS
2010-04-07 14:32:58 ----D---- I:\WINDOWS\system32\DirectX
2010-04-07 12:09:36 ----D---- I:\Program Files\PokerStars
2010-04-07 05:34:28 ----D---- I:\Documents and Settings\Administrator\Application Data\vlc
2010-04-07 04:33:53 ----A---- I:\WINDOWS\NeroDigital.ini
2010-04-06 12:33:59 ----RSHDC---- I:\WINDOWS\system32\dllcache
2010-04-06 12:33:53 ----D---- I:\WINDOWS\system32\drivers
2010-04-06 12:33:50 ----D---- I:\WINDOWS\system32\CatRoot2
2010-04-06 04:52:00 ----A---- I:\WINDOWS\SchedLgU.Txt
2010-04-06 04:37:51 ----D---- I:\Documents and Settings\Administrator\Application Data\skypePM
2010-04-05 14:43:32 ----RD---- I:\Program Files
2010-04-05 14:43:16 ----D---- I:\Program Files\Common Files
2010-04-05 14:41:34 ----D---- I:\Program Files\Instal
2010-04-03 10:01:19 ----A---- I:\WINDOWS\system32\PerfStringBackup.INI
2010-04-03 09:59:46 ----D---- I:\Program Files\FlashGet
2010-04-03 09:58:35 ----D---- I:\WINDOWS\security
2010-03-31 18:33:05 ----D---- I:\WINDOWS\WinSxS
2010-03-31 18:30:26 ----D---- I:\Program Files\Nero
2010-03-31 18:30:26 ----D---- I:\Documents and Settings\All Users\Application Data\Nero
2010-03-31 18:30:11 ----D---- I:\Program Files\Windows Media Player
2010-03-31 18:30:10 ----D---- I:\WINDOWS\Debug
2010-03-27 13:30:39 ----D---- I:\Program Files\Full Tilt Poker
2010-03-25 22:37:15 ----SD---- I:\WINDOWS\Downloaded Program Files
2010-03-21 22:45:09 ----D---- I:\Documents and Settings\Administrator\Application Data\dvdcss
2010-03-21 22:03:06 ----RSD---- I:\WINDOWS\Fonts
2010-03-18 16:39:04 ----HD---- I:\Program Files\InstallShield Installation Information
2010-03-10 09:59:07 ----D---- I:\Documents and Settings\All Users\Application Data\Skype
2010-03-09 08:39:31 ----A---- I:\WINDOWS\system.ini
2010-03-09 08:38:11 ----D---- I:\WINDOWS\AppPatch
2010-03-09 08:36:16 ----RASH---- I:\boot.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; I:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R2 irda;IrDA Protocol; I:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R3 Arp1394;1394 ARP Client Protocol; I:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; I:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; I:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); I:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-08-10 4603904]
R3 irsir;Microsoft Serial Infrared Driver; I:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Mouse HID Driver; I:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; I:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; I:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-11-21 10235968]
R3 pcouffin;VSO Software pcouffin; I:\WINDOWS\System32\Drivers\pcouffin.sys [2010-03-10 47360]
R3 PnkBstrK;PnkBstrK; \??\I:\WINDOWS\system32\drivers\PnkBstrK.sys []
R3 Rasirda;WAN Miniport (IrDA); I:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; I:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; I:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;USB Mass Storage Driver; I:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; I:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; I:\WINDOWS\system32\DRIVERS\yk51x86.sys [2010-03-03 297344]
S3 aycx31fw;aycx31fw; I:\WINDOWS\system32\drivers\aycx31fw.sys []
S3 catchme;catchme; \??\I:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 dot4;MS IEEE-1284.4 Driver; I:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; I:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; I:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808]
S3 usbccgp;Microsoft USB Generic Parent Driver; I:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;USB Scanner Driver; I:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Irmon;Infrared Monitor; I:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; I:\Program Files\Java\jre6\bin\jqs.exe [2010-04-05 153376]
R2 LicCtrlService;LicCtrl Service; I:\WINDOWS\runservice.exe [2010-03-04 16384]
R2 nvsvc;NVIDIA Display Driver Service; I:\WINDOWS\system32\nvsvc32.exe [2009-11-20 154216]
R2 pgsql-8.3;PostgreSQL Database Server 8.3; I:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe [2009-03-13 65536]
R2 PnkBstrA;PunkBuster; I:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe [2008-10-23 63040]
R2 PnkBstrB;PnkBstrB; I:\WINDOWS\system32\PnkBstrB.exe [2010-04-07 183112]
R2 UMWdf;Windows User Mode Driver Framework; I:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S2 gupdate;Služba Google Update (gupdate); I:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-17 135664]
S3 aspnet_state;ASP.NET State Service; I:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; I:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; I:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-17 182768]
S3 IDriverT;InstallDriver Table Manager; I:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; I:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 odserv;Microsoft Office Diagnostics Service; I:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; I:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; I:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravím


Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.


Vložte do PC všechny flash disky, které používáte.

Stáhněte na plochu UsbFix http://pagesperso-orange.fr/NosTools/Ch ... UsbFix.exe

• Spusťte, poté zvolte jazyk E - Enter
• Zvolte 2 - Enter (Počítač může být restartován)
• Po dokončení na Vás vyskočí log, vložte mi ho sem, případně ho najdete v C:\UsbFix.txt

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe

• Spusťte program, poté klikněte na Prohledat
• Po dokončení, sem vložte logy OTL.Txt a Extras.txt

############################## | UsbFix V6.100 |

User : Administrator (Administrators) # ROBO
Update on 18/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 9:02:24 | 8. 4. 2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.5512
Windows Firewall Status : Enabled

A:\ -> 3 1/2 Inch Floppy Drive
C:\ -> Local Fixed Disk # 465,64 Go (373,22 Go free) [My Book] # FAT32
D:\ -> CD-ROM Disc # 4,57 Go (0 Mo free) [BF2 DVD] # UDF
E:\ -> Removable Disk
F:\ -> Removable Disk
G:\ -> Removable Disk
H:\ -> Removable Disk
I:\ -> Local Fixed Disk # 97,65 Go (26,73 Go free) # NTFS
J:\ -> Local Fixed Disk # 135,22 Go (92,4 Go free) # NTFS

################## | Files # Infected Folders |

(!) Not deleted ! D:\autorun.inf
(!) Not deleted ! D:\msvcr71.dll
Deleted ! I:\Recycler\S-1-5-21-1659004503-796845957-725345543-500
Deleted ! J:\Recycler\S-1-5-21-1659004503-796845957-725345543-500

################## | Registry |


################## | Mountpoints2 |


################## | Listing of the present files |

[31. 03. 2008 12:57|--a------|87] C:\Install.ini
[01. 04. 2008 15:05|--a------|319488] C:\setup.exe
[11. 03. 2009 17:40|--a------|78] C:\Install.log
[01. 11. 2005 12:59|-r-------|20482048] D:\00000001.TMP
[01. 11. 2005 12:59|-r-------|317440] D:\00000002.TMP
[02. 02. 2007 17:48|-r-------|1196032] D:\Autorun.exe
[11. 01. 2007 15:00|-r-------|43] D:\Autorun.inf
[10. 01. 2007 10:29|-r-------|4150] D:\bf2.ico
[09. 02. 2007 17:47|-r-------|3027942] D:\data1.cab
[09. 02. 2007 17:47|-r-------|18739] D:\data1.hdr
[09. 02. 2007 17:47|-r-------|512] D:\data2.cab
[22. 10. 2004 04:16|-r-------|470174] D:\engine32.cab
[09. 02. 2007 17:47|-r-------|30664] D:\layout.bin
[11. 01. 2007 15:00|-r-------|1060864] D:\MFC71.dll
[11. 01. 2007 15:00|-r-------|499712] D:\msvcp71.dll
[11. 01. 2007 15:00|-r-------|348160] D:\msvcr71.dll
[02. 01. 2007 17:36|-r-------|1279256] D:\Setup.bmp
[22. 10. 2004 04:16|-r-------|118736] D:\setup.exe
[09. 02. 2007 17:47|-r-------|464834] D:\setup.ibt
[09. 02. 2007 17:38|-r-------|593] D:\setup.ini
[09. 02. 2007 17:38|-r-------|198783] D:\setup.inx
[31. 12. 2009 13:38|--a------|210] I:\Boot.bak
[09. 03. 2010 08:36|-rahs----|281] I:\boot.ini
[04. 08. 2004 00:00|--a------|260272] I:\cmldr
[09. 03. 2010 08:40|--a------|15238] I:\ComboFix.txt
[28. 02. 2006 14:00|-rahs----|47564] I:\NTDETECT.COM
[03. 03. 2010 08:53|-rahs----|250048] I:\ntldr
[?|?|?] I:\pagefile.sys
[13. 01. 2010 15:14|--a------|731779072] I:\phila1.by.UltimaThule.of.UCU
[08. 04. 2010 09:04|--a------|2766] I:\UsbFix.txt
[15. 12. 2009 14:23|--a------|67392] J:\Bill Vosti - How to Beat 6max Cash Games (Preflop Hand Charts).pdf

################## | Vaccination |

# C:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# I:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# J:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).

################## | Upload |

Please send the file : I:\UsbFix_Upload_Me_ROBO.zip : http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution .

################## | ! End of report # UsbFix V6.100 ! |

OTL logfile created on: 8. 4. 2010 9:17:10 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = I:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 0000041B | Country: Slovakia | Language: SKY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): I:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = I: | %SystemRoot% = I:\WINDOWS | %ProgramFiles% = I:\Program Files
Drive C: | 465,64 Gb Total Space | 373,22 Gb Free Space | 80,15% Space Free | Partition Type: FAT32
Drive D: | 4,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 97,65 Gb Total Space | 30,54 Gb Free Space | 31,28% Space Free | Partition Type: NTFS
Drive J: | 135,22 Gb Total Space | 92,40 Gb Free Space | 68,33% Space Free | Partition Type: NTFS

Computer Name: ROBO
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.08 08:41:40 | 000,561,664 | ---- | M] (OldTimer Tools) -- I:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2010.03.04 08:20:59 | 000,016,384 | ---- | M] () -- I:\WINDOWS\runservice.exe
PRC - [2010.01.15 04:26:31 | 000,039,408 | ---- | M] (Google Inc.) -- I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009.11.20 20:01:18 | 000,832,296 | ---- | M] (Opera Software) -- I:\Program Files\Opera\opera.exe
PRC - [2009.03.13 06:50:20 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) -- I:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
PRC - [2009.03.13 06:48:48 | 003,678,208 | ---- | M] (PostgreSQL Global Development Group) -- I:\Program Files\PostgreSQL\8.3\bin\postgres.exe
PRC - [2008.10.23 13:57:11 | 000,063,040 | ---- | M] () -- I:\Program Files\EA GAMES\Need for Speed Undercover\PB\PnkBstrA.exe
PRC - [2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- I:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010.04.08 08:41:40 | 000,561,664 | ---- | M] (OldTimer Tools) -- I:\Documents and Settings\Administrator\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2010.03.04 08:20:59 | 000,016,384 | ---- | M] () [Auto | Running] -- I:\WINDOWS\runservice.exe -- (LicCtrlService)
SRV - [2009.03.13 06:50:20 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- I:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe -- (pgsql-8.3)
SRV - [2008.10.23 13:57:11 | 000,063,040 | ---- | M] () [Auto | Running] -- I:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe -- (PnkBstrA)
SRV - [2008.07.29 20:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- I:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)


========== Driver Services (SafeList) ==========

DRV - [2010.03.03 11:54:46 | 000,297,344 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- I:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2009.12.31 15:13:41 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- I:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2009.11.21 04:34:54 | 010,235,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- I:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008.04.13 18:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- I:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.08.10 22:52:44 | 004,603,904 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- I:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.07.29 19:51:10 | 000,048,896 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- I:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2001.08.17 15:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- I:\WINDOWS\system32\drivers\irsir.sys -- (irsir)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,734 | ---- | M]) - I:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - I:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - I:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - I:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [36X Raid Configurer] I:\WINDOWS\System32\xRaidSetup.exe (JMicron Technology Corp.)
O4 - HKLM..\Run: [combofix] I:\ComboFix\CF27431.cfx File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] I:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] I:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] I:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] I:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [DAEMON Tools Lite] I:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - I:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - I:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - I:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... vc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - I:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - I:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - I:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: I:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: I:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.04.08 08:48:26 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2008.08.11 09:32:10 | 000,000,000 | ---D | M] - C:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2007.02.09 17:49:15 | 000,000,000 | R--D | M] - D:\autorun -- [ UDF ]
O32 - AutoRun File - [2007.02.02 17:48:45 | 001,196,032 | R--- | M] () - D:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2007.01.11 15:00:44 | 000,000,043 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O32 - AutoRun File - [2010.04.08 08:48:25 | 000,000,000 | RHSD | M] - I:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.04.08 08:48:25 | 000,000,000 | RHSD | M] - J:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.04.08 08:48:25 | 000,000,000 | RHSD | C] -- I:\autorun.inf
[2010.04.08 08:42:01 | 000,000,000 | ---D | C] -- I:\UsbFix
[2010.04.08 08:41:40 | 000,561,664 | ---- | C] (OldTimer Tools) -- I:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010.04.08 08:39:21 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\Adobe
[2010.04.08 08:39:21 | 000,000,000 | ---D | C] -- I:\Program Files\Adobe
[2010.04.08 08:39:08 | 000,000,000 | -HSD | C] -- I:\Config.Msi
[2010.04.08 08:36:16 | 000,000,000 | ---D | C] -- I:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010.04.08 05:33:56 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\Adobe AIR
[2010.04.07 14:58:35 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\My Documents\NFS Undercover
[2010.04.07 14:57:50 | 000,000,000 | RH-D | C] -- I:\Documents and Settings\Administrator\Application Data\SecuROM
[2010.04.07 14:53:20 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Local Settings\Application Data\Downloaded Installations
[2010.04.07 14:53:10 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\Leadertech
[2010.04.06 17:47:18 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Anvil.the.Story.of.Anvil.2008.DVDRip.XviD.AC3
[2010.04.06 12:33:53 | 000,032,128 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\dllcache\usbccgp.sys
[2010.04.06 04:35:55 | 000,000,000 | -HSD | C] -- I:\found.000
[2010.04.05 14:43:32 | 000,000,000 | ---D | C] -- I:\Program Files\QuickTime
[2010.04.05 14:43:16 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\TechSmith Shared
[2010.04.05 14:43:15 | 000,000,000 | ---D | C] -- I:\Program Files\TechSmith
[2010.04.05 08:56:57 | 000,000,000 | ---D | C] -- I:\WINDOWS\Sun
[2010.04.05 08:56:13 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\Java
[2010.04.05 08:56:01 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javaws.exe
[2010.04.05 08:56:01 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javaw.exe
[2010.04.05 08:56:01 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\java.exe
[2010.04.05 08:56:01 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javacpl.cpl
[2010.04.05 08:55:50 | 000,000,000 | ---D | C] -- I:\Program Files\Java
[2010.04.05 08:49:48 | 000,000,000 | ---D | C] -- I:\Documents and Settings\All Users\Application Data\Sun
[2010.04.05 08:49:33 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\deploytk.dll
[2010.04.05 08:48:27 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\Sun
[2010.04.03 08:52:52 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Local Settings\Application Data\STDUViewer
[2010.04.03 08:52:51 | 000,348,160 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\msvcr71.dll
[2010.04.03 08:52:51 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\STDUtility
[2010.04.03 08:52:51 | 000,000,000 | ---D | C] -- I:\Program Files\STDU Viewer
[2010.04.03 08:32:38 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\UDC Profiles
[2010.04.03 08:32:09 | 000,024,440 | ---- | C] (fCoder Group, Inc.) -- I:\WINDOWS\System32\udcpm.dll
[2010.04.03 08:32:09 | 000,000,000 | R--D | C] -- I:\Documents and Settings\Administrator\My Documents\UDC Output Files
[2010.04.03 08:32:03 | 000,000,000 | ---D | C] -- I:\Program Files\Universal Document Converter
[2010.04.02 20:52:55 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\T.MissSA
[2010.03.31 19:24:06 | 000,000,000 | ---D | C] -- I:\Documents and Settings\All Users\Application Data\TechSmith
[2010.03.31 19:21:56 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\TechSmith_Camtasia_Studio_6.0.3
[2010.03.31 18:32:52 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Local Settings\Application Data\Ahead
[2010.03.31 18:32:23 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\Ahead
[2010.03.31 18:32:04 | 000,000,000 | ---D | C] -- I:\Documents and Settings\All Users\Application Data\Ahead
[2010.03.31 18:30:26 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\Ahead
[2010.03.31 18:29:47 | 000,000,000 | ---D | C] -- I:\WINDOWS\RegisteredPackages
[2010.03.31 18:27:05 | 186,745,040 | ---- | C] (Igor Pavlov) -- I:\Documents and Settings\Administrator\Desktop\Nero-7.10.1.0_sky_trial.exe
[2010.03.31 18:27:05 | 003,068,544 | ---- | C] (Hewlett Packard Company ) -- I:\Documents and Settings\Administrator\Desktop\LS_Update_1.4.142.1_.exe
[2010.03.31 16:34:22 | 000,000,000 | ---D | C] -- I:\Program Files\WM Converter
[2010.03.28 23:41:45 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\ShutIsla-AC3-Pahyl.of.BonGo
[2010.03.28 20:51:43 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\CHMBRR
[2010.03.28 07:20:40 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Crazy.Heart.2009.BDRip.XviD-iMBT
[2010.03.27 13:59:12 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\lj1010serieshb-en
[2010.03.27 13:53:49 | 000,012,928 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\dllcache\dot4prt.sys
[2010.03.27 13:53:42 | 000,206,976 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\dllcache\dot4.sys
[2010.03.27 13:53:42 | 000,023,808 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\dllcache\dot4usb.sys
[2010.03.27 13:32:31 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Stratégia
[2010.03.26 08:27:12 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Korekcie Hry
[2010.03.25 21:53:38 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\camtasia poker
[2010.03.25 21:50:44 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\My Documents\Camtasia Studio
[2010.03.25 21:50:38 | 000,000,000 | ---D | C] -- I:\WINDOWS\System32\QuickTime
[2010.03.25 21:49:25 | 000,000,000 | ---D | C] -- I:\Program Files\TechSmith_Camtasia_Studio_6.0.3
[2010.03.23 20:51:17 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Super Movie Hits (2008)
[2010.03.23 20:26:03 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Forrest Gump - Album (1995)
[2010.03.23 20:25:54 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Pupendo (2003)
[2010.03.23 20:02:17 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Duety_s_Vladimirem_Mensikem
[2010.03.23 19:46:51 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Vománkový víno
[2010.03.23 19:41:42 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\RND (1980) - Hry Na Domáce Zvieratá
[2010.03.23 19:36:07 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Radosina zmes Kublajz
[2010.03.23 19:34:49 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\RadosinaPokoj Domu Tomuto
[2010.03.23 19:28:55 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Radosinske naivne divadlo
[2010.03.23 19:22:35 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\RND (2001) - Loď Svet
[2010.03.23 18:33:04 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Fried
[2010.03.22 19:12:04 | 000,015,104 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\dllcache\usbscan.sys
[2010.03.22 19:12:04 | 000,005,632 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\ptpusb.dll
[2010.03.22 19:12:03 | 000,159,232 | ---- | C] (Microsoft Corporation) -- I:\WINDOWS\System32\ptpusd.dll
[2010.03.21 22:01:43 | 000,000,000 | ---D | C] -- I:\Program Files\Guitar Pro 5
[2010.03.21 22:01:21 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\Guitar Pro 5.2
[2010.03.18 16:41:51 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\My Documents\THE SETTLERS - Heritage of Kings
[2010.03.18 16:38:56 | 000,000,000 | ---D | C] -- I:\Program Files\Ubisoft
[2010.03.13 10:21:42 | 000,000,000 | ---D | C] -- I:\Program Files\trend micro
[2010.03.13 10:21:42 | 000,000,000 | ---D | C] -- I:\rsit
[2010.03.10 20:14:31 | 000,047,360 | ---- | C] (VSO Software) -- I:\Documents and Settings\Administrator\Application Data\pcouffin.sys
[2010.03.10 20:14:31 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\Vso
[2010.03.10 20:14:31 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\My Documents\PcSetup
[2010.03.10 20:14:25 | 000,000,000 | ---D | C] -- I:\Documents and Settings\All Users\Application Data\DVDXStudio
[2010.03.10 20:14:25 | 000,000,000 | ---D | C] -- I:\Program Files\CloneDVD5
[2010.03.10 20:12:24 | 016,817,511 | ---- | C] (DVD X Studios ) -- I:\Documents and Settings\Administrator\Desktop\CloneDVDSetup.exe
[2010.03.10 14:39:34 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Desktop\The Hurt Locker
[2010.03.10 12:18:26 | 000,000,000 | -HSD | C] -- I:\RECYCLER
[2010.03.10 09:59:13 | 000,000,000 | ---D | C] -- I:\Documents and Settings\Administrator\Application Data\Skype
[2010.03.10 09:59:09 | 000,000,000 | ---D | C] -- I:\Program Files\Common Files\Skype
[2010.03.10 09:59:07 | 000,000,000 | R--D | C] -- I:\Program Files\Skype
[2010.02.25 18:52:36 | 000,000,000 | ---D | M] -- I:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010.02.17 10:37:55 | 000,000,000 | ---D | M] -- I:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009.12.31 12:55:22 | 000,000,000 | ---D | M] -- I:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009.12.31 12:54:45 | 000,000,000 | ---D | M] -- I:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009.12.31 12:51:33 | 000,000,000 | --SD | M] -- I:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009.12.31 12:51:33 | 000,000,000 | --SD | M] -- I:\Documents and Settings\LocalService\Application Data\Microsoft
[5 I:\WINDOWS\*.tmp files -> I:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.04.08 09:15:56 | 000,466,095 | ---- | M] () -- I:\UsbFix_Upload_Me_ROBO.zip
[2010.04.08 09:02:22 | 000,012,598 | ---- | M] () -- I:\WINDOWS\System32\wpa.dbl
[2010.04.08 09:02:17 | 000,000,049 | -HS- | M] () -- I:\WINDOWS\System32\mmf.sys
[2010.04.08 09:02:10 | 000,000,996 | ---- | M] () -- I:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.04.08 09:02:09 | 000,000,006 | -H-- | M] () -- I:\WINDOWS\tasks\SA.DAT
[2010.04.08 09:01:59 | 000,002,048 | --S- | M] () -- I:\WINDOWS\bootstat.dat
[2010.04.08 09:00:41 | 002,883,584 | -H-- | M] () -- I:\Documents and Settings\Administrator\NTUSER.DAT
[2010.04.08 09:00:41 | 000,000,178 | -HS- | M] () -- I:\Documents and Settings\Administrator\ntuser.ini
[2010.04.08 08:52:01 | 000,001,000 | ---- | M] () -- I:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.04.08 08:41:40 | 000,561,664 | ---- | M] (OldTimer Tools) -- I:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010.04.08 08:41:32 | 001,776,011 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\UsbFix.exe
[2010.04.08 08:39:56 | 000,001,729 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010.04.08 08:36:18 | 000,001,907 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\EA Download Manager.lnk
[2010.04.08 05:17:06 | 000,272,291 | ---- | M] () -- I:\WINDOWS\System32\NvApps.xml
[2010.04.07 20:42:38 | 000,138,184 | ---- | M] () -- I:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.04.07 20:07:10 | 000,001,698 | ---- | M] () -- I:\Documents and Settings\Administrator\default.pls
[2010.04.07 20:07:05 | 000,000,069 | ---- | M] () -- I:\WINDOWS\NeroDigital.ini
[2010.04.07 17:31:34 | 000,215,128 | ---- | M] () -- I:\WINDOWS\System32\PnkBstrB.xtr
[2010.04.07 14:53:30 | 000,008,964 | ---- | M] () -- I:\WINDOWS\System32\ealregsnapshot1.reg
[2010.04.07 14:52:52 | 000,001,815 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Need for Speed™ Undercover.lnk
[2010.04.06 17:58:32 | 000,043,008 | ---- | M] () -- I:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.04.06 15:20:41 | 001,644,185 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Scan001.PDF
[2010.04.06 10:52:18 | 000,083,099 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\prihlasenie.JPG
[2010.04.06 04:43:58 | 000,002,419 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Shortcut to HoldemManager.exe.lnk
[2010.04.05 17:12:29 | 000,089,593 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\viewReportAction.pdf
[2010.04.05 14:43:34 | 000,316,640 | ---- | M] () -- I:\WINDOWS\WMSysPr9.prx
[2010.04.05 14:43:33 | 000,000,893 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Camtasia Studio 6.lnk
[2010.04.05 08:55:53 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javaws.exe
[2010.04.05 08:55:53 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javaw.exe
[2010.04.05 08:55:53 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\java.exe
[2010.04.05 08:55:53 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\javacpl.cpl
[2010.04.05 08:55:52 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- I:\WINDOWS\System32\deploytk.dll
[2010.04.04 11:58:04 | 089,595,240 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Session june 7.wmv
[2010.04.04 11:33:15 | 250,817,536 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\FTP[100]nl 4 table.avi
[2010.04.04 10:32:24 | 000,134,675 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Poker_coaching_videos.5233970.TPB.torrent
[2010.04.04 09:08:12 | 336,743,974 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Diederik part 1.mp4
[2010.04.03 14:07:58 | 070,420,219 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\SAMPLE-LUCKYCHEWY.wmv
[2010.04.03 13:50:55 | 021,048,549 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\SAMPLE-AEJONES.wmv
[2010.04.03 10:01:19 | 000,512,960 | ---- | M] () -- I:\WINDOWS\System32\PerfStringBackup.INI
[2010.04.03 10:01:19 | 000,435,590 | ---- | M] () -- I:\WINDOWS\System32\perfh009.dat
[2010.04.03 10:01:19 | 000,068,360 | ---- | M] () -- I:\WINDOWS\System32\perfc009.dat
[2010.04.03 09:57:58 | 000,002,560 | ---- | M] () -- I:\WINDOWS\_MSRSTRT.EXE
[2010.04.03 08:52:51 | 000,000,670 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\STDU Viewer.lnk
[2010.04.03 08:32:24 | 000,000,512 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\UDC Output Files.lnk
[2010.04.03 08:16:40 | 098,460,507 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Mistrovstvi_Excel_2007-150-man.djvu
[2010.03.31 18:32:44 | 000,002,361 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2010.03.31 18:32:44 | 000,002,261 | ---- | M] () -- I:\Documents and Settings\All Users\Desktop\Nero Home.lnk
[2010.03.31 17:26:01 | 217,486,731 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\capture-2.avi.asf
[2010.03.28 22:19:35 | 000,100,504 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Leaves of Grass.srt
[2010.03.27 13:58:31 | 000,928,240 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\lj1010serieshb-en.exe
[2010.03.27 06:36:55 | 002,822,656 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\TeamViewer_Setup.exe
[2010.03.27 06:29:32 | 000,180,182 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\gioo.JPG
[2010.03.27 06:28:55 | 003,932,214 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\gio.bmp
[2010.03.27 06:19:59 | 000,199,169 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\m3bdtrip 093.jpg
[2010.03.26 20:40:58 | 000,010,908 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Strišková - Maboro.xlsx
[2010.03.26 19:30:10 | 000,034,304 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Zoznam_pracov._leas._spoloč.doc
[2010.03.26 19:00:10 | 000,010,629 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Pacienti neplatici.xlsx
[2010.03.26 09:39:24 | 296,080,216 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\finalni verze.wmv
[2010.03.25 22:49:02 | 155,911,898 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\yegon-nl200-20090322.wmv
[2010.03.25 22:14:13 | 000,199,845 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\stats.JPG
[2010.03.25 22:05:48 | 000,258,247 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\poker stats.JPG
[2010.03.25 16:01:16 | 000,927,230 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\animat.pdf
[2010.03.25 13:58:24 | 000,015,015 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Dobrý deň.docx
[2010.03.25 12:54:25 | 000,011,747 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Zošit1.xlsx
[2010.03.25 12:54:25 | 000,000,165 | -H-- | M] () -- I:\Documents and Settings\Administrator\Desktop\~$Zošit1.xlsx
[2010.03.25 11:23:56 | 000,021,504 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Vyúčtovanie Apartmán A1 .doc
[2010.03.22 19:17:39 | 000,268,600 | ---- | M] () -- I:\WINDOWS\System32\FNTCACHE.DAT
[2010.03.21 22:05:22 | 000,069,632 | ---- | M] () -- I:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010.03.21 22:01:50 | 000,000,619 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\Guitar Pro 5.lnk
[2010.03.13 10:21:21 | 000,781,909 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\RSIT.exe
[2010.03.10 20:14:47 | 000,000,014 | ---- | M] () -- I:\WINDOWS\System32\systeminfo3.dll
[2010.03.10 20:14:31 | 000,087,608 | ---- | M] () -- I:\Documents and Settings\Administrator\Application Data\inst.exe
[2010.03.10 20:14:31 | 000,047,360 | ---- | M] (VSO Software) -- I:\Documents and Settings\Administrator\Application Data\pcouffin.sys
[2010.03.10 20:14:31 | 000,007,887 | ---- | M] () -- I:\Documents and Settings\Administrator\Application Data\pcouffin.cat
[2010.03.10 20:14:31 | 000,001,144 | ---- | M] () -- I:\Documents and Settings\Administrator\Application Data\pcouffin.inf
[2010.03.10 20:14:30 | 000,000,682 | ---- | M] () -- I:\Documents and Settings\Administrator\Desktop\CloneDVD5.lnk
[2010.03.10 20:13:36 | 016,817,511 | ---- | M] (DVD X Studios ) -- I:\Documents and Settings\Administrator\Desktop\CloneDVDSetup.exe
[5 I:\WINDOWS\*.tmp files -> I:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.08 09:15:56 | 000,466,095 | ---- | C] () -- I:\UsbFix_Upload_Me_ROBO.zip
[2010.04.08 08:41:30 | 001,776,011 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\UsbFix.exe
[2010.04.08 08:39:36 | 000,001,729 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010.04.08 08:36:18 | 000,001,907 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\EA Download Manager.lnk
[2010.04.07 14:53:30 | 000,008,964 | ---- | C] () -- I:\WINDOWS\System32\ealregsnapshot1.reg
[2010.04.07 14:52:52 | 000,001,815 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\Need for Speed™ Undercover.lnk
[2010.04.06 14:34:42 | 001,644,185 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Scan001.PDF
[2010.04.06 10:52:18 | 000,083,099 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\prihlasenie.JPG
[2010.04.05 17:12:29 | 000,089,593 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\viewReportAction.pdf
[2010.04.05 14:43:33 | 000,000,893 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\Camtasia Studio 6.lnk
[2010.04.04 11:58:01 | 089,595,240 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Session june 7.wmv
[2010.04.04 11:33:08 | 250,817,536 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\FTP[100]nl 4 table.avi
[2010.04.04 10:32:24 | 000,134,675 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Poker_coaching_videos.5233970.TPB.torrent
[2010.04.04 08:46:55 | 336,743,974 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Diederik part 1.mp4
[2010.04.03 14:03:22 | 070,420,219 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\SAMPLE-LUCKYCHEWY.wmv
[2010.04.03 13:49:16 | 021,048,549 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\SAMPLE-AEJONES.wmv
[2010.04.03 09:57:58 | 000,002,560 | ---- | C] () -- I:\WINDOWS\_MSRSTRT.EXE
[2010.04.03 08:52:51 | 000,000,670 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\STDU Viewer.lnk
[2010.04.03 08:32:24 | 000,000,512 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\UDC Output Files.lnk
[2010.04.03 08:10:43 | 098,460,507 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Mistrovstvi_Excel_2007-150-man.djvu
[2010.04.02 11:49:12 | 000,001,698 | ---- | C] () -- I:\Documents and Settings\Administrator\default.pls
[2010.03.31 19:05:57 | 052,734,210 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Video production.wmv
[2010.03.31 18:32:44 | 000,002,361 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2010.03.31 18:32:44 | 000,002,261 | ---- | C] () -- I:\Documents and Settings\All Users\Desktop\Nero Home.lnk
[2010.03.31 18:27:14 | 000,118,784 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Nero_7_Keygen.exe
[2010.03.31 17:09:43 | 217,486,731 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\capture-2.avi.asf
[2010.03.28 22:19:27 | 000,100,504 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Leaves of Grass.srt
[2010.03.27 13:58:28 | 000,928,240 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\lj1010serieshb-en.exe
[2010.03.27 06:36:47 | 002,822,656 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\TeamViewer_Setup.exe
[2010.03.27 06:29:32 | 000,180,182 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\gioo.JPG
[2010.03.27 06:28:54 | 003,932,214 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\gio.bmp
[2010.03.27 06:19:45 | 000,199,169 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\m3bdtrip 093.jpg
[2010.03.27 05:58:18 | 130,227,264 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\HEM tutorial.wmv
[2010.03.26 19:30:10 | 000,034,304 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Zoznam_pracov._leas._spoloč.doc
[2010.03.26 19:26:50 | 000,010,908 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Strišková - Maboro.xlsx
[2010.03.26 19:00:10 | 000,010,629 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Pacienti neplatici.xlsx
[2010.03.26 17:51:40 | 296,080,216 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\finalni verze.wmv
[2010.03.25 22:39:33 | 155,911,898 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\yegon-nl200-20090322.wmv
[2010.03.25 22:14:13 | 000,199,845 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\stats.JPG
[2010.03.25 22:05:48 | 000,258,247 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\poker stats.JPG
[2010.03.25 16:01:16 | 000,927,230 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\animat.pdf
[2010.03.25 13:58:53 | 726,396,296 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\2006_03_09-Pod_lampou-Matematika_postrach_ci_poezia.avi
[2010.03.25 12:54:25 | 000,011,747 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Zošit1.xlsx
[2010.03.25 12:54:25 | 000,000,165 | -H-- | C] () -- I:\Documents and Settings\Administrator\Desktop\~$Zošit1.xlsx
[2010.03.25 11:23:56 | 000,021,504 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Vyúčtovanie Apartmán A1 .doc
[2010.03.25 10:27:44 | 000,015,015 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Dobrý deň.docx
[2010.03.22 19:12:06 | 1786,065,398 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\NAVIGON_1.1.ipa
[2010.03.21 22:01:50 | 000,000,619 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\Guitar Pro 5.lnk
[2010.03.16 12:13:22 | 000,051,135 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\d3vl2090 r03.pdf
[2010.03.15 23:59:52 | 000,009,262 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\m-brooklyn.nfo
[2010.03.13 10:21:20 | 000,781,909 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\RSIT.exe
[2010.03.10 20:14:47 | 000,000,014 | ---- | C] () -- I:\WINDOWS\System32\systeminfo3.dll
[2010.03.10 20:14:41 | 000,000,034 | ---- | C] () -- I:\Documents and Settings\Administrator\Application Data\pcouffin.log
[2010.03.10 20:14:31 | 000,087,608 | ---- | C] () -- I:\Documents and Settings\Administrator\Application Data\inst.exe
[2010.03.10 20:14:31 | 000,007,887 | ---- | C] () -- I:\Documents and Settings\Administrator\Application Data\pcouffin.cat
[2010.03.10 20:14:31 | 000,001,144 | ---- | C] () -- I:\Documents and Settings\Administrator\Application Data\pcouffin.inf
[2010.03.10 20:14:30 | 000,000,682 | ---- | C] () -- I:\Documents and Settings\Administrator\Desktop\CloneDVD5.lnk
[2010.03.04 08:21:01 | 000,000,049 | -HS- | C] () -- I:\WINDOWS\System32\mmf.sys
[2010.03.04 08:20:59 | 000,048,640 | ---- | C] () -- I:\WINDOWS\mmfs.dll
[2010.02.10 04:02:13 | 000,000,206 | ---- | C] () -- I:\WINDOWS\System32\MRT.INI
[2010.01.22 10:26:20 | 000,000,069 | ---- | C] () -- I:\WINDOWS\NeroDigital.ini
[2010.01.10 11:56:50 | 000,043,008 | ---- | C] () -- I:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.06 14:27:18 | 000,000,000 | ---- | C] () -- I:\WINDOWS\HMHud.INI
[2010.01.01 18:31:47 | 000,138,184 | ---- | C] () -- I:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.12.31 12:55:30 | 000,001,024 | -H-- | C] () -- I:\Documents and Settings\Administrator\ntuser.dat.LOG
[2009.12.31 12:55:30 | 000,000,178 | -HS- | C] () -- I:\Documents and Settings\Administrator\ntuser.ini
[2009.12.31 12:55:29 | 002,883,584 | -H-- | C] () -- I:\Documents and Settings\Administrator\NTUSER.DAT
[2009.06.19 21:06:22 | 000,197,912 | ---- | C] () -- I:\WINDOWS\System32\physxcudart_20.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelSwedish.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelSpanish.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelPortugese.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelKorean.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelJapanese.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelGerman.dll
[2009.06.19 21:06:22 | 000,058,648 | ---- | C] () -- I:\WINDOWS\System32\AgCPanelFrench.dll
[2007.11.26 22:56:28 | 000,151,415 | ---- | C] () -- I:\WINDOWS\System32\xlive.dll.cat
[2005.10.14 12:56:50 | 003,596,288 | ---- | C] () -- I:\WINDOWS\System32\qt-dx331.dll
[2005.10.14 12:56:50 | 000,921,600 | ---- | C] () -- I:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 12:56:50 | 000,761,856 | ---- | C] () -- I:\WINDOWS\System32\xvidcore.dll
[2005.10.14 12:56:50 | 000,344,064 | ---- | C] () -- I:\WINDOWS\System32\xvid.dll
[2005.10.14 12:56:50 | 000,237,568 | ---- | C] () -- I:\WINDOWS\System32\OggDS.dll
[2005.10.14 12:56:50 | 000,188,416 | ---- | C] () -- I:\WINDOWS\System32\vorbis.dll
[2005.10.14 12:56:50 | 000,155,136 | ---- | C] () -- I:\WINDOWS\System32\unrar.dll
[2005.10.14 12:56:50 | 000,045,056 | ---- | C] () -- I:\WINDOWS\System32\ogg.dll
< End of report >



OTL Extras logfile created on: 8. 4. 2010 9:17:10 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = I:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 0000041B | Country: Slovakia | Language: SKY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): I:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = I: | %SystemRoot% = I:\WINDOWS | %ProgramFiles% = I:\Program Files
Drive C: | 465,64 Gb Total Space | 373,22 Gb Free Space | 80,15% Space Free | Partition Type: FAT32
Drive D: | 4,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 97,65 Gb Total Space | 30,54 Gb Free Space | 31,28% Space Free | Partition Type: NTFS
Drive J: | 135,22 Gb Total Space | 92,40 Gb Free Space | 68,33% Space Free | Partition Type: NTFS

Computer Name: ROBO
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "I:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "I:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "I:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "I:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"I:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = I:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"I:\Program Files\Opera\opera.exe" = I:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"I:\Program Files\EA GAMES\Battlefield 2\BF2.exe" = I:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 -- ()
"I:\Documents and Settings\Administrator\temp\TeamViewer\Version5\TeamViewer.exe" = I:\Documents and Settings\Administrator\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)
"I:\Program Files\EA GAMES\Need for Speed Undercover\nfs.exe" = I:\Program Files\EA GAMES\Need for Speed Undercover\nfs.exe:*:Enabled:Need for Speed Undercover -- (Electronic Arts)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03CE036B-B815-4EBC-83E9-BBCEDFF862CB}" = Baldur's Gate 2
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{42DE940E-8037-4266-9FBF-5A3AEDA39E96}" = Holdem Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = THE SETTLERS - Dìdictví králù
"{90120000-0010-041B-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Slovak) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0015-041B-0000-0000000FF1CE}" = Microsoft Office Access MUI (Slovak) 2007
"{90120000-0016-041B-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Slovak) 2007
"{90120000-0018-041B-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Slovak) 2007
"{90120000-0019-041B-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Slovak) 2007
"{90120000-001A-041B-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Slovak) 2007
"{90120000-001B-041B-0000-0000000FF1CE}" = Microsoft Office Word MUI (Slovak) 2007
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040E-0000-0000000FF1CE}" = Microsoft Office Proof (Hungarian) 2007
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-002C-041B-0000-0000000FF1CE}" = Microsoft Office Proofing (Slovak) 2007
"{90120000-0044-041B-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Slovak) 2007
"{90120000-006E-041B-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Slovak) 2007
"{91C0B95B-B83A-4828-A775-BBE2DD421033}" = Nero 7 Ultra Edition
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{9AFA9294-C7A4-4DD5-ADBE-3DFC98752417}_is1" = Theatre of War 2 Kursk 1943 Demo (Remove Only)
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1029-7B44-A93000000001}" = Adobe Reader 9.3.1 - Czech
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D5A9DA4B-E4F9-FB49-017D-769FC540F1F0}" = EA Download Manager UI
"{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}" = Need for Speed™ Undercover
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FB8148DD-C575-4B0A-9F6C-0CFC46937930}" = Opera 10.10
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ashampoo Burning Studio 8_is1" = Ashampoo Burning Studio 8.02
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Divinity II - Ego Draconis - Demo_is1" = Divinity II - Ego Draconis - Demo
"Driver Checker_is1" = Driver Checker v2.7.3
"EA Download Manager" = EA Download Manager
"FlatOut: UC_is1" = FlatOut UC
"Guitar Pro 5_is1" = Guitar Pro 5.2
"HijackThis" = HijackThis 2.0.2
"MainApp.exe_is1" = CloneDVD 5.0.0.3
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Nero8Lite_is1" = Nero 8 Lite 8.2.8.0
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PokerStars" = PokerStars
"PROPLUS" = Microsoft Office Professional Plus 2007
"STDU Viewer_is1" = STDU Viewer version 1.5.311.0
"Totalcmd" = Total Commander (Remove or Repair)
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"VLC media player" = VLC media player 1.0.3
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archivátor
"WM Converter 2.0" = WM Converter 2.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22. 1. 2010 14:36:09 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 22. 1. 2010 14:36:09 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1. 2. 2010 14:36:29 | Computer Name = ROBO | Source = Application Error | ID = 1000
Description = Faulting application fulltiltpoker.exe, version 0.0.0.0, faulting
module fulltiltpoker.exe, version 0.0.0.0, fault address 0x003ab122.

Error - 1. 3. 2010 17:29:58 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application HoldemManager.exe, version 1.9.1.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2. 3. 2010 5:26:28 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application HoldemManager.exe, version 1.9.1.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2. 3. 2010 6:25:24 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application HoldemManager.exe, version 1.9.1.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10. 3. 2010 4:25:27 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application Skype.exe, version 4.2.0.152, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 16. 3. 2010 3:54:00 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application HoldemManager.exe, version 1.9.1.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 31. 3. 2010 8:31:39 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1. 4. 2010 23:18:15 | Computer Name = ROBO | Source = Application Hang | ID = 1002
Description = Hanging application HoldemManager.exe, version 1.9.1.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 9. 3. 2010 2:28:09 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 9. 3. 2010 2:36:59 | Computer Name = ROBO | Source = Service Control Manager | ID = 7034
Description = The LicCtrl Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9. 3. 2010 2:36:59 | Computer Name = ROBO | Source = Service Control Manager | ID = 7034
Description = The PostgreSQL Database Server 8.3 service terminated unexpectedly.
It has done this 1 time(s).

Error - 10. 3. 2010 3:54:59 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 10. 3. 2010 3:55:29 | Computer Name = ROBO | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.

Error - 20. 3. 2010 13:17:05 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 22. 3. 2010 13:17:54 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 25. 3. 2010 1:57:24 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 25. 3. 2010 1:58:48 | Computer Name = ROBO | Source = Service Control Manager | ID = 7022
Description = The Windows Image Acquisition (WIA) service hung on starting.

Error - 25. 3. 2010 13:15:17 | Computer Name = ROBO | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126


< End of report >

Spusťte OTL a do spodního okna vložte následující skript. Poté klikněte na Opravit, PC se restartuje, log vložte sem.


Tohle otestujte na http://www.virustotal.com/cs/
I:\WINDOWS\System32\systeminfo3.dll
I:\WINDOWS\System32\mmf.sys

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{E0E899AB-F487-11D5-8D29-0050BA6940E3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E0E899AB-F487-11D5-8D29-0050BA6940E3}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\combofix deleted successfully.
File not found.
File not found.
File not found.
File not found.
I:\WINDOWS\003129_.tmp deleted successfully.
I:\WINDOWS\SET29.tmp deleted successfully.
I:\WINDOWS\SET3.tmp deleted successfully.
I:\WINDOWS\SET4.tmp deleted successfully.
I:\WINDOWS\SET8.tmp deleted successfully.
I:\WINDOWS\_MSRSTRT.EXE moved successfully.
I:\Documents and Settings\Administrator\Desktop\Nero_7_Keygen.exe moved successfully.
I:\Documents and Settings\Administrator\Application Data\inst.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 743738367 bytes
->Temporary Internet Files folder emptied: 58997981 bytes
->Java cache emptied: 63912 bytes
->Flash cache emptied: 2009949 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: postgres
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: postgrespass
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18143 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 4209357934 bytes

Total Files Cleaned = 4 782,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: postgres

User: postgrespass

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.1.0 log created on 04082010_154405

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

OK, ještě virustotal.

Ktora cas z toho co mi to vyhodi vas zaujma?

Odkaz z adresního řádku prohlížeče.

http://www.virustotal.com/cs/reanalisis ... 1270735574

ten druhy file neprejde ani ked cakam 40 minut???

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

nemozem postnut log u combofixu , pretoze ma cca 550k znakov a maximum na tejto stranke je 60k, mam to poslat ako prilohu?

Část Snapshot vynechte a zbytek logu vložte do příspěvku. Poté mi sem celý log dejte jako přílohu.