Desktop Secure 2010

Zpráva

Lord_Viktor · #1 Příspěvek od **Lord_Viktor** » 30 dub 2010 12:34

Sam jsem si hloupe nainstalovat virus do pc, existuje nejaky univerzalni navod, jak se ho zbavit?

#2 Příspěvek od **Caroprd111** » 30 dub 2010 12:48

Zdravím

Každý počítač se řeší individuálně. Vložte sem log z RSIT.

Lord_Viktor · #3 Příspěvek od **Lord_Viktor** » 30 dub 2010 12:56

Logfile of random's system information tool 1.06 (written by random/random)
Run by LV at 2010-04-30 13:09:35
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 80 GB (23%) free of 351 GB
Total RAM: 767 MB (17% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-04-21 1615200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-12-09 18063872]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-08-13 98304]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-04-21 2064736]
"settings"=C:\DOCUME~1\LV\LOCALS~1\Temp\Rar$EX03.563\settings.exe [2010-04-29 160256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
"o4otvguvwwo0"=C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe [2010-04-30 2949632]
"Desktop Security 2010"=C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe [2010-04-29 1415168]
"SecurityCenter"=C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe [2010-04-29 139264]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
DualCoreCenter.lnk - C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe
Gigabyte Wireless Utility.lnk - C:\Program Files\GIGABYTE\Common\GNConfig.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-08-14 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2010-03-17 12464]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=91000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoResolveTrack"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgnsx.exe"="C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\oldgames\Dune 2000\DUNE2000.DAT"="C:\oldgames\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000"
"C:\oldgames\Return to Castle Wolfenstein\WolfMP.exe"="C:\oldgames\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP"
"C:\Games\Dune 2000\DUNE2000.DAT"="C:\Games\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000"
"C:\HRY\Games\Dune 2000\DUNE2000.DAT"="C:\HRY\Games\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000"
"C:\HRY\Games\CS\Valve\hl.exe"="C:\HRY\Games\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\HRY\Roztridit\Dawn of War\W40k.exe"="C:\HRY\Roztridit\Dawn of War\W40k.exe:*:Enabled:W40K"
"C:\HRY\Games\Return to Castle Wolfenstein\WolfMP.exe"="C:\HRY\Games\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP"
"C:\HRY\Roztridit\HL2\hl2.exe"="C:\HRY\Roztridit\HL2\hl2.exe:*:Enabled:hl2"
"C:\HRY\Games\HL2\hl2.exe"="C:\HRY\Games\HL2\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe"="C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Warcraft III\Warcraft III.exe"="C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\Warcraft III\Warcraft III\Warcraft III.exe"="D:\Warcraft III\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\HRY\GamesHelp\Warcraft III\Warcraft III.exe"="C:\HRY\GamesHelp\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Quake III Arena\quake3.exe"="C:\Program Files\Quake III Arena\quake3.exe:*:Enabled:quake3"
"C:\Program Files\TrackMania Sunrise\TmSunrise.exe"="C:\Program Files\TrackMania Sunrise\TmSunrise.exe:*:Enabled:TmSunrise"
"C:\HRY\GamesHelp\Worms2\frontend.exe"="C:\HRY\GamesHelp\Worms2\frontend.exe:*:Enabled:Worms 2 Frontend"
"C:\HRY\GamesHelp\The Battle for Midlle-earth II\game.dat"="C:\HRY\GamesHelp\The Battle for Midlle-earth II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe"="C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe:*:Enabled:lh"
"C:\Program Files\Electronic Arts\Need For Speed III\nfs3.exe"="C:\Program Files\Electronic Arts\Need For Speed III\nfs3.exe:*:Enabled:Need For Speed III for Win32"
"C:\HRY\Worms2\frontend.exe"="C:\HRY\Worms2\frontend.exe:*:Enabled:Worms 2 Frontend"
"C:\Program Files\Xplosiv\SOF PLATINUM\SoF.exe"="C:\Program Files\Xplosiv\SOF PLATINUM\SoF.exe:*:Enabled:SoF"
"C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat"="C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Program Files\KVIrc\kvirc.exe"="C:\Program Files\KVIrc\kvirc.exe:*:Enabled:K Visual IRC Client Executable"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\HRY\Games\hlp\CS\Valve\hl.exe"="C:\HRY\Games\hlp\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\HRY\Games\hlp\HL2\hl2.exe"="C:\HRY\Games\hlp\HL2\hl2.exe:*:Enabled:hl2"
"C:\HRY\Games\Install\Warcraft III\Warcraft III.exe"="C:\HRY\Games\Install\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\HRY\GAMES\Sid Meier's Civilization 4\Civilization4.exe"="C:\HRY\GAMES\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe"="C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords"
"C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe"="C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss"
"C:\HRY\Gamesfault\SIERRA\Half-Life\hl.exe"="C:\HRY\Gamesfault\SIERRA\Half-Life\hl.exe:*:Enabled:Half-Life Launcher"
"C:\HRY\GAMES\SOF PLATINUM\SoF.exe"="C:\HRY\GAMES\SOF PLATINUM\SoF.exe:*:Enabled:SoF"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

======List of files/folders created in the last 1 months======

2010-04-30 13:09:36 ----D---- C:\Program Files\trend micro
2010-04-30 13:09:35 ----D---- C:\rsit
2010-04-30 12:27:54 ----D---- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010
2010-04-19 15:09:25 ----D---- C:\Documents and Settings\LV\Data aplikací\Subversion
2010-04-19 13:41:50 ----D---- C:\Program Files\FITkit
2010-04-19 13:41:14 ----D---- C:\Program Files\DIFX
2010-04-19 13:41:14 ----A---- C:\WINDOWS\system32\ftserui2.dll
2010-04-19 13:41:14 ----A---- C:\WINDOWS\system32\ftcserco.dll
2010-04-19 13:41:10 ----A---- C:\WINDOWS\system32\FTLang.dll
2010-04-19 13:41:10 ----A---- C:\WINDOWS\system32\ftd2xx.dll
2010-04-19 13:41:10 ----A---- C:\WINDOWS\system32\ftbusui.dll
2010-04-13 20:28:41 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-13 20:28:34 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-13 20:28:24 ----HDC---- C:\WINDOWS\$NtUninstallKB979402_WM9$
2010-04-13 20:26:34 ----HDC---- C:\WINDOWS\$NtUninstallKB981349$
2010-04-13 20:26:29 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-13 20:26:24 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-13 20:26:19 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-13 20:26:11 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-08 12:47:33 ----D---- C:\Program Files\ESET

======List of files/folders modified in the last 1 months======

2010-04-30 13:09:36 ----RD---- C:\Program Files
2010-04-30 12:49:52 ----D---- C:\WINDOWS\Prefetch
2010-04-29 12:39:03 ----SD---- C:\Documents and Settings\LV\Data aplikací\Microsoft
2010-04-29 02:05:31 ----D---- C:\WINDOWS
2010-04-29 02:03:58 ----A---- C:\WINDOWS\NeroDigital.ini
2010-04-29 01:33:01 ----A---- C:\WINDOWS\wincmd.ini
2010-04-28 17:14:06 ----D---- C:\WINDOWS\Temp
2010-04-27 20:22:14 ----D---- C:\Documents and Settings\LV\Data aplikací\Skype
2010-04-26 15:03:43 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-25 08:54:05 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-21 14:41:25 ----D---- C:\WINDOWS\system32\drivers
2010-04-19 13:43:49 ----D---- C:\WINDOWS\system32
2010-04-19 13:43:35 ----HD---- C:\WINDOWS\inf
2010-04-19 13:42:42 ----D---- C:\PROGRAMY
2010-04-19 13:41:13 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-04-13 20:28:45 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-13 20:28:39 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-11 14:38:41 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-04-07 17:45:22 ----D---- C:\Program Files\Mozilla Firefox
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-01 11:40:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2010-03-17 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-03-17 29512]
R1 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2010-04-21 242896]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS\System32\DRIVERS\AegisP.sys [2002-01-06 21419]
R2 giveio;giveio; \??\C:\WINDOWS\giveio.sys []
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-08-14 4485632]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-07-02 89600]
R3 DualCoreCenter;DualCoreCenter; \??\C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-12-11 4959232]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 RushTopDevice2;RushTopDevice2; \??\C:\Program Files\MSI\DualCoreCenter\RushTop.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 a9q97mjy;a9q97mjy; C:\WINDOWS\system32\drivers\a9q97mjy.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2008-03-13 57536]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2008-03-13 72000]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 RT61;Gigabyte RT61 Wireless Driver; C:\WINDOWS\System32\DRIVERS\RT61.sys [2007-07-28 483968]
S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568]
S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 98696]
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-08-14 602112]
R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-03-17 308064]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-08-13 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe [2004-03-15 112128]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#4 Příspěvek od **Caroprd111** » 30 dub 2010 13:00

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe

Spusťte, poté do spodního políčka vložte následující skript.

Kód: Vybrat vše

 netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys 
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys 
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys 
cdrom.sys 
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav 
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

Označte položku Pro všechny uživatele.
Označte položky Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Klikněte na tlačítko Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

Lord_Viktor · #5 Příspěvek od **Lord_Viktor** » 30 dub 2010 13:04

ok jdu na to, nevim, jestli to pomuze, ale tahle polozka je presne ten program, ktery to zpusobil

"settings"=C:\DOCUME~1\LV\LOCALS~1\Temp\Rar$EX03.563\settings.exe [2010-04-29 160256]

#6 Příspěvek od **Caroprd111** » 30 dub 2010 13:10

Soubor který to způsobil mi prosím zazipujte a někam uložte, odkaz na soubor mi pošlete soukromou zprávou.

Děkuji

Lord_Viktor · #7 Příspěvek od **Lord_Viktor** » 30 dub 2010 13:16

v zipu mi prisel, v zipu ho dostanete, jen chvili strpeni, nez dobehne OLT, protoze pc mam odpojeny od site

jen tak mimochodem, chce to nejake zasadni znalosti, abych dokazal nekomu poradit co a jak s viry? je mozne se to naucit a byt uzitecny treba v ramci fora tady? je potreba nejake softwarove vybaveni?

Lord_Viktor · #8 Příspěvek od **Lord_Viktor** » 30 dub 2010 13:27

OTL logfile created on: 30.4.2010 14:09:42 - Run 1
OTL by OldTimer - Version 3.2.3.1 Folder = H:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

767,00 Mb Total Physical Memory | 132,00 Mb Available Physical Memory | 17,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 61,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 342,44 Gb Total Space | 78,43 Gb Free Space | 22,90% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 931,51 Gb Total Space | 636,47 Gb Free Space | 68,33% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 489,01 Mb Total Space | 458,02 Mb Free Space | 93,66% Space Free | Partition Type: FAT32
I: Drive not present or media not loaded

Computer Name: LV-PC
Current User Name: LV
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.30 14:01:48 | 000,562,176 | ---- | M] (OldTimer Tools) -- H:\OTL.exe
PRC - [2010.04.30 12:27:44 | 002,949,632 | ---- | M] () -- C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe
PRC - [2010.04.29 10:38:53 | 001,415,168 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe
PRC - [2010.04.29 10:38:09 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe
PRC - [2010.04.21 14:41:22 | 002,064,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010.04.21 14:41:20 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010.04.07 17:45:14 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010.04.06 21:30:11 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010.03.27 19:09:56 | 000,161,384 | ---- | M] () -- C:\Program Files\FITkit\bin\qdevkit.exe
PRC - [2010.03.17 11:54:11 | 000,508,184 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010.03.17 11:54:07 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010.03.17 11:53:28 | 000,710,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009.10.30 13:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe
PRC - [2009.08.13 12:43:54 | 003,276,288 | ---- | M] (The Author of QIP) -- C:\Program Files\QIP\qip.exe
PRC - [2009.01.06 11:26:54 | 032,010,240 | ---- | M] () -- C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe
PRC - [2008.11.21 17:36:08 | 002,004,496 | ---- | M] (Design Science, Inc.) -- C:\Program Files\MathType\MathType.exe
PRC - [2008.08.08 08:04:10 | 001,091,768 | ---- | M] (C. Ghisler & Co.) -- C:\PROGRAMY\totalcmd\TOTALCMD.EXE
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.03.23 22:33:38 | 002,473,984 | ---- | M] (KVIrc Development Team) -- C:\Program Files\KVIrc\kvirc.exe
PRC - [2007.12.07 17:29:58 | 000,753,664 | ---- | M] (GIGABYTE TECHNOLOGY CO., LTD.) -- C:\Program Files\GIGABYTE\Common\GNConfig.exe
PRC - [2007.07.11 16:57:42 | 000,880,640 | R--- | M] (Sony Ericsson Mobile Communications AB) -- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
PRC - [2007.03.16 04:23:20 | 000,983,040 | R--- | M] (Teleca AB) -- C:\Program Files\Common Files\Teleca Shared\Generic.exe
PRC - [2006.11.13 14:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe
PRC - [2006.11.13 14:39:34 | 000,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe

========== Modules (SafeList) ==========

MOD - [2010.04.30 14:01:48 | 000,562,176 | ---- | M] (OldTimer Tools) -- H:\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2010.03.17 11:54:07 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2004.03.15 23:40:52 | 000,112,128 | ---- | M] (TuneUp Software GmbH) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe -- (TUWinStylerThemeSvc)

========== Driver Services (SafeList) ==========

DRV - [2010.04.21 14:41:21 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010.03.17 11:54:11 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010.03.17 11:53:28 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2009.12.17 22:11:33 | 000,163,712 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\vidstub.sys -- (BootScreen)
DRV - [2009.12.17 19:08:22 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.08.14 06:27:00 | 004,485,632 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008.12.16 10:48:50 | 000,055,296 | ---- | M] (Your Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\MSI\DualCoreCenter\RushTop.sys -- (RushTopDevice2)
DRV - [2008.12.11 11:24:20 | 004,959,232 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.12.08 10:30:22 | 000,028,672 | ---- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand | Running] -- C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys -- (DualCoreCenter)
DRV - [2008.10.30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.08.05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008.07.02 21:38:14 | 000,089,600 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2008.06.20 01:33:58 | 000,005,248 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\giveio.sys -- (giveio)
DRV - [2008.03.13 15:51:52 | 000,057,536 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2008.03.13 15:50:02 | 000,072,000 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2007.10.12 03:40:12 | 000,009,096 | R--- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdide.sys -- (amdide)
DRV - [2007.07.28 17:10:18 | 000,483,968 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61)
DRV - [2007.06.29 14:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2007.04.24 12:33:46 | 000,100,488 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mgmt.sys -- (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM)
DRV - [2007.04.24 12:33:46 | 000,098,696 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125obex.sys -- (s125obex)
DRV - [2007.04.24 12:33:44 | 000,108,680 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mdm.sys -- (s125mdm)
DRV - [2007.04.24 12:33:42 | 000,015,112 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mdfl.sys -- (s125mdfl)
DRV - [2007.04.24 12:33:34 | 000,083,336 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125bus.sys -- (s125bus) Sony Ericsson Device 125 driver (WDM)
DRV - [2007.04.23 16:54:50 | 000,100,488 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mgmt.sys -- (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM)
DRV - [2007.04.23 16:54:50 | 000,098,568 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115obex.sys -- (s115obex)
DRV - [2007.04.23 16:54:48 | 000,108,680 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdm.sys -- (s115mdm)
DRV - [2007.04.23 16:54:48 | 000,015,112 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdfl.sys -- (s115mdfl)
DRV - [2007.04.23 16:54:46 | 000,083,208 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115bus.sys -- (s115bus) Sony Ericsson Device 115 driver (WDM)
DRV - [2007.01.12 20:09:53 | 000,082,296 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2006.09.24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)
DRV - [2006.07.10 18:19:58 | 000,027,032 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2006.07.05 14:46:06 | 000,063,352 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01a.sys -- (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a)
DRV - [2006.07.01 22:42:58 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2006.06.14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2006.01.04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005.05.17 14:48:21 | 000,050,176 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.01.07 18:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.com/preferences?hl={SUB_RFC1766}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie?hl={SUB_RFC1766}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-484763869-838170752-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.812

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010.04.22 10:12:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.07 17:45:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.07 17:45:18 | 000,000,000 | ---D | M]

[2002.01.06 00:12:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Mozilla\Extensions
[2010.04.25 20:46:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Mozilla\Firefox\Profiles\ceni1ppe.default\extensions
[2009.12.12 16:46:49 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\LV\Data aplikací\Mozilla\Firefox\Profiles\ceni1ppe.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.14 23:01:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.12.12 17:04:44 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2010.03.12 18:04:27 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.03.12 18:04:27 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.03.12 18:04:27 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.03.12 18:04:27 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.03.12 18:04:27 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2002.12.05 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [settings] C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [Desktop Security 2010] C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe ()
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [o4otvguvwwo0] C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe ()
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [SecurityCenter] C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe ()
O4 - HKLM..\RunServices: [settings] C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Gigabyte Wireless Utility.lnk = C:\Program Files\GIGABYTE\Common\GNConfig.exe (GIGABYTE TECHNOLOGY CO., LTD.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-484763869-838170752-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-484763869-838170752-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002.01.05 23:13:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2002.01.05 23:13:46 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: VIDC.IV41 - C:\WINDOWS\System32\ir41_32.dll (Intel Corporation)
Drivers32: VIDC.MKVC - C:\WINDOWS\System32\KMVIDC32.DLL ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54338281256517632)

========== Files/Folders - Created Within 7 Days ==========

[2010.04.30 13:09:36 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.04.30 13:09:35 | 000,000,000 | ---D | C] -- C:\rsit
[2010.04.30 12:30:53 | 005,918,800 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\LV\Plocha\mbam-setup.exe
[2010.04.30 12:27:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010
[2010.04.29 12:36:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LV\Application Data
[2010.04.27 17:30:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LV\fitkit-svn
[2010.04.25 08:29:25 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\LV\Recent
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2010.04.30 12:31:46 | 005,918,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\LV\Plocha\mbam-setup.exe
[2010.04.30 12:27:59 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\LV\NTUSER.DAT
[2010.04.30 12:26:20 | 000,137,779 | ---- | M] () -- C:\Documents and Settings\LV\Plocha\settings.zip
[2010.04.30 08:23:12 | 059,393,922 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010.04.29 03:00:24 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\LV\Plocha\SCo.xls
[2010.04.29 02:03:58 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\LV\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.04.29 02:03:58 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.04.29 01:33:01 | 000,003,554 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.04.27 21:29:58 | 000,008,396 | ---- | M] () -- C:\Documents and Settings\LV\Plocha\projekt.zip
[2010.04.25 20:30:34 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.04.25 20:30:33 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.04.25 20:30:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.04.25 08:54:02 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\LV\ntuser.ini
[2010.04.24 01:15:01 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\LV\Plocha\nastrel.xls
[2010.04.23 17:15:31 | 000,000,388 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.30 12:26:20 | 000,137,779 | ---- | C] () -- C:\Documents and Settings\LV\Plocha\settings.zip
[2010.04.27 21:29:56 | 000,008,396 | ---- | C] () -- C:\Documents and Settings\LV\Plocha\projekt.zip
[2010.04.27 15:36:19 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\LV\Plocha\SCo.xls
[2010.04.19 13:42:59 | 000,005,248 | ---- | C] () -- C:\WINDOWS\giveio.sys
[2010.01.12 18:52:29 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.01.08 15:46:04 | 000,000,896 | ---- | C] () -- C:\WINDOWS\STBC.ini
[2010.01.05 19:59:49 | 000,000,966 | ---- | C] () -- C:\WINDOWS\SOFPLAT.ini
[2010.01.05 18:00:20 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI
[2010.01.05 16:42:05 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2010.01.05 00:48:52 | 000,000,632 | ---- | C] () -- C:\WINDOWS\Sof2.INI
[2010.01.04 20:39:45 | 000,000,684 | ---- | C] () -- C:\WINDOWS\Sof.INI
[2010.01.04 18:03:05 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2009.12.27 18:55:41 | 000,000,871 | ---- | C] () -- C:\WINDOWS\QIII.INI
[2009.12.18 17:15:10 | 000,000,099 | ---- | C] () -- C:\WINDOWS\dinksmallwood.ini
[2009.12.18 16:58:32 | 000,066,936 | -HS- | C] () -- C:\WINDOWS\dlinfo_0.drv
[2009.12.18 16:24:37 | 000,000,386 | ---- | C] () -- C:\WINDOWS\XLMSoft.ini
[2009.12.18 15:55:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BB.INI
[2009.12.17 20:21:13 | 000,163,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\vidstub.sys
[2009.12.17 19:08:22 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009.12.17 18:56:28 | 000,000,040 | ---- | C] () -- C:\WINDOWS\nero.INI
[2009.12.12 14:52:11 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.10.19 02:36:22 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009.10.18 20:22:40 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll
[2003.04.09 16:38:04 | 000,005,664 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.01.05 23:42:19 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2002.01.05 23:38:06 | 000,003,554 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010.02.04 17:08:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\avg9
[2009.12.17 19:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2009.12.12 15:00:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Teleca
[2010.04.11 14:38:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2009.12.25 17:05:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
[2009.12.22 23:05:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\AnvSoft
[2009.12.25 17:47:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\DAEMON Tools Lite
[2010.01.04 20:00:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Design Science
[2010.04.30 12:27:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010
[2009.10.19 18:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Dev-Cpp
[2009.12.18 13:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\EFSoftware
[2009.12.12 17:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Foxit
[2010.01.16 22:46:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\FreeFLVConverter
[2010.02.06 14:39:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\ICQ
[2010.03.03 15:17:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Leadertech
[2010.01.05 14:17:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\My Battle for Middle-earth(tm) II Files
[2010.03.12 23:10:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\My Games
[2009.12.15 00:44:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\MyPhoneExplorer
[2010.01.05 15:34:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\OpenOffice.org
[2010.04.19 15:09:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Subversion
[2009.12.13 23:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Teleca
[2009.10.18 21:51:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\TuneUp Software
[2010.04.23 17:15:31 | 000,000,388 | ---- | M] () -- C:\WINDOWS\Tasks\1-Click Maintenance.job

========== Purity Check ==========

========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"DAEMON Tools Lite" = "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun -- [2009.10.30 13:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd)
"H/PC Connection Agent" = "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" -- [2006.11.13 14:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation)
"o4otvguvwwo0" = C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe -- [2010.04.30 12:27:44 | 002,949,632 | ---- | M] ()
"Desktop Security 2010" = "C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe" /STARTUP -- [2010.04.29 10:38:53 | 001,415,168 | ---- | M] ()
"SecurityCenter" = C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe -- [2010.04.29 10:38:09 | 000,139,264 | ---- | M] ()

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.10.18 20:44:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Adobe
[2009.12.22 23:05:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\AnvSoft
[2002.01.05 23:45:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\ATI
[2009.12.25 17:47:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\DAEMON Tools Lite
[2010.01.04 20:00:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Design Science
[2010.04.30 12:27:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010
[2009.10.19 18:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Dev-Cpp
[2009.12.18 13:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\EFSoftware
[2009.12.12 17:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Foxit
[2010.01.16 22:46:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\FreeFLVConverter
[2002.01.05 23:38:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Help
[2010.02.06 14:39:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\ICQ
[2002.01.05 23:19:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Identities
[2002.01.06 00:40:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\InstallShield
[2010.03.03 15:17:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Leadertech
[2009.10.18 20:44:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Macromedia
[2010.04.29 12:39:03 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LV\Data aplikací\Microsoft
[2002.01.06 00:12:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Mozilla
[2010.01.05 14:17:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\My Battle for Middle-earth(tm) II Files
[2010.03.12 23:10:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\My Games
[2009.12.15 00:44:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\MyPhoneExplorer
[2010.01.05 15:34:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\OpenOffice.org
[2010.04.27 20:22:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Skype
[2009.12.12 15:00:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Sony Ericsson
[2010.04.19 15:09:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Subversion
[2009.12.13 23:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\Teleca
[2009.10.18 21:51:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\TuneUp Software
[2010.03.03 15:07:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LV\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2010.04.29 10:38:53 | 001,415,168 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe
[2010.04.29 10:38:09 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe
[2010.04.30 12:27:44 | 002,949,632 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securityhelper.exe
[2009.10.18 20:10:15 | 000,009,158 | R--- | M] () -- C:\Documents and Settings\LV\Data aplikací\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
[2009.10.18 20:18:01 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\LV\Data aplikací\Microsoft\Installer\{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}\ARPPRODUCTICON.exe

< MD5 for: AGP440.SYS >
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: AHCIX86.SYS >
[2006.10.11 06:34:14 | 000,120,320 | ---- | M] (ATI Technologies Inc.) MD5=6763E07BDC8AFFBA5F3A5E6F71D93D1B -- C:\PROGRAMY\sw\OVLADACE\ATI\SBDrv\RAID\x86\ahcix86.sys
[2007.08.17 20:29:02 | 000,123,392 | R--- | M] (AMD Technologies Inc.) MD5=9A31E06CE926AD3A268DC853A8302800 -- C:\PROGRAMY\sw\OVLADACE\XP\SBDrv\RAID6xx\x86\ahcix86.sys
[2009.01.23 11:35:14 | 000,186,384 | R--- | M] (Advanced Micro Devices, Inc) MD5=C2834AEC989618F9CDB4B436FCF0F543 -- C:\PROGRAMY\sw\OVLADACE\XP\SBDrv\RAID7xx\x86\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2002.12.05 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

< MD5 for: CDROM.SYS >
[2002.12.05 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:cdrom.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:cdrom.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2004.08.03 22:59:54 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2004.08.17 15:49:04 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2002.12.05 14:00:00 | 000,000,987 | ---- | M] () MD5=2322E8CBC335EE67F031F45011C2674F -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\EVENTLOG.DLL
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2004.08.17 15:49:08 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004.08.17 15:49:24 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2002.12.05 14:00:00 | 000,006,825 | ---- | M] () MD5=793391078DA0EF3EC2A47A9391673072 -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\EXPLORER.EXE

< MD5 for: HAL.DLL >
[2002.12.05 14:00:00 | 010,174,968 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:hal.dll
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:hal.dll
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2008.04.13 20:31:28 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=4329EE7D502C9113EBA0F9570392F5EE -- C:\WINDOWS\system32\HAL.DLL
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2004.08.03 22:59:14 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=DFCE51FD96909D1B97D4A1A72D060D77 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll

< MD5 for: CHANGER.SYS >
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2004.08.17 15:57:28 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:Changer.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys
[2004.08.03 23:00:14 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=DAF1A8193B6CAF0FB858CADCC5C4AF4A -- C:\WINDOWS\$NtServicePackUninstall$\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.10.19 18:11:46 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2002.12.05 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2002.12.05 14:00:00 | 000,001,313 | ---- | M] () MD5=77B31EE695B575B2C83D2B1C45EF5513 -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\ISAPNP.SYS
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2004.08.17 15:49:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe
[2002.12.05 14:00:00 | 000,006,544 | ---- | M] () MD5=FF9F20B48F6652DFA07E4FD41A146D9F -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\LSASS.EXE

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2004.08.03 23:14:30 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2009.02.06 20:47:20 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=1F43B8C0F4C767FBED89711C30E704D9 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:47:20 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=1F43B8C0F4C767FBED89711C30E704D9 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004.08.17 15:49:14 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2002.12.05 14:00:00 | 000,002,511 | ---- | M] () MD5=5EC22C986659D3B7DC6ACA62AF9033B9 -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\NETLOGON.DLL
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004.08.17 15:49:18 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002.12.05 14:00:00 | 000,005,509 | ---- | M] () MD5=74AA54F9485E175FBA64E0A5F63198CF -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\SCECLI.DLL
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2004.08.17 15:49:28 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2004.08.17 15:49:28 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2006.04.20 13:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
[2008.06.20 12:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2004.08.03 23:14:42 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2006.04.20 14:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2004.08.17 15:49:28 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2002.12.05 14:00:00 | 000,001,341 | ---- | M] () MD5=9557C23914D740F310C383058B3A87B7 -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\USERINIT.EXE

< MD5 for: WINLOGON.EXE >
[2004.08.17 15:49:28 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe
[2002.12.05 14:00:00 | 000,006,919 | ---- | M] () MD5=EFE91097D088F32B91836515A15305F3 -- C:\PROGRAMY\sw\UTILITIES\MUICZ\CS.MUI\I386\WINLOGON.EXE

< MD5 for: WS2_32.DLL >
[2004.08.17 15:49:22 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009.08.14 04:28:26 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2009.12.17 19:08:22 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2002.01.06 00:05:37 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2002.01.06 00:05:37 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2002.01.06 00:05:37 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2009.08.14 04:28:26 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 229 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:8FF81EB0
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:4BF2F6B5
< End of report >

Lord_Viktor · #9 Příspěvek od **Lord_Viktor** » 30 dub 2010 13:28

OTL Extras logfile created on: 30.4.2010 14:09:42 - Run 1
OTL by OldTimer - Version 3.2.3.1 Folder = H:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

767,00 Mb Total Physical Memory | 132,00 Mb Available Physical Memory | 17,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 61,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 342,44 Gb Total Space | 78,43 Gb Free Space | 22,90% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 931,51 Gb Total Space | 636,47 Gb Free Space | 68,33% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 489,01 Mb Total Space | 458,02 Mb Free Space | 93,66% Space Free | Partition Type: FAT32
I: Drive not present or media not loaded

Computer Name: LV-PC
Current User Name: LV
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-484763869-838170752-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found
"C:\oldgames\Dune 2000\DUNE2000.DAT" = C:\oldgames\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000 -- File not found
"C:\oldgames\Return to Castle Wolfenstein\WolfMP.exe" = C:\oldgames\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP -- File not found
"C:\Games\Dune 2000\DUNE2000.DAT" = C:\Games\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000 -- File not found
"C:\HRY\Games\Dune 2000\DUNE2000.DAT" = C:\HRY\Games\Dune 2000\DUNE2000.DAT:*:Enabled:Dune2000 -- (Intelligent Games)
"C:\HRY\Games\CS\Valve\hl.exe" = C:\HRY\Games\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\HRY\Roztridit\Dawn of War\W40k.exe" = C:\HRY\Roztridit\Dawn of War\W40k.exe:*:Enabled:W40K -- File not found
"C:\HRY\Games\Return to Castle Wolfenstein\WolfMP.exe" = C:\HRY\Games\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP -- ()
"C:\HRY\Roztridit\HL2\hl2.exe" = C:\HRY\Roztridit\HL2\hl2.exe:*:Enabled:hl2 -- File not found
"C:\HRY\Games\HL2\hl2.exe" = C:\HRY\Games\HL2\hl2.exe:*:Enabled:hl2 -- ()
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe" = C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service -- ()
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)
"C:\Program Files\Warcraft III\Warcraft III.exe" = C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- File not found
"D:\Warcraft III\Warcraft III\Warcraft III.exe" = D:\Warcraft III\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- File not found
"C:\HRY\GamesHelp\Warcraft III\Warcraft III.exe" = C:\HRY\GamesHelp\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- File not found
"C:\Program Files\Quake III Arena\quake3.exe" = C:\Program Files\Quake III Arena\quake3.exe:*:Enabled:quake3 -- ()
"C:\Program Files\TrackMania Sunrise\TmSunrise.exe" = C:\Program Files\TrackMania Sunrise\TmSunrise.exe:*:Enabled:TmSunrise -- ()
"C:\HRY\GamesHelp\Worms2\frontend.exe" = C:\HRY\GamesHelp\Worms2\frontend.exe:*:Enabled:Worms 2 Frontend -- File not found
"C:\HRY\GamesHelp\The Battle for Midlle-earth II\game.dat" = C:\HRY\GamesHelp\The Battle for Midlle-earth II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II -- File not found
"C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe" = C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe:*:Enabled:lh -- (LionHead Studios Ltd.)
"C:\Program Files\Electronic Arts\Need For Speed III\nfs3.exe" = C:\Program Files\Electronic Arts\Need For Speed III\nfs3.exe:*:Enabled:Need For Speed III for Win32 -- (Electronic Arts, Inc.)
"C:\HRY\Worms2\frontend.exe" = C:\HRY\Worms2\frontend.exe:*:Enabled:Worms 2 Frontend -- File not found
"C:\Program Files\Xplosiv\SOF PLATINUM\SoF.exe" = C:\Program Files\Xplosiv\SOF PLATINUM\SoF.exe:*:Enabled:SoF -- File not found
"C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat" = C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II -- (Electronic Arts Inc.)
"C:\Program Files\KVIrc\kvirc.exe" = C:\Program Files\KVIrc\kvirc.exe:*:Enabled:K Visual IRC Client Executable -- (KVIrc Development Team)
"C:\Program Files\QIP\qip.exe" = C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\HRY\Games\hlp\CS\Valve\hl.exe" = C:\HRY\Games\hlp\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"C:\HRY\Games\hlp\HL2\hl2.exe" = C:\HRY\Games\hlp\HL2\hl2.exe:*:Enabled:hl2 -- File not found
"C:\HRY\Games\Install\Warcraft III\Warcraft III.exe" = C:\HRY\Games\Install\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- File not found
"C:\HRY\GAMES\Sid Meier's Civilization 4\Civilization4.exe" = C:\HRY\GAMES\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 -- (Firaxis Games)
"C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe" = C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords -- (Firaxis Games)
"C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe" = C:\HRY\GAMES\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss -- (Firaxis Games)
"C:\HRY\Gamesfault\SIERRA\Half-Life\hl.exe" = C:\HRY\Gamesfault\SIERRA\Half-Life\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"C:\HRY\GAMES\SOF PLATINUM\SoF.exe" = C:\HRY\GAMES\SOF PLATINUM\SoF.exe:*:Enabled:SoF -- (Raven Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02FB40EA-C8AC-36F7-A546-B083E00AF3AA}" = Catalyst Control Center Core Implementation
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{11F5D779-7BD9-465A-BBC4-10701386BCB9}" = FW LiveUpdate
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{25BEC3AB-5CD4-481D-9143-215C1BBB189E}" = Sony Ericsson PC Suite
"{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = The Battle for Middle-earth (tm) II
"{2BAE6A53-E241-11D5-873A-0050DABC2539}" = Tropico: Paradise Island
"{2C3738C9-56FA-410A-BCB5-79C5DFD238F0}" = TuneUp Utilities 2004
"{2C564A58-BD28-4926-95E1-EC7812FCA44F}" = Gigabyte Wireless LAN Card
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E4B349F-10B5-4586-9D99-489A90A8B228}" = Sid Meier's Civilization 4 - Warlords
"{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4
"{4445BFF0-008A-8F5C-9D68-B0164F7E26FF}" = ccc-core-static
"{4D89AFAD-669B-514A-E150-7DA3208477DC}" = ccc-utility
"{4E47B686-8DFF-1AAD-3264-A537E2FC3833}" = Catalyst Control Center Graphics Previews Common
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7764393A-A48B-6BB2-28BC-A6B4EF3A95BC}" = Catalyst Control Center Graphics Full Existing
"{7B31DF8A-8B77-497F-8180-E710A01635F1}" = Warlords IV
"{818FB39B-1A57-4F1B-A54D-391C33D6C586}" = Tropico
"{824BADF8-9A1B-4D07-8817-8DDDC8543F23}" = OpenOffice.org 3.1
"{825DFF04-8FB0-3430-CB22-8725719B1A01}" = Catalyst Control Center Graphics Light
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84430565-C205-B818-7D13-052F88707F70}" = CCC Help English
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6F1BDF7-53A7-4AF6-84B9-0C51C722BC91}" = Europa Universalis
"{A979B2D8-E3EE-4523-A26C-4AF0A6809280}" = Sniper Elite
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C60BA916-9E44-4DA4-B11A-9E27B7624EF5}" = Sony Ericsson Drivers
"{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}" = Sony Ericsson Device Data
"{CA67FB1D-A367-4883-9004-435BAB1ECAAB}" = Disciples 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}" = Catalyst Control Center - Branding
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D6BF6477-8369-489F-8DE6-3731F4B88560}" = Sony Ericsson PC Suite
"{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"{D99667FF-4A9B-B278-9014-BEA2896F413F}" = ccc-core-preinstall
"{DBD86EB8-8536-DB02-EC42-31ED143497A8}" = Catalyst Control Center HydraVision Full
"{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}" = Black and White
"{E9F882ED-C2B8-2716-0330-7FBA5C9C455B}" = Catalyst Control Center Graphics Full New
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2B5A2A7-2DF9-4361-8BD5-362714528B51}" = NHL® 09
"{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}" = Dual-Core Optimizer
"A106663FD3361BDFACB045D83EBA03858EB1E411" = Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Wonders II" = Age of Wonders II
"All ATI Software" = ATI - Software Uninstall Utility
"Any Video Converter_is1" = Any Video Converter 3.0.1
"Ashampoo WinOptimizer 5_is1" = Ashampoo WinOptimizer 5.10
"ATI Display Driver" = ATI Display Driver
"AVG9Uninstall" = AVG Free 9.0
"Battle for Wesnoth 1.6.5" = Battle for Wesnoth 1.6.5
"BootSkin" = BootSkin
"Bridge Commander" = Star Trek Bridge Commander
"Descent3" = Descent 3
"DSMT6" = MathType 6
"DualCoreCenter_is1" = DualCoreCenter
"EF Duplicate MP3 Finder" = EF Duplicate MP3 Finder
"EMDB_is1" = EMDB 0.80
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"F2F24872454C7CAEAABD8BB063F70FBEFF01989D" = Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06)
"FITkit" = QDevKit
"Foxit Reader" = Foxit Reader
"Free FLV Converter_is1" = Free FLV Converter V 6.7.4
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{CA67FB1D-A367-4883-9004-435BAB1ECAAB}" = Disciples 2
"InstallShield_{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"IrfanView" = IrfanView (remove only)
"KVIrc" = KVIrc
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MPE" = MyPhoneExplorer
"mspgcc" = mspgcc - The GNU tools for the MSP430
"Need For Speed II" = Need For Speed II
"Need For Speed III" = Need For Speed III
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Quake III Arena" = Quake III Arena
"Rise And Fall" = Rise And Fall (remove only)
"SpeedFan" = SpeedFan (remove only)
"The KMPlayer" = The KMPlayer (remove only)
"TmSunrise_is1" = TrackMania Sunrise Extreme 1.5.1
"Update Service" = Update Service
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-484763869-838170752-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Desktop Security 2010" = Desktop Security 2010
"QIP 2005" = QIP 2005 8095
"Warcraft III" = Warcraft III

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 15.4.2010 8:33:27 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 15.4.2010 11:06:43 | Computer Name = LV-PC | Source = MRxSmb | ID = 8003
Description = Hlavní prohledávač přijal oznámení serveru od počítače ERIK-NTB, který
se považuje za hlavní prohledávač domény pro přenos NetBT_Tcpip_{7FA978C0-B3D0-4D65-.
Hlavní
prohledávač bude ukončen nebo bude vyvolána volba.

Error - 15.4.2010 16:01:09 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 16.4.2010 5:15:19 | Computer Name = LV-PC | Source = MRxSmb | ID = 8003
Description = Hlavní prohledávač přijal oznámení serveru od počítače ERIK-NTB, který
se považuje za hlavní prohledávač domény pro přenos NetBT_Tcpip_{7FA978C0-B3D0-4D65-.
Hlavní
prohledávač bude ukončen nebo bude vyvolána volba.

Error - 17.4.2010 15:49:18 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 21.4.2010 8:35:44 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 22.4.2010 4:12:25 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 23.4.2010 8:04:22 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 24.4.2010 11:44:38 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

Error - 25.4.2010 14:30:39 | Computer Name = LV-PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: PCIIde

< End of report >

#10 Příspěvek od **Caroprd111** » 30 dub 2010 13:42

http://www.viry.cz/forum/viewtopic.php?f=12&t=80963 Žádné placené softwarové vybavení není třeba. Potřebujete pouze internetový prohlížeč. Pokud chcete testovat havěť, tak budete potřebovat nějaký emulátor operačních systémů.

Obrázek

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
PRC - [2010.04.30 12:27:44 | 002,949,632 | ---- | M] () -- C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe
PRC - [2010.04.29 10:38:53 | 001,415,168 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe
PRC - [2010.04.29 10:38:09 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe
O4 - HKLM..\Run: [settings] C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe ()
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [Desktop Security 2010] C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe ()
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [o4otvguvwwo0] C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe ()
O4 - HKU\S-1-5-21-484763869-838170752-725345543-1003..\Run: [SecurityCenter] C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe ()
O4 - HKLM..\RunServices: [settings] C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe ()
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
[2010.04.30 12:27:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010
[2010.04.30 12:26:20 | 000,137,779 | ---- | M] () -- C:\Documents and Settings\LV\Plocha\settings.zip
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
@Alternate Data Stream - 229 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:8FF81EB0
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:4BF2F6B5

:Commands
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[CREATERESTOREPOINT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

Obrázek

Tohle otestujte na http://www.virustotal.com/cs/
C:\Program Files\FITkit\bin\qdevkit.exe

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

Lord_Viktor · #11 Příspěvek od **Lord_Viktor** » 30 dub 2010 13:52

qdevkit by mel byt ok, pokud ho ta havet nezmenila, je to soft, ktery jsem instaloval umyslne a potrebuju ho, urcite neosahoval puvodne nic skodliveho

#12 Příspěvek od **Caroprd111** » 30 dub 2010 13:53

Ok, v tom případě ho nemusíte testovat. Počkám na log z OTL.

Lord_Viktor · #13 Příspěvek od **Lord_Viktor** » 30 dub 2010 14:07

All processes killed
========== OTL ==========
No active process named m.2125.tmp.exe was found!
No active process named Desktop Security 2010.exe was found!
No active process named securitycenter.exe was found!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\settings deleted successfully.
C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-484763869-838170752-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Desktop Security 2010 deleted successfully.
C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-484763869-838170752-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\o4otvguvwwo0 deleted successfully.
C:\Documents and Settings\LV\Local Settings\Temp\m.2125.tmp.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-484763869-838170752-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\SecurityCenter deleted successfully.
C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010\securitycenter.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\\settings deleted successfully.
File C:\Documents and Settings\LV\Local Settings\Temp\Rar$EX03.563\settings.exe not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Folder move failed. C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010 scheduled to be moved on reboot.
C:\Documents and Settings\LV\Plocha\settings.zip moved successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:8FF81EB0 deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:4BF2F6B5 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LV
->Temp folder emptied: 3597738 bytes
->Temporary Internet Files folder emptied: 23632543 bytes
->FireFox cache emptied: 100348096 bytes
->Flash cache emptied: 2423 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 68830 bytes
RecycleBin emptied: 3190579994 bytes

Total Files Cleaned = 3 165,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: LV
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.3.1 log created on 04302010_145447

Files\Folders moved on Reboot...
C:\Documents and Settings\LV\Data aplikací\Desktop Security 2010 folder moved successfully.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_9d8.dat not found!

Registry entries deleted on Reboot...

#14 Příspěvek od **Caroprd111** » 30 dub 2010 14:13

Jak to vypadá s PC

Lord_Viktor · #15 Příspěvek od **Lord_Viktor** » 30 dub 2010 14:37

pocitac nevykazuje zadne znamky viru, takze dekuji za pomoc a jakmile nasbiram patricny pocet prispevku, zacnu se zajimat dal

VIRY.CZ

Desktop Secure 2010

Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010

Re: Desktop Secure 2010