Fest pomaly pocitac

Zpráva

majlosh · #1 Příspěvek od **majlosh** » 29 čer 2010 20:41

Zdravim..pozrie sa mi prosim vas niekto na log? Pocitac je strasne pomaly a disk sem-tam maka aj ked od neho nic nechcem

Vdaka

Logfile of random's system information tool 1.07 (written by random/random)
Run by Sona at 2010-06-29 21:37:47
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (35%) free of 20 GB
Total RAM: 446 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:38:13, on 29. 6. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Sona\Desktop\RSIT.exe
C:\Program Files\trend micro\Sona.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 4393 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]
"MSSE"=C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-06-01 1093208]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2010-04-22 319280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-06-03 139264]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\IncrediMail\Bin\IncMail.exe"="C:\Program Files\IncrediMail\Bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\Bin\ImApp.exe"="C:\Program Files\IncrediMail\Bin\ImApp.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\Bin\ImpCnt.exe"="C:\Program Files\IncrediMail\Bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-06-29 21:37:47 ----D---- C:\rsit
2010-06-29 21:37:47 ----D---- C:\Program Files\trend micro
2010-06-29 21:10:20 ----D---- C:\WINDOWS\pss
2010-06-12 22:27:28 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-12 22:25:01 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-12 22:23:26 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-12 22:21:18 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-12 22:21:12 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-12 22:21:03 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$

======List of files/folders modified in the last 1 months======

2010-06-29 21:37:53 ----D---- C:\WINDOWS\Temp
2010-06-29 21:37:47 ----RD---- C:\Program Files
2010-06-29 21:32:13 ----SD---- C:\WINDOWS\Tasks
2010-06-29 21:28:15 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-29 21:25:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-29 21:24:39 ----SH---- C:\boot.ini
2010-06-29 21:24:39 ----A---- C:\WINDOWS\win.ini
2010-06-29 21:24:39 ----A---- C:\WINDOWS\system.ini
2010-06-29 21:16:07 ----D---- C:\WINDOWS
2010-06-29 21:13:35 ----D---- C:\Program Files\Microsoft Security Essentials
2010-06-29 21:13:34 ----SHD---- C:\WINDOWS\Installer
2010-06-29 21:13:34 ----HD---- C:\Config.Msi
2010-06-29 21:13:06 ----HD---- C:\WINDOWS\inf
2010-06-29 21:13:06 ----D---- C:\WINDOWS\system32\drivers
2010-06-29 21:05:53 ----D---- C:\Documents and Settings\Sona\Application Data\uTorrent
2010-06-29 21:05:12 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-29 21:05:08 ----RSD---- C:\WINDOWS\assembly
2010-06-29 20:58:42 ----D---- C:\WINDOWS\Prefetch
2010-06-26 20:41:24 ----AD---- C:\WINDOWS\system32
2010-06-26 20:40:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-26 20:40:10 ----D---- C:\WINDOWS\WinSxS
2010-06-26 19:23:32 ----D---- C:\Program Files\Mozilla Firefox
2010-06-22 17:43:38 ----D---- C:\WINDOWS\Minidump
2010-06-12 22:27:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-12 22:25:07 ----A---- C:\WINDOWS\imsins.BAK
2010-06-12 22:24:58 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-12 22:12:40 ----D---- C:\WINDOWS\system32\en-US
2010-06-12 22:12:39 ----D---- C:\Program Files\Internet Explorer
2010-06-01 19:37:48 ----N---- C:\WINDOWS\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-08-29 3644928]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-06-03 3100160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2010-03-14 10368]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 ALSysIO;ALSysIO; \??\C:\DOCUME~1\Sona\LOCALS~1\Temp\ALSysIO.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-06-03 552960]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2009-11-12 71096]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-06-02 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 29 čer 2010 20:47

Zdravim a pekny vecer preji

Tohle znate a pouzivate a je to nutne tam mit C:\Program Files\Yahoo!\SoftwareUpdate\. Dle meho zcela zbytecnost. Pokud neznate, nepouzivate odinstalujte pres Přidat nebo odebrat programy

V logu nic nevidet

ale kouknem na to dukladneji

Stahnete OTL (viz muj podpis) a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Zaskrtnete okenko Pro vsechny uzivatele
Zaskrtnete okenko Kontrola na havet "LOP"
Zaskrtnete okenko Kontrola na havet "Purity"
Stari souboru zmente z 30 dnu na 7 dnu
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
autochk.exe
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

Kliknete na tlacitko Prohledat
Po dokonceni skenu (cca 5min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

majlosh · #3 Příspěvek od **majlosh** » 29 čer 2010 21:19

juuu ina rychlost

diik.. tak yahoo updater letel z compu jak meciar z parlamentu a tu pridavam tie pozadovane logy:

OTL logfile created on: 29. 6. 2010 22:09:33 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Sona\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000041B | Country: Slovakia | Language: SKY | Date Format: d. M. yyyy

446,00 Mb Total Physical Memory | 108,00 Mb Available Physical Memory | 24,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 6,86 Gb Free Space | 35,11% Space Free | Partition Type: NTFS
Drive D: | 54,99 Gb Total Space | 30,56 Gb Free Space | 55,59% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SONA-86B6802986
Current User Name: Sona
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.06.29 22:04:49 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sona\Desktop\OTL.exe
PRC - [2010.06.26 19:23:23 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010.06.26 19:23:17 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010.06.01 14:53:46 | 001,093,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2010.03.25 21:40:42 | 000,203,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MpCmdRun.exe
PRC - [2009.11.12 14:48:58 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010.06.29 22:04:49 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sona\Desktop\OTL.exe
MOD - [2008.04.14 02:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2009.11.12 14:48:58 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2008.07.29 20:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)

========== Driver Services (SafeList) ==========

DRV - [2010.03.25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter)
DRV - [2010.03.14 20:49:12 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2009.11.12 14:48:58 | 000,005,504 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\StarOpen.sys -- (StarOpen)
DRV - [2008.06.03 08:20:54 | 003,100,160 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.08.29 16:11:00 | 003,644,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004.08.04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
IE - HKU\S-1-5-21-1844237615-1500820517-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: radiobar@toolbar:1.0.0
FF - prefs.js..keyword.URL: "http://mystart.incredimail.com/?loc=ff_ ... v2&search="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.06.26 19:23:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.06.26 19:23:23 | 000,000,000 | ---D | M]

[2010.03.12 16:56:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Mozilla\Extensions
[2010.06.29 21:33:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Mozilla\Firefox\Profiles\k3mcoljm.default\extensions
[2010.03.15 15:53:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Sona\Application Data\Mozilla\Firefox\Profiles\k3mcoljm.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.20 22:15:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Mozilla\Firefox\Profiles\k3mcoljm.default\extensions\radiobar@toolbar
[2010.04.01 09:26:15 | 000,002,149 | ---- | M] () -- C:\Documents and Settings\Sona\Application Data\Mozilla\Firefox\Profiles\k3mcoljm.default\searchplugins\MyStart Search.xml
[2010.03.12 19:42:27 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.146.132.59 195.146.128.60
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Sona\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sona\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.12 16:24:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010.03.12 16:23:34 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: VIDC.ACDV - C:\WINDOWS\System32\ACDV.dll (ACD Systems)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 7 Days ==========

[2010.06.29 22:06:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sona\Recent
[2010.06.29 22:04:16 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sona\Desktop\OTL.exe
[2010.06.29 21:37:47 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.06.29 21:37:47 | 000,000,000 | ---D | C] -- C:\rsit
[2010.06.29 21:10:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010.06.23 17:45:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sona\Local Settings\Application Data\PCHealth
[2010.06.23 17:45:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2010.06.29 22:04:49 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sona\Desktop\OTL.exe
[2010.06.29 21:36:48 | 000,824,681 | ---- | M] () -- C:\Documents and Settings\Sona\Desktop\RSIT.exe
[2010.06.29 21:32:13 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010.06.29 21:25:55 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.06.29 21:25:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.06.29 21:25:03 | 003,932,160 | -H-- | M] () -- C:\Documents and Settings\Sona\NTUSER.DAT
[2010.06.29 21:25:03 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Sona\ntuser.ini
[2010.06.29 21:24:39 | 000,000,573 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.06.29 21:24:39 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.06.29 21:24:39 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010.06.29 21:12:39 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
[2010.06.29 21:09:32 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Sona\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.29 21:09:24 | 000,088,865 | ---- | M] () -- C:\Documents and Settings\Sona\Desktop\Bild0077.jpg
[2010.06.29 21:09:16 | 000,081,742 | ---- | M] () -- C:\Documents and Settings\Sona\Desktop\Bild0078.jpg
[2010.06.29 20:45:42 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.06.26 20:40:32 | 000,488,532 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.06.26 20:40:32 | 000,432,492 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.06.26 20:40:32 | 000,067,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.06.26 19:05:28 | 734,565,418 | ---- | M] () -- C:\Documents and Settings\Sona\Desktop\ALVIN A CHIPMUNKOVE 2-rodinna komedie-DVDRip-CZdabing-super kvalita.avi
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.06.29 21:36:32 | 000,824,681 | ---- | C] () -- C:\Documents and Settings\Sona\Desktop\RSIT.exe
[2010.06.29 21:22:02 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010.06.29 21:12:39 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
[2010.06.29 21:08:45 | 000,088,865 | ---- | C] () -- C:\Documents and Settings\Sona\Desktop\Bild0077.jpg
[2010.06.29 21:07:18 | 000,081,742 | ---- | C] () -- C:\Documents and Settings\Sona\Desktop\Bild0078.jpg
[2010.06.26 17:58:00 | 734,565,418 | ---- | C] () -- C:\Documents and Settings\Sona\Desktop\ALVIN A CHIPMUNKOVE 2-rodinna komedie-DVDRip-CZdabing-super kvalita.avi
[2010.03.16 14:21:12 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2010.03.13 20:54:44 | 000,002,675 | ---- | C] () -- C:\WINDOWS\Slovnik 2005.INI
[2010.03.12 17:12:03 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.03.12 17:01:15 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.03.12 17:01:15 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.03.12 17:01:14 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.03.12 17:01:14 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.03.12 17:01:12 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.03.12 17:01:12 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2010.03.12 16:51:26 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2009.11.12 14:48:58 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\StarOpen.sys
[2003.04.07 12:38:32 | 000,005,746 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.07.07 04:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

========== LOP Check ==========

[2010.03.14 20:49:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2010.03.12 17:36:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010.04.01 09:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM
[2010.04.01 09:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail
[2010.03.14 20:53:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\ACD Systems
[2010.05.26 15:00:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\AIMP
[2010.03.13 20:53:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Canneverbe Limited
[2010.06.29 21:05:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\uTorrent
[2010.06.29 21:32:13 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 02:12:16 | 000,015,360 | ---- | M] (Microsoft Corporation)

< c:\windows\*.* /U >
[5 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >
[2010.03.14 20:49:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2010.03.17 16:47:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2010.03.12 16:40:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI
[2010.03.12 17:36:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010.04.01 09:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM
[2010.04.01 09:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail
[2010.03.12 17:17:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010.04.04 12:35:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010.03.12 17:55:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010.03.12 17:50:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010.06.29 22:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo!

< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2009.12.14 17:52:46 | 000,607,472 | ---- | M] (Yahoo! Inc.) -- C:\Documents and Settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

< %APPDATA%\*. >
[2010.03.14 20:53:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\ACD Systems
[2010.03.17 16:46:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Adobe
[2010.05.26 15:00:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\AIMP
[2010.03.12 16:40:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\ATI
[2010.03.13 20:53:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Canneverbe Limited
[2010.03.12 16:29:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Identities
[2010.03.12 17:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Macromedia
[2010.03.12 17:02:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Media Player Classic
[2010.06.29 21:43:10 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Sona\Application Data\Microsoft
[2010.03.12 16:56:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Mozilla
[2010.05.20 07:39:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Skype
[2010.05.20 07:39:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\skypePM
[2010.04.07 18:36:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Sun
[2010.06.29 21:05:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\uTorrent
[2010.03.17 16:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\WinRAR
[2010.03.12 17:44:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Yahoo!

< %APPDATA%\*.exe /s >

< MD5 for: AGP440.SYS >
[2006.02.28 14:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: AHCIX86.SYS >
[2008.03.08 03:24:52 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\ATI\SUPPORT\8-6_xp32_dd_ccc_wdm_enu_64783\SBDrv\RAID7xx\x86\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2006.02.28 14:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2006.02.28 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008.04.14 02:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
[2008.04.14 02:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\system32\autochk.exe
[2006.02.28 14:00:00 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe

< MD5 for: CDROM.SYS >
[2006.02.28 14:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006.02.28 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2006.02.28 14:00:00 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=10654F9DDCEA9C46CFB77554231BE73B -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 02:11:51 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=3D4E199942E29207970E04315D02AD3B -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 02:11:51 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=3D4E199942E29207970E04315D02AD3B -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 02:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 02:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2006.02.28 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006.02.28 14:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2006.02.28 14:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:28 | 000,131,840 | ---- | M] (Microsoft Corporation) MD5=6F61D3287A6A15A08A9433222C09D17F -- C:\WINDOWS\system32\HAL.DLL
[2006.02.28 14:00:00 | 000,131,968 | ---- | M] (Microsoft Corporation) MD5=F9A0F579FC18036FFDD9E26E0D268CCD -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll

< MD5 for: CHANGER.SYS >
[2006.02.28 14:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: ISAPNP.SYS >
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2010.03.17 16:04:21 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2008.04.13 20:36:41 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=05A299EC56E52649B1CF2FC52D20F2D7 -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.13 20:36:41 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=05A299EC56E52649B1CF2FC52D20F2D7 -- C:\WINDOWS\system32\drivers\isapnp.sys
[2006.02.28 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=E504F706CCB699C2596E9A3DA1596E87 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys

< MD5 for: LSASS.EXE >
[2006.02.28 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=84885F9B82F4D55C6146EBF6065D75D2 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 02:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 02:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006.02.28 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008.04.14 02:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 02:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009.02.06 20:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2006.02.28 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2006.02.28 14:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 02:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 02:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2008.04.14 02:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 02:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\system32\smss.exe
[2006.02.28 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=BD7FB0957C716F1A60333AEE04DE2178 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 02:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 02:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2006.02.28 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.06.20 12:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2006.02.28 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2006.02.28 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008.04.14 02:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 02:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006.02.28 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 02:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 02:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 02:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 02:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[2006.02.28 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008.06.03 05:22:24 | 000,413,696 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010.03.12 17:09:07 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010.03.12 17:09:07 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010.03.12 17:09:07 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2008.06.03 05:22:24 | 000,413,696 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.06.29 20:45:42 | 000,013,646 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >

OTL Extras logfile created on: 29. 6. 2010 22:09:33 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Sona\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000041B | Country: Slovakia | Language: SKY | Date Format: d. M. yyyy

446,00 Mb Total Physical Memory | 108,00 Mb Available Physical Memory | 24,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 6,86 Gb Free Space | 35,11% Space Free | Partition Type: NTFS
Drive D: | 54,99 Gb Total Space | 30,56 Gb Free Space | 55,59% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SONA-86B6802986
Current User Name: Sona
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\Program Files\ACD Systems\ACDSee\8.0.Pro\ACDSee8Pro.exe" "%1" (ACD Systems Ltd.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Program Files\IncrediMail\Bin\IncMail.exe" = C:\Program Files\IncrediMail\Bin\IncMail.exe:*:Enabled:IncrediMail -- File not found
"C:\Program Files\IncrediMail\Bin\ImApp.exe" = C:\Program Files\IncrediMail\Bin\ImApp.exe:*:Enabled:IncrediMail -- File not found
"C:\Program Files\IncrediMail\Bin\ImpCnt.exe" = C:\Program Files\IncrediMail\Bin\ImpCnt.exe:*:Enabled:IncrediMail -- File not found
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{1116FD69-3C49-BE9A-C206-E8BA26CCA10F}" = CCC Help English
"{16FE2579-06B2-3E32-58F2-4B70B69A3070}" = ccc-core-preinstall
"{1EB21F28-E3AF-A317-4658-6C0C455C2F61}" = Catalyst Control Center Core Implementation
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{46D9C523-FABB-FFF1-321D-F493A68E2C3E}" = Catalyst Control Center Graphics Previews Common
"{57D32909-FCA8-A78B-2AD2-2A50F5E11858}" = ccc-core-static
"{57EA735B-4F1D-9FC5-6A36-B0C0F1D704FE}" = Catalyst Control Center Graphics Light
"{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}" = CDBurnerXP
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{9012041B-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DE31F8AA-B12D-3A38-E561-C657EED45465}" = Catalyst Control Center Graphics Full Existing
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E6EB53D4-5AD0-07F0-2DAC-0A2D624DF39D}" = ccc-utility
"{E74CC47C-28D3-25E1-14D2-68EBC87C31BA}" = Skins
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F251B61F-9D18-13C4-02EE-71A36343D442}" = Catalyst Control Center Graphics Full New
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F99F74B4-972B-4B06-B893-6B3B0DB0128B}" = ACDSee Pro
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIMP2" = AIMP2
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.8.0 (Full)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Mozilla Firefox (3.6.4)" = Mozilla Firefox (3.6.4)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"uTorrent" = µTorrent
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Puzzle Pirates" = Puzzle Pirates
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.7.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15. 4. 2010 0:25:39 | Computer Name = SONA-86B6802986 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 23. 4. 2010 3:14:31 | Computer Name = SONA-86B6802986 | Source = Windows Live Messenger | ID = 1000
Description =

Error - 26. 5. 2010 8:14:32 | Computer Name = SONA-86B6802986 | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3743, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4. 6. 2010 15:09:52 | Computer Name = SONA-86B6802986 | Source = Application Error | ID = 1000
Description = Faulting application wuauclt.exe, version 7.4.7600.226, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x00010a19.

Error - 19. 6. 2010 2:05:25 | Computer Name = SONA-86B6802986 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0xffffffff, P2 patchapplication, P3 am bde,
P4 2.1.1112.0, P5 mpsigstub.exe, P6 2.1.6519.0, P7 microsoft security essentials,
P8 NIL, P9 NIL, P10 NIL.

Error - 19. 6. 2010 2:06:02 | Computer Name = SONA-86B6802986 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 23. 6. 2010 11:45:48 | Computer Name = SONA-86B6802986 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3
download, P4 2.1.6519.0, P5 mpsigdwn.dll, P6 2.1.6519.0, P7 microsoft antimalware
(bcf43643-a118-4432-aede-d861fcbcfcde), P8 NIL, P9 NIL, P10 NIL.

Error - 23. 6. 2010 11:45:52 | Computer Name = SONA-86B6802986 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 29. 6. 2010 15:12:17 | Computer Name = SONA-86B6802986 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 29. 6. 2010 15:12:56 | Computer Name = SONA-86B6802986 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2147550906, P2 unspecified, P3 scanfile,
P4 2.1.6519.0, P5 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 7. 5. 2010 7:24:36 | Computer Name = SONA-86B6802986 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 00173135785A has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 27. 5. 2010 8:12:20 | Computer Name = SONA-86B6802986 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.102 for the Network Card with network
address 00173135785A has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 27. 5. 2010 8:44:44 | Computer Name = SONA-86B6802986 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 00173135785A has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 27. 5. 2010 8:46:32 | Computer Name = SONA-86B6802986 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 00173135785A has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 29. 5. 2010 5:27:15 | Computer Name = SONA-86B6802986 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.102 for the Network Card with network
address 00173135785A has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 19. 6. 2010 2:05:38 | Computer Name = SONA-86B6802986 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.83.1887.0 Update Source: %%859 Update Stage:
%%854 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.5802.0 Error
code: 0x80070643 Error description: Fatal error during installation.

Error - 19. 6. 2010 2:08:21 | Computer Name = SONA-86B6802986 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Definition Update for Microsoft Security Essentials - KB972696
(Definition 1.85.362.0).

Error - 23. 6. 2010 11:45:47 | Computer Name = SONA-86B6802986 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.85.532.0 Update Source: %%859 Update Stage:
%%853 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.5902.0 Error
code: 0x80240022 Error description: The program can't check for definition updates.

Error - 23. 6. 2010 11:45:47 | Computer Name = SONA-86B6802986 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.85.532.0 Update Source: %%859 Update Stage:
%%853 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.5902.0 Error
code: 0x80240022 Error description: The program can't check for definition updates.

Error - 29. 6. 2010 15:26:37 | Computer Name = SONA-86B6802986 | Source = Microsoft Antimalware | ID = 2004
Description = %%861 has encountered an error trying to load signatures and will
attempt reverting back to a known-good set of signatures. Signatures Attempted: %%824

Error
Code: 0x8050800c Error description: An unexpected problem occurred. Install any
available updates, and then try to start the program again. For information on installing
updates, see Help and Support. Signature version: 1.85.1029.0;1.85.1029.0 Engine
version: 1.1.5902.0

< End of report >

#4 Příspěvek od **vyosek** » 29 čer 2010 21:26

Jeste jsme ani nezacali cistit skriptem a vy uz se radujete - ja rikal ze yahoo je pekne zpomalovadlo a zbytecnost

Kdyby ten parlament sel vycistit tak jednoduse

Spustte znovu OTL

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

:otl
IE - HKU\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..keyword.URL: "http://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search="
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2009.12.14 17:52:46 | 000,607,472 | ---- | M] (Yahoo! Inc.) -- C:\Documents and Settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
[2010.03.12 17:44:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sona\Application Data\Yahoo!

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\Program Files\Yahoo!

:services
YahooAUService
Yahoo! Updater

:reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"=-

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]

Nasledne kliknete na Opravit
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

majlosh · #5 Příspěvek od **majlosh** » 29 čer 2010 21:34

chapem chapem..on to nie je moj comp..v mojom yahoo veci som nikdy nemal

jooo a tu je toto dalsie po restarte:

All processes killed
========== OTL ==========
HKU\S-1-5-21-1844237615-1500820517-725345543-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "MyStart Search" removed from browser.search.defaultenginename
Prefs.js: "chrf-ytbm" removed from browser.search.param.yahoo-fr
Prefs.js: "chrf-ytbm" removed from browser.search.param.yahoo-fr-cjkt
Prefs.js: "${8}" removed from browser.search.param.yahoo-type
Prefs.js: "http://mystart.incredimail.com/?loc=ff_ ... v2&search=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
C:\WINDOWS\002788_.tmp deleted successfully.
C:\WINDOWS\SET25.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\Documents and Settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\c0589c59-cb81-4a9d-7d29-fbb9c487e05e.yplugin\MANIFEST folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\c0589c59-cb81-4a9d-7d29-fbb9c487e05e.yplugin folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\vitality\vitality folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\vitality\log folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\vitality\images folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\vitality folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\zh-Hant-TW folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\zh-Hant-HK folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\vi-VN folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\th-TH folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\pt-BR folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\ko-KR folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\it-IT folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\id-ID folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\fr-FR folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\fr-CA folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\es-US folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\es-MX folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\es-ES folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\es-AR folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\en-US folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\en-GB folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language\de-DE folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\language folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\vn folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\ve folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\us folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\uk folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\tw folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\th folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\sg folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\ph folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\pe folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\my folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\mx folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\kr folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\it folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\in folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\id folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\hk folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\hi folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\fr folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\es folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\e1 folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\de folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\co folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\cl folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\cf folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\ca folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\br folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\au folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n\ar folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource\i18n folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\resource folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin\MANIFEST folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin\16762d37-0eb1-40d0-5863-5fa5ade02675.yplugin folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger\Plugin folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Messenger folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Companion\CrashLogs folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Companion\Buttons folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo!\Companion folder moved successfully.
C:\Documents and Settings\Sona\Application Data\Yahoo! folder moved successfully.
========== FILES ==========
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP162.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP194.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1C.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP234.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP25C.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP271.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP273.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP33E.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3A0.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3B.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAA.tmp folder moved successfully.
C:\WINDOWS\SoftwareDistribution\AuthCabs\7971f918-a847-4430-9279-4a52d1efe18d\wlt3A.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\0324c5a28e6362009236ca4e6a4fc546\BIT4.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\287a4eec8738e59214471d76f4561bed\BIT9.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\2dc9fc30bc273b9e96c8bbe5860f5315\BIT7.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\3a2773ed0185d9cc0572da01353f3b98\BIT12.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\467d56591ed085161e5bb3d2f520fada\BITB.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\611d743d4542df94f306941e6533bca2\BIT8.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\666736978c382eaeae461834da3723d5\BIT2.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\788a709ca6976915e46d02310f43b6dc\BIT9.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\7994a8d20bf504ced8e426e137f8305e\BIT7.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\803c1ec8c092d5a48603180d872f3355\BIT6.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\8446f99aab9fdf8015abf144d753426f\BITE.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\86b0a3da81bf3edf55c9e9c6ef2e8b55\BITF.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\8c38d732c1d8905e381f200acddd63a3\BIT6.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\8cb3a5dc2e5ce55afbfdfd38e49058d5\BIT11.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\8d4b7190fed5d78ca3642f80259aa01d\BIT3.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\96b693c692e14647ca6762904feb693b\BITA.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\9ea827e145f1a2be7f2a7f428b84aa41\BIT3.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\a7a44f3060b9de093f833176e196dff7\BIT5.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\cef3a8d8eda5a26f4b054f9be7f25498\BITD.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\cfa47f37230070f7072b02102a875bda\BIT4.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\daa4daae7e044164b6b67fd9bfc0934f\BIT5.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\db250b969298d4b9909ab53611417a5a\BIT10.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\db524307f1cae2f6443879522082afe1\BIT6.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\dd1d31f82e16f1dce87e833fd358b78e\BIT5.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\e4c2007810f05e435207a9313d458bee\BITC.tmp moved successfully.
C:\WINDOWS\SoftwareDistribution\Download\fbd10dcbeeea9977a50637fdf6817519\BIT7.tmp moved successfully.
C:\Program Files\Yahoo!\Shared folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Wood folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Violet flame folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Twinkle pink folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue\Images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Sky blue folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver\Images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Silver folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\sumo folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\IMWindow folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Ruby red folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Purple folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\sumo folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\IMWindow folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Mystic black folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Icy blue folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Green fantasia folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Graffiti folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\VoiceUI folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\theme folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\sumo folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\SlotManager folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\MiscSmallUI folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\LoginWnd folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\IMWindow folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\FriendList folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\ContactCard folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default\AddRequest folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins\Default folder moved successfully.
C:\Program Files\Yahoo!\Messenger\skins folder moved successfully.
C:\Program Files\Yahoo!\Messenger\resources\en-US folder moved successfully.
C:\Program Files\Yahoo!\Messenger\resources folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\My Icons folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive\Messages\ryan12_al10@hotmail.co.uk@@imm folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive\Messages\rajajunior18 folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive\Messages\ermagy folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive\Messages\andzf78 folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive\Messages folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona\Archive folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\tobiasovasona folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles\Archive folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Profiles folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Plugin\Test folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Plugin folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\Voice folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\Smileys folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\RingTones folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\misc folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\Images folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\FriendIcon folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\Etc folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media\Audibles folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Media folder moved successfully.
C:\Program Files\Yahoo!\Messenger\logs folder moved successfully.
C:\Program Files\Yahoo!\Messenger\imvcache\hearts folder moved successfully.
C:\Program Files\Yahoo!\Messenger\imvcache\doodle folder moved successfully.
C:\Program Files\Yahoo!\Messenger\imvcache folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Games\icons folder moved successfully.
C:\Program Files\Yahoo!\Messenger\Games folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\SearchBar folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\IMScanners folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\Icon\temp\activities folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\Icon\temp folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\Icon folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\d5wnIrH68UW1519j9e.FVQ-- folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\branding folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache\Audibles folder moved successfully.
C:\Program Files\Yahoo!\Messenger\cache folder moved successfully.
C:\Program Files\Yahoo!\Messenger folder moved successfully.
C:\Program Files\Yahoo!\Common folder moved successfully.
C:\Program Files\Yahoo! folder moved successfully.
========== SERVICES/DRIVERS ==========
Error: No service named YahooAUService was found to stop!
Service\Driver key YahooAUService not found.
Error: No service named Yahoo! Updater was found to stop!
Service\Driver key Yahoo! Updater not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33368 bytes

User: NetworkService
->Temp folder emptied: 499638 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Sona
->Temp folder emptied: 7144537 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->FireFox cache emptied: 38656876 bytes
->Flash cache emptied: 1563 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1174458 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 64629958 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 107,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Sona
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.7.0 log created on 06292010_222933

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#6 Příspěvek od **vyosek** » 29 čer 2010 21:37

Tak skript vykonany, cely yahoo i s messengerem zpomalovadlem je pryc...

Jak se chova PC

majlosh · #7 Příspěvek od **majlosh** » 29 čer 2010 21:43

nooo..stierace stieraju,svetla svietia..ist ide..

podla mojho skromneho nazoru je to lepsie..o dost..

ale yahoo massenger prec nie je..len ten updater asi

#8 Příspěvek od **vyosek** » 29 čer 2010 21:47

Klakson troubi

Messenger se smazl skriptem C:\Program Files\Yahoo!\Messenger folder moved successfully, je nutne jej v PC mit

Muzem jej obnovit ze zalohy

majlosh · #9 Příspěvek od **majlosh** » 29 čer 2010 21:55

nooo nechcem ti do toho kecat,inak sorry,ze ti tykam,ale ked kliknem na ikonu yahoo! messenger tak ten sa veselo spusti..hm? a v tomto compe nie je az tak potrebny..teda pre mna urcite nie

#10 Příspěvek od **vyosek** » 29 čer 2010 22:03

V pohode tykani mi nevadi, spis jen ze slusnosti na foru vykam, ale jak nekdo tyka, rad se prizpusobim.

S tim mesengerem jsi me tedy dostal, je nekde teda asi zasatroceny jeste nekde jinde - ja smazl jen slozku Yahoo co jsem videl v RSITu...Pokud potreba neni tak sup s nim pryc - kazdy nepotrebny program jen PC zpomaluje...A jede uplne normalne jo

Pokud se podivas na log po vykonani opravy tak sam uvidis co se smazlo...

Obnovime tedy ten mesenger co se smazl, nebo ho budes davat pryc uplne

majlosh · #11 Příspěvek od **majlosh** » 29 čer 2010 22:08

no zaujimava situacia..akoze ten messenger kludne aj odinstalujem,aj ked..pri starte sa na pc automaticky nespusta,tak ani neviem ci ho je nutne odinstalovat,ked nebezi,tak asi nespomaluje..ci

#12 Příspěvek od **vyosek** » 29 čer 2010 22:12

kdyz nebezi nezpomaluje, i kdyz jsou i takove veci...napr deamon toolbar - nebezel ale pc bylo zpomalene jak blazen diky nemu...pokud opravdu neni vyuzivan tak pryc s nim...

majlosh · #13 Příspěvek od **majlosh** » 29 čer 2010 22:19

taaak..ccleaner ho nevidi..pridanie a odstranenie programov tiez nie..ikona v ponuke start je stale funkcna..spusti sa a da sa tam prihlasit..co teraz?..inak na tomto pc budem az zajtra,takze dnes uz neodpisem..jo a dik zatial

#14 Příspěvek od **vyosek** » 29 čer 2010 22:23

Zkusit odinstalovat pres Revo Uninstaller http://www.stahuj.centrum.cz/utility_a_ ... installer/

OK, tez pujdu chrnet, zitra uklidime po utilitach a udelame zaverecnou kontrolu...Napis zda se povedlo odinstalovat pres Revo...zatim nemas zac, hlavne ze jsme prisli na pricinu zpomaleni...zitra to bude uz jen pohodicka uklid a kontrola...

VIRY.CZ

Fest pomaly pocitac

Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac

Re: Fest pomaly pocitac