PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Prosím o kontrolu logu - 2 Trojani Hiloti

https://pc-help.cnews.cz/viewtopic.php?f=70&t=51050

Stránka 1 z 2

Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 04 bře 2010 22:56
od martin.efres
Ahoj,

Při dnešní rychlé kontrole mi Malwarebytes' Anti-Malware nalezl 2 Trojany typu Hiloti..infikován má být 1 soubor a 1 registr. Děkuji za kontrolu. Nechápu to..a to jsem měl celou dobu Avast zaplý.

LOG Z HIJACKTHIS :

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 22:49:30, on 4.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\eSupport.com\driveragent_59.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.garena.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 6781085453
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\Common Files\BinarySense\hlAPP.dll" (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 6537 bytes


LOG Z MALWAREBYTES ANTI-MALWARE :

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3792
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4.3.2010 22:48:06
mbam-log-2010-03-04 (22-48-03).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 132945
Uplynulý čas: 6 minute(s), 4 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_CLASSES_ROOT\CLSID\{68d6728a-d715-492a-a57b-8dda01f4921f} (Trojan.Hiloti) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\RLOFRDec.ax (Trojan.Hiloti) -> No action taken.

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 04 bře 2010 23:05
od Damned
Červený soubor zkontroluj na Virustotalu a vlož sem odkaz na výsledek.
Pokud ho nenajdeš, dej si zobrazit skryté a systémové soubory. Pokud ti nabídne, že soubor už kontroloval,
nech ho zkontrolovat znovu, a počkej až se objeví "Dokončeno" a výsledek.Potom sem zkopíruj adresní řádek.

C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\eSupport.com\driveragent_59.exe
C:\WINDOWS\system32\RLOFRDec.ax

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 04 bře 2010 23:13
od martin.efres
http://www.virustotal.com/cs/analisis/c ... 1267740492

https://www.virustotal.com/cs/analisis/ ... 1267740731

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 04 bře 2010 23:32
od Damned
Toto: RLOFRDec.ax by měla být součást nějakých kodeků, tady to hodnotí jako Trojana (samozřejmě i se záznamem v registru). Není to něco z tý Gareny? To je rejdiště podobných šmejdů. Smaž to tím MbAMem.

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.garena.com/
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\Common Files\BinarySense\hlAPP.dll" (file missing)
*****************************************************************************************************************************************
Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 05 bře 2010 00:05
od martin.efres
Není to něco z tý Gareny?

Je to možné..garenu jsem odpoledne už smazal ,ale stihla nápachat škody.

LOG Z COMBOFIXU :

ComboFix 10-03-04.02 - Butterfly 04.03.2010 23:57:53.9.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.683 [GMT 1:00]
Spuštěný z: c:\documents and settings\Butterfly\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\driver
c:\windows\system32\AVSredirect.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-04 do 2010-03-04 )))))))))))))))))))))))))))))))
.

2010-03-04 21:47 . 2006-08-01 14:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2010-03-04 21:47 . 2010-03-04 21:47 -------- d-----w- c:\windows\system32\RTCOM
2010-03-04 21:47 . 2007-10-11 10:04 1826816 ----a-w- c:\windows\SkyTel.exe
2010-03-04 21:47 . 2007-07-26 17:06 1191936 ----a-w- c:\windows\RtlUpd.exe
2010-03-04 21:47 . 2006-07-21 15:14 86016 ----a-w- c:\windows\SoundMan.exe
2010-03-04 21:47 . 2007-10-16 17:38 4615168 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2010-03-04 21:47 . 2007-03-23 18:19 9715200 ----a-w- c:\windows\RTLCPL.exe
2010-03-04 21:47 . 2007-10-16 17:30 16855552 ----a-w- c:\windows\RTHDCPL.exe
2010-03-04 21:47 . 2007-06-28 15:44 2165760 ----a-w- c:\windows\MicCal.exe
2010-03-04 21:47 . 2010-03-04 21:47 -------- d-----w- c:\program files\Realtek
2010-03-04 21:47 . 2006-05-04 15:26 2808832 ----a-w- c:\windows\alcwzrd.exe
2010-03-04 21:47 . 2005-05-03 17:43 69632 ----a-w- c:\windows\Alcmtr.exe
2010-03-04 21:46 . 2010-03-04 21:46 319488 ----a-w- c:\windows\HideWin.exe
2010-03-04 21:11 . 2006-05-03 21:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2010-03-04 21:11 . 2010-03-04 21:11 -------- d-----w- c:\program files\DIFX
2010-03-04 21:11 . 2006-07-24 15:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-03-04 21:09 . 2010-03-04 21:09 -------- d-----w- c:\program files\Samsung
2010-03-04 19:46 . 2010-03-04 19:56 -------- d-----w- c:\program files\Garena
2010-03-04 19:33 . 2006-10-27 15:26 69632 ----a-w- c:\windows\system32\vuins32.dll
2010-03-04 19:32 . 2010-03-04 21:11 -------- dc----w- c:\windows\system32\DRVSTORE
2010-03-04 18:16 . 2010-03-04 18:16 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-04 16:59 . 2010-03-04 17:02 -------- d-----w- c:\program files\All Ten Fingers
2010-03-04 16:17 . 2010-03-04 16:17 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-04 16:17 . 2010-03-04 16:17 262144 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-04 16:16 . 2007-09-07 13:55 12744 ----a-w- c:\windows\system32\drivers\Entech64.sys
2010-03-04 16:16 . 2001-11-19 19:05 3972 ----a-w- c:\windows\system32\drivers\PciBus.sys
2010-03-04 16:16 . 2010-03-04 16:16 -------- d-----w- c:\windows\system32\Futuremark
2010-03-04 16:16 . 2007-09-07 13:55 27672 ----a-w- c:\windows\system32\drivers\Entech.sys
2010-03-04 16:14 . 2010-03-04 16:14 -------- d-----w- c:\program files\Futuremark
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\custom matrices
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\C2MP
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\QuickTime
2010-03-03 21:53 . 2010-03-03 21:53 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-03-03 20:56 . 2010-03-03 20:56 -------- d-----w- C:\VIRTINS Multi-Instrument 3.2
2010-03-03 20:55 . 2010-03-03 20:55 -------- d-----w- c:\program files\SoundCheck
2010-03-03 13:44 . 2010-03-03 13:44 -------- d-----w- c:\windows\system32\Adobe
2010-03-02 22:58 . 2010-03-02 22:58 -------- d-----w- C:\HLITE
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\OperaPortable
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\ChromePortable
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\FirefoxPortable
2010-03-01 20:36 . 2010-03-01 20:37 -------- d-----w- c:\program files\Prime95
2010-03-01 20:31 . 2010-03-01 20:31 -------- d-----w- c:\program files\SystemRequirementsLab
2010-03-01 20:31 . 2010-03-01 20:31 -------- d-----w- c:\documents and settings\Butterfly\SystemRequirementsLab
2010-03-01 20:16 . 2010-03-04 16:56 -------- d-----w- c:\program files\Hot CPU Tester Pro 4 LE
2010-03-01 20:16 . 2007-03-05 10:51 360580 ----a-w- c:\windows\eSellerateEngine.dll
2010-03-01 17:36 . 2010-03-01 17:36 -------- d-----w- c:\program files\System Stability Tester
2010-03-01 17:29 . 2006-11-02 06:21 319456 ------w- c:\windows\system32\difxapi.dll
2010-03-01 16:35 . 2008-04-13 23:10 5376 -c--a-w- c:\windows\system32\dllcache\viaide.sys
2010-03-01 16:35 . 2008-04-13 23:10 5376 ----a-w- c:\windows\system32\drivers\viaide.sys
2010-03-01 14:13 . 2010-03-01 14:33 -------- d-----w- c:\program files\Astroburn Lite
2010-02-28 21:24 . 2010-02-28 21:24 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-28 21:01 . 2010-02-28 21:01 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-02-28 20:41 . 2010-02-28 20:41 -------- d-----w- c:\program files\WarpSpeeder
2010-02-28 20:41 . 2006-12-28 16:56 26472 ----a-w- c:\windows\system32\drivers\BS_I2c64.sys
2010-02-28 20:38 . 2005-01-26 18:19 97 ----a-w- c:\windows\system32\drivers\a.bat
2010-02-28 20:38 . 2004-10-07 05:59 102912 ----a-r- c:\windows\system32\Ntport.dll
2010-02-28 20:38 . 2001-01-22 13:23 6080 ----a-w- c:\windows\system32\drivers\zntport.sys
2010-02-28 20:38 . 2010-02-28 20:38 -------- d-----w- c:\windows\SysWow64
2010-02-28 20:38 . 2010-02-28 20:38 -------- d-----w- c:\program files\ITE
2010-02-28 20:38 . 2003-10-22 19:04 46080 ----a-r- c:\windows\system32\itevio.dll
2010-02-28 20:04 . 2010-03-02 22:40 -------- d-----w- c:\program files\PKR
2010-02-28 19:58 . 2010-02-28 19:58 -------- d-----w- C:\MFT 2867
2010-02-28 14:36 . 2010-03-04 17:53 -------- d-----w- c:\program files\Valve
2010-02-28 13:40 . 2010-02-28 13:40 -------- d-----w- c:\program files\Intel
2010-02-28 13:38 . 2007-02-23 10:34 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-02-28 13:23 . 2010-03-01 16:09 -------- d-----w- c:\program files\BIOS Update
2010-02-27 13:54 . 2010-02-27 13:57 -------- d--h--w- c:\windows\msdownld.tmp
2010-02-27 13:54 . 2010-02-27 13:54 -------- d-----w- c:\windows\Logs
2010-02-27 13:16 . 2005-11-14 10:40 29184 ----a-w- c:\windows\system32\dwmapi.dll
2010-02-27 10:56 . 2010-03-01 14:33 -------- d-----w- c:\program files\Glary Utilities
2010-02-27 10:16 . 2010-02-27 10:53 -------- d-----w- c:\program files\Speeditup Free
2010-02-27 10:16 . 2010-02-27 10:16 -------- d-----w- c:\windows\Speeditup Free
2010-02-27 09:19 . 2009-10-30 14:31 29512 ----a-w- c:\windows\system32\TURegOpt.exe
2010-02-27 09:19 . 2009-10-30 14:24 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-27 09:18 . 2010-02-27 09:19 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-02-27 09:07 . 2010-03-03 16:45 -------- d-----w- c:\windows\Internet Logs
2010-02-27 09:04 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-27 09:04 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-27 09:04 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-27 09:04 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-27 09:04 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-27 09:04 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-27 09:04 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-27 09:04 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-27 09:04 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-26 19:55 . 2010-02-26 19:55 -------- d-sh--w- c:\documents and settings\Butty\PrivacIE
2010-02-25 20:28 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 20:28 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-24 16:13 . 2010-02-27 09:07 -------- d-----w- c:\program files\CheckPoint
2010-02-24 16:13 . 2010-02-24 16:13 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-23 19:47 . 2010-02-23 19:47 -------- d-sh--w- c:\documents and settings\Butterfly\IECompatCache
2010-02-22 14:10 . 2010-02-27 09:44 -------- d-----w- c:\program files\Motherboard Monitor 5
2010-02-22 13:57 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-02-21 23:25 . 2010-02-21 23:25 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-02-21 20:11 . 2010-02-21 20:11 -------- d-----w- c:\windows\ie8updates
2010-02-21 13:14 . 2010-02-21 13:14 -------- d-----w- c:\program files\WhoCrashed
2010-02-21 13:09 . 2009-03-06 18:52 18944 ----a-w- c:\windows\system32\drivers\gHidPnp.sys
2010-02-21 13:09 . 2009-03-04 08:55 11520 ----a-w- c:\windows\system32\drivers\gMouUsb.sys
2010-02-21 13:08 . 2010-02-21 13:08 -------- d-----w- C:\Genius
2010-02-21 12:47 . 2004-12-27 13:57 4016 ----a-w- c:\windows\mHotkey.reg
2010-02-21 12:47 . 2004-04-07 10:00 61440 ----a-w- c:\windows\String.dll
2010-02-21 12:47 . 2003-10-06 09:22 40960 ----a-w- c:\windows\StopHid.exe
2010-02-21 12:47 . 2003-05-16 19:09 11776 ----a-w- c:\windows\HIDMNT.dll
2010-02-21 12:47 . 2004-12-27 15:02 550912 ----a-w- c:\windows\mHotkey.exe
2010-02-21 12:47 . 2004-12-27 13:08 536064 ----a-w- c:\windows\SETFORM.exe
2010-02-21 12:47 . 2004-12-27 12:20 24576 ----a-w- c:\windows\HKNTDLL.dll
2010-02-21 12:47 . 2003-07-03 13:21 294912 ----a-w- c:\windows\PIC.dll
2010-02-21 11:53 . 2007-10-18 10:28 52224 ----a-r- c:\windows\system32\drivers\ViPrt.sys
2010-02-21 11:53 . 2007-09-21 08:28 18432 ----a-r- c:\windows\system32\vIdeInst.dll
2010-02-21 11:53 . 2007-10-18 10:28 16896 ----a-r- c:\windows\system32\drivers\ViBus.sys
2010-02-21 11:52 . 2008-04-14 07:10 68736 -c--a-w- c:\windows\system32\dllcache\pci.sys
2010-02-21 11:52 . 2008-04-14 07:10 68736 ----a-w- c:\windows\system32\drivers\pci.sys
2010-02-21 11:52 . 2008-04-14 06:57 37248 -c--a-w- c:\windows\system32\dllcache\isapnp.sys
2010-02-21 11:52 . 2008-04-14 06:57 37248 ----a-w- c:\windows\system32\drivers\isapnp.sys
2010-02-21 11:47 . 2009-06-16 17:28 46592 ----a-w- c:\windows\system32\drivers\fetnd5bv.sys
2010-02-21 11:47 . 2010-02-21 11:47 -------- d-----w- c:\windows\vnDrvBas
2010-02-21 11:44 . 2008-02-25 12:54 105088 ----a-r- c:\windows\system32\drivers\Rtnicxp.sys
2010-02-21 11:44 . 2010-02-21 11:44 -------- d-----w- c:\windows\OPTIONS
2010-02-21 11:42 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-21 10:40 . 2010-01-14 10:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-21 08:50 . 2009-12-21 19:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-21 08:50 . 2009-12-21 19:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-02-21 08:50 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-21 08:49 . 2009-12-21 19:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-21 08:49 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 21:10 . 2010-02-09 21:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\ChromePortable
2010-02-26 19:53 . 2010-02-26 19:53 0 ----a-w- c:\windows\nsreg.dat
2010-02-23 18:01 . 2001-10-25 14:00 61056 ----a-w- c:\windows\system32\perfc005.dat
2010-02-23 18:01 . 2001-10-25 14:00 337152 ----a-w- c:\windows\system32\perfh005.dat
2010-02-20 11:40 . 2004-08-17 13:49 219648 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-20 10:29 . 2010-02-09 21:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-20 10:29 . 2010-02-09 21:16 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-02-17 14:50 . 2010-02-09 21:26 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-12 21:17 . 2010-02-12 16:23 -------- d-----w- c:\program files\CyberLink
2010-02-12 21:17 . 2010-02-12 21:17 -------- d-----w- c:\program files\Common Files\CyberLink
2010-02-12 21:15 . 2010-02-12 21:17 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-02-12 21:14 . 2010-02-12 21:14 -------- d-----w- c:\program files\AviSynth 2.5
2010-02-12 21:14 . 2010-02-12 21:14 -------- d-----w- c:\program files\eRightSoft
2010-02-12 21:12 . 2010-02-12 21:12 -------- d-----w- c:\program files\Google
2010-02-10 18:06 . 2010-02-09 21:16 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-02-09 21:17 . 2010-02-09 21:17 -------- d-----w- c:\program files\microsoft frontpage
2010-02-09 21:12 . 2010-02-09 21:12 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-02-04 09:01 . 2010-02-27 13:58 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-02-27 13:58 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-02-27 13:58 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-02-27 13:58 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-12 04:03 . 2010-02-10 18:46 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-10 18:46 10276768 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-01-12 04:03 . 2010-02-10 18:46 4104192 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-10 18:46 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-10 18:46 2259560 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-10 18:46 182888 ----a-w- c:\windows\system32\nvcodins.dll
2010-01-12 04:03 . 2010-02-10 18:46 182888 ----a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03 . 2010-02-10 18:46 14458880 ----a-w- c:\windows\system32\nvoglnt.dll
2010-01-12 04:03 . 2010-02-10 18:46 11632640 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2010-02-10 18:46 6359168 ----a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-10 18:46 2283526 ----a-w- c:\windows\system32\nvdata.bin
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2010-02-09 21:10 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 14:15 . 2005-10-14 10:56 178176 ----a-w- c:\windows\system32\unrar.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2006-05-03 09:06 . 2010-02-12 21:14 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2010-02-12 21:14 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2010-02-12 21:14 216064 --sh--r- c:\windows\system32\nbDX.dll
.

------- Sigcheck -------

[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe

[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2004-08-17 . 4D32D7FFC2F583FE21EF0A4F99EABB12 . 974848 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2004-12-27 15:02 550912 ----a-w- c:\windows\mHotkey.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD Cinema\\PowerDVDCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=

R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [21.2.2010 12:53 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [21.2.2010 12:53 52224]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [17.2.2010 20:27 22168]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [27.2.2010 10:04 162512]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [9.2.2010 22:30 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [17.2.2010 15:51 17024]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/02/12 22:17];c:\program files\CyberLink\PowerDVD9\000.fcl [28.2.2009 19:40 87536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2010 10:04 19024]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 15:28 1021256]
R3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\drivers\gHidPnp.sys [21.2.2010 14:09 18944]
R3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\drivers\gMouUsb.sys [21.2.2010 14:09 11520]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S2 HDDlife HDD Access service;HDDlife HDD Access service;c:\program files\Common Files\BinarySense\hldasvc.exe [19.8.2009 19:04 822936]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]
S3 BS_Flash;BS_Flash;c:\program files\Tseries BIOS Update\Award\BS_Flash.sys [1.3.2010 17:11 3604]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [10.2.2010 19:53 23456]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\my folder\SLOZKY - INSTALL\everestultimate_build_4.60.1554 Beta\kerneld.wnt [31.10.2009 11:07 23664]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\BUTTER~1\LOCALS~1\Temp\HFXD.tmp --> c:\docume~1\BUTTER~1\LOCALS~1\Temp\HFXD.tmp [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.2.2010 22:24 691696]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-02-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-04 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 14:35]

2010-03-04 c:\windows\Tasks\User_Feed_Synchronization-{1B255865-963C-43CA-8CB9-18642688F034}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 00:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\d:\my folder\SLOZKY - INSTALL\everestultimate_build_4.60.1554 Beta\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\BUTTER~1\LOCALS~1\Temp\HFXD.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
Celkový čas: 2010-03-05 00:04:18
ComboFix-quarantined-files.txt 2010-03-04 23:04

Před spuštěním: Volných bajtů: 88 102 273 024
Po spuštění: Volných bajtů: 88 228 679 680

- - End Of File - - 6066055CF1FB65C4677D509B98656D4D

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 05 bře 2010 00:24
od Damned
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\drivers\a.bat
c:\windows\system32\emptyregdb.dat
d:\my folder\SLOZKY - INSTALL\everestultimate_build_4.60.1554 Beta\kerneld.wnt
c:\docume~1\BUTTER~1\LOCALS~1\Temp\HFXD.tmp

Folder::
c:\windows\msdownld.tmp

Driver::
EverestDriver;Lavalys EVEREST Kernel Driver
EverestDriver
GarenaPEngine;GarenaPEngine
GarenaPEngine

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]





Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.
Obrázek

- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu
*****************************************************************************************************************************************
Červený soubor zkontroluj na Virustotalu a vlož sem odkaz na výsledek.
Pokud ho nenajdeš, dej si zobrazit skryté a systémové soubory. Pokud ti nabídne, že soubor už kontroloval,
nech ho zkontrolovat znovu, a počkej až se objeví "Dokončeno" a výsledek.Potom sem zkopíruj adresní řádek.

c:\windows\system32\drivers\DrvAgent32.sys
c:\windows\system32\drivers\Ambfilt.sys

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 11:56
od martin.efres
LOG Z COMBOFIX :

ComboFix 10-03-05.03 - Butterfly 06.03.2010 11:43:18.10.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.537 [GMT 1:00]
Spuštěný z: c:\documents and settings\Butterfly\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Butterfly\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\docume~1\BUTTER~1\LOCALS~1\Temp\HFXD.tmp"
"c:\windows\system32\drivers\a.bat"
"c:\windows\system32\emptyregdb.dat"
"d:\my folder\SLOZKY - INSTALL\everestultimate_build_4.60.1554 Beta\kerneld.wnt"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\msdownld.tmp
c:\windows\system32\drivers\a.bat
c:\windows\system32\emptyregdb.dat
d:\my folder\SLOZKY - INSTALL\everestultimate_build_4.60.1554 Beta\kerneld.wnt

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EVERESTDRIVER
-------\Legacy_GARENAPENGINE


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-06 do 2010-03-06 )))))))))))))))))))))))))))))))
.

2010-03-06 10:09 . 2010-03-06 10:09 -------- d-----w- c:\program files\MSXML 4.0
2010-03-06 10:09 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-06 10:08 . 2010-03-06 10:08 -------- d-----w- c:\program files\BinarySense
2010-03-04 21:47 . 2006-08-01 14:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2010-03-04 21:47 . 2010-03-04 21:47 -------- d-----w- c:\windows\system32\RTCOM
2010-03-04 21:47 . 2007-10-11 10:04 1826816 ----a-w- c:\windows\SkyTel.exe
2010-03-04 21:47 . 2007-07-26 17:06 1191936 ----a-w- c:\windows\RtlUpd.exe
2010-03-04 21:47 . 2006-07-21 15:14 86016 ----a-w- c:\windows\SoundMan.exe
2010-03-04 21:47 . 2007-10-16 17:38 4615168 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2010-03-04 21:47 . 2007-03-23 18:19 9715200 ----a-w- c:\windows\RTLCPL.exe
2010-03-04 21:47 . 2007-10-16 17:30 16855552 ----a-w- c:\windows\RTHDCPL.exe
2010-03-04 21:47 . 2007-06-28 15:44 2165760 ----a-w- c:\windows\MicCal.exe
2010-03-04 21:47 . 2010-03-04 21:47 -------- d-----w- c:\program files\Realtek
2010-03-04 21:47 . 2006-05-04 15:26 2808832 ----a-w- c:\windows\alcwzrd.exe
2010-03-04 21:47 . 2005-05-03 17:43 69632 ----a-w- c:\windows\Alcmtr.exe
2010-03-04 21:46 . 2010-03-04 21:46 319488 ----a-w- c:\windows\HideWin.exe
2010-03-04 21:11 . 2006-05-03 21:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2010-03-04 21:11 . 2010-03-04 21:11 -------- d-----w- c:\program files\DIFX
2010-03-04 21:11 . 2006-07-24 15:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-03-04 21:09 . 2010-03-04 21:09 -------- d-----w- c:\program files\Samsung
2010-03-04 19:46 . 2010-03-04 19:56 -------- d-----w- c:\program files\Garena
2010-03-04 19:33 . 2006-10-27 15:26 69632 ----a-w- c:\windows\system32\vuins32.dll
2010-03-04 19:32 . 2010-03-04 21:11 -------- dc----w- c:\windows\system32\DRVSTORE
2010-03-04 18:16 . 2010-03-04 18:16 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-04 16:59 . 2010-03-04 17:02 -------- d-----w- c:\program files\All Ten Fingers
2010-03-04 16:17 . 2010-03-04 16:17 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-04 16:17 . 2010-03-04 16:17 262144 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-04 16:16 . 2007-09-07 13:55 12744 ----a-w- c:\windows\system32\drivers\Entech64.sys
2010-03-04 16:16 . 2001-11-19 19:05 3972 ----a-w- c:\windows\system32\drivers\PciBus.sys
2010-03-04 16:16 . 2010-03-04 16:16 -------- d-----w- c:\windows\system32\Futuremark
2010-03-04 16:16 . 2007-09-07 13:55 27672 ----a-w- c:\windows\system32\drivers\Entech.sys
2010-03-04 16:14 . 2010-03-04 16:14 -------- d-----w- c:\program files\Futuremark
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\custom matrices
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\C2MP
2010-03-03 21:57 . 2010-03-03 21:57 -------- d-----w- c:\windows\system32\QuickTime
2010-03-03 21:53 . 2010-03-03 21:53 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-03-03 20:56 . 2010-03-03 20:56 -------- d-----w- C:\VIRTINS Multi-Instrument 3.2
2010-03-03 20:55 . 2010-03-03 20:55 -------- d-----w- c:\program files\SoundCheck
2010-03-03 13:44 . 2010-03-03 13:44 -------- d-----w- c:\windows\system32\Adobe
2010-03-02 22:58 . 2010-03-02 22:58 -------- d-----w- C:\HLITE
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\OperaPortable
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\ChromePortable
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\FirefoxPortable
2010-03-01 20:36 . 2010-03-01 20:37 -------- d-----w- c:\program files\Prime95
2010-03-01 20:31 . 2010-03-01 20:31 -------- d-----w- c:\program files\SystemRequirementsLab
2010-03-01 20:31 . 2010-03-01 20:31 -------- d-----w- c:\documents and settings\Butterfly\SystemRequirementsLab
2010-03-01 20:16 . 2010-03-04 16:56 -------- d-----w- c:\program files\Hot CPU Tester Pro 4 LE
2010-03-01 20:16 . 2007-03-05 10:51 360580 ----a-w- c:\windows\eSellerateEngine.dll
2010-03-01 17:36 . 2010-03-01 17:36 -------- d-----w- c:\program files\System Stability Tester
2010-03-01 17:29 . 2006-11-02 06:21 319456 ----a-w- c:\windows\system32\difxapi.dll
2010-03-01 16:35 . 2008-04-13 23:10 5376 -c--a-w- c:\windows\system32\dllcache\viaide.sys
2010-03-01 16:35 . 2008-04-13 23:10 5376 ----a-w- c:\windows\system32\drivers\viaide.sys
2010-03-01 14:13 . 2010-03-01 14:33 -------- d-----w- c:\program files\Astroburn Lite
2010-02-28 21:24 . 2010-02-28 21:24 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-28 21:01 . 2010-02-28 21:01 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-02-28 20:41 . 2010-02-28 20:41 -------- d-----w- c:\program files\WarpSpeeder
2010-02-28 20:41 . 2006-12-28 16:56 26472 ----a-w- c:\windows\system32\drivers\BS_I2c64.sys
2010-02-28 20:38 . 2004-10-07 05:59 102912 ----a-r- c:\windows\system32\Ntport.dll
2010-02-28 20:38 . 2001-01-22 13:23 6080 ----a-w- c:\windows\system32\drivers\zntport.sys
2010-02-28 20:38 . 2010-02-28 20:38 -------- d-----w- c:\windows\SysWow64
2010-02-28 20:38 . 2010-02-28 20:38 -------- d-----w- c:\program files\ITE
2010-02-28 20:38 . 2003-10-22 19:04 46080 ----a-r- c:\windows\system32\itevio.dll
2010-02-28 20:04 . 2010-03-02 22:40 -------- d-----w- c:\program files\PKR
2010-02-28 19:58 . 2010-02-28 19:58 -------- d-----w- C:\MFT 2867
2010-02-28 14:36 . 2010-03-04 17:53 -------- d-----w- c:\program files\Valve
2010-02-28 13:40 . 2010-02-28 13:40 -------- d-----w- c:\program files\Intel
2010-02-28 13:38 . 2007-02-23 10:34 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-02-28 13:23 . 2010-03-01 16:09 -------- d-----w- c:\program files\BIOS Update
2010-02-27 13:54 . 2010-02-27 13:54 -------- d-----w- c:\windows\Logs
2010-02-27 13:16 . 2005-11-14 10:40 29184 ----a-w- c:\windows\system32\dwmapi.dll
2010-02-27 10:56 . 2010-03-01 14:33 -------- d-----w- c:\program files\Glary Utilities
2010-02-27 10:16 . 2010-02-27 10:53 -------- d-----w- c:\program files\Speeditup Free
2010-02-27 10:16 . 2010-02-27 10:16 -------- d-----w- c:\windows\Speeditup Free
2010-02-27 09:19 . 2009-10-30 14:31 29512 ----a-w- c:\windows\system32\TURegOpt.exe
2010-02-27 09:19 . 2009-10-30 14:24 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-27 09:18 . 2010-03-06 09:46 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-02-27 09:07 . 2010-03-03 16:45 -------- d-----w- c:\windows\Internet Logs
2010-02-27 09:04 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-27 09:04 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-27 09:04 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-27 09:04 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-27 09:04 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-27 09:04 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-27 09:04 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-27 09:04 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-27 09:04 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-26 19:55 . 2010-02-26 19:55 -------- d-sh--w- c:\documents and settings\Butty\PrivacIE
2010-02-25 20:28 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 20:28 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-24 16:13 . 2010-02-27 09:07 -------- d-----w- c:\program files\CheckPoint
2010-02-24 16:13 . 2010-02-24 16:13 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-23 19:47 . 2010-02-23 19:47 -------- d-sh--w- c:\documents and settings\Butterfly\IECompatCache
2010-02-22 14:10 . 2010-02-27 09:44 -------- d-----w- c:\program files\Motherboard Monitor 5
2010-02-22 13:57 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-02-21 23:25 . 2010-02-21 23:25 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-02-21 20:11 . 2010-02-21 20:11 -------- d-----w- c:\windows\ie8updates
2010-02-21 13:14 . 2010-02-21 13:14 -------- d-----w- c:\program files\WhoCrashed
2010-02-21 13:09 . 2009-03-06 18:52 18944 ----a-w- c:\windows\system32\drivers\gHidPnp.sys
2010-02-21 13:09 . 2009-03-04 08:55 11520 ----a-w- c:\windows\system32\drivers\gMouUsb.sys
2010-02-21 13:08 . 2010-02-21 13:08 -------- d-----w- C:\Genius
2010-02-21 12:47 . 2004-12-27 13:57 4016 ----a-w- c:\windows\mHotkey.reg
2010-02-21 12:47 . 2004-04-07 10:00 61440 ----a-w- c:\windows\String.dll
2010-02-21 12:47 . 2003-10-06 09:22 40960 ----a-w- c:\windows\StopHid.exe
2010-02-21 12:47 . 2003-05-16 19:09 11776 ----a-w- c:\windows\HIDMNT.dll
2010-02-21 12:47 . 2004-12-27 15:02 550912 ----a-w- c:\windows\mHotkey.exe
2010-02-21 12:47 . 2004-12-27 13:08 536064 ----a-w- c:\windows\SETFORM.exe
2010-02-21 12:47 . 2004-12-27 12:20 24576 ----a-w- c:\windows\HKNTDLL.dll
2010-02-21 12:47 . 2003-07-03 13:21 294912 ----a-w- c:\windows\PIC.dll
2010-02-21 11:53 . 2007-10-18 10:28 52224 ----a-r- c:\windows\system32\drivers\ViPrt.sys
2010-02-21 11:53 . 2007-09-21 08:28 18432 ----a-r- c:\windows\system32\vIdeInst.dll
2010-02-21 11:53 . 2007-10-18 10:28 16896 ----a-r- c:\windows\system32\drivers\ViBus.sys
2010-02-21 11:52 . 2008-04-14 07:10 68736 -c--a-w- c:\windows\system32\dllcache\pci.sys
2010-02-21 11:52 . 2008-04-14 07:10 68736 ----a-w- c:\windows\system32\drivers\pci.sys
2010-02-21 11:52 . 2008-04-14 06:57 37248 -c--a-w- c:\windows\system32\dllcache\isapnp.sys
2010-02-21 11:52 . 2008-04-14 06:57 37248 ----a-w- c:\windows\system32\drivers\isapnp.sys
2010-02-21 11:47 . 2009-06-16 17:28 46592 ----a-w- c:\windows\system32\drivers\fetnd5bv.sys
2010-02-21 11:47 . 2010-02-21 11:47 -------- d-----w- c:\windows\vnDrvBas
2010-02-21 11:44 . 2008-02-25 12:54 105088 ----a-r- c:\windows\system32\drivers\Rtnicxp.sys
2010-02-21 11:44 . 2010-02-21 11:44 -------- d-----w- c:\windows\OPTIONS
2010-02-21 11:42 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-21 10:40 . 2010-01-14 10:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-21 08:50 . 2009-12-21 19:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-21 08:50 . 2009-12-21 19:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-02-21 08:50 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-21 08:49 . 2009-12-21 19:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 21:10 . 2010-02-09 21:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-02 21:04 . 2010-03-02 21:04 -------- d-----w- c:\program files\ChromePortable
2010-02-26 19:53 . 2010-02-26 19:53 0 ----a-w- c:\windows\nsreg.dat
2010-02-23 18:01 . 2001-10-25 14:00 61056 ----a-w- c:\windows\system32\perfc005.dat
2010-02-23 18:01 . 2001-10-25 14:00 337152 ----a-w- c:\windows\system32\perfh005.dat
2010-02-20 11:40 . 2004-08-17 13:49 219648 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-20 10:29 . 2010-02-09 21:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-20 10:29 . 2010-02-09 21:16 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-02-17 14:50 . 2010-02-09 21:26 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-12 21:17 . 2010-02-12 16:23 -------- d-----w- c:\program files\CyberLink
2010-02-12 21:17 . 2010-02-12 21:17 -------- d-----w- c:\program files\Common Files\CyberLink
2010-02-12 21:15 . 2010-02-12 21:17 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-02-12 21:14 . 2010-02-12 21:14 -------- d-----w- c:\program files\AviSynth 2.5
2010-02-12 21:14 . 2010-02-12 21:14 -------- d-----w- c:\program files\eRightSoft
2010-02-12 21:12 . 2010-02-12 21:12 -------- d-----w- c:\program files\Google
2010-02-10 18:06 . 2010-02-09 21:16 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-02-09 21:17 . 2010-02-09 21:17 -------- d-----w- c:\program files\microsoft frontpage
2010-02-04 09:01 . 2010-02-27 13:58 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-02-27 13:58 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-02-27 13:58 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-02-27 13:58 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-12 04:03 . 2010-02-10 18:46 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-10 18:46 10276768 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-01-12 04:03 . 2010-02-10 18:46 4104192 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-10 18:46 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-10 18:46 2259560 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-10 18:46 182888 ----a-w- c:\windows\system32\nvcodins.dll
2010-01-12 04:03 . 2010-02-10 18:46 182888 ----a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03 . 2010-02-10 18:46 14458880 ----a-w- c:\windows\system32\nvoglnt.dll
2010-01-12 04:03 . 2010-02-10 18:46 11632640 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2010-02-10 18:46 6359168 ----a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-10 18:46 2283526 ----a-w- c:\windows\system32\nvdata.bin
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-17 13:49 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2010-02-09 21:10 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 14:15 . 2005-10-14 10:56 178176 ----a-w- c:\windows\system32\unrar.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2006-05-03 09:06 . 2010-02-12 21:14 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2010-02-12 21:14 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2010-02-12 21:14 216064 --sh--r- c:\windows\system32\nbDX.dll
.

------- Sigcheck -------

[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe

[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 13E794E5591776CBC71055A7B3CC1D5F . 976384 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2004-08-17 . 4D32D7FFC2F583FE21EF0A4F99EABB12 . 974848 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-03-04_23.02.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-30 15:45 . 2008-09-30 15:45 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2010-03-06 10:49 . 2010-03-06 10:49 16384 c:\windows\temp\Perflib_Perfdata_6dc.dat
+ 2010-03-06 10:50 . 2010-03-06 10:50 16384 c:\windows\temp\Perflib_Perfdata_3e8.dat
+ 2010-03-06 10:09 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-03-06 10:12 . 2006-10-27 15:26 69632 c:\windows\system32\ReinstallBackups\0005\DriverFiles\vuins32.dll
+ 2010-03-06 10:12 . 2009-06-16 17:28 46592 c:\windows\system32\ReinstallBackups\0005\DriverFiles\fetnd5bv.sys
+ 2010-03-06 10:09 . 2010-03-06 10:09 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2010-02-11 19:56 . 2010-03-06 10:08 10134 c:\windows\Installer\{E352C82D-3303-4C9B-A64A-5680466996D6}\HDDlifeIcon2k.exe
- 2010-02-11 19:56 . 2010-02-11 19:56 10134 c:\windows\Installer\{E352C82D-3303-4C9B-A64A-5680466996D6}\HDDlifeIcon2k.exe
+ 2010-03-06 10:08 . 2010-03-06 10:08 76446 c:\windows\Installer\{E352C82D-3303-4C9B-A64A-5680466996D6}\HDDlifeIcon.exe
+ 2010-03-06 10:09 . 2010-03-06 10:09 32768 c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2010-03-06 10:12 . 2006-11-02 06:21 319456 c:\windows\system32\ReinstallBackups\0005\DriverFiles\difxapi.dll
+ 2010-03-06 10:09 . 2010-03-06 10:09 429568 c:\windows\Installer\3d7a9.msi
+ 2010-03-06 10:09 . 2010-03-06 10:09 432640 c:\windows\Installer\3d7a0.msi
+ 2009-07-20 23:03 . 2009-07-20 23:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-09-30 15:42 . 2008-09-30 15:42 1286152 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2009-07-20 23:05 . 2009-07-20 23:05 1348432 c:\windows\system32\msxml4.dll
+ 2010-03-06 10:08 . 2010-03-06 10:08 1160704 c:\windows\Installer\3d797.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Butterfly\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HDDlife.lnk - c:\program files\BinarySense\HDDlife 3\HDDlifePro.exe [2009-8-19 2252440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
2004-12-27 15:02 550912 ----a-w- c:\windows\mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD Cinema\\PowerDVDCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=

R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [21.2.2010 12:53 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [21.2.2010 12:53 52224]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [17.2.2010 20:27 22168]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [27.2.2010 10:04 162512]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [9.2.2010 22:30 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [17.2.2010 15:51 17024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2010 10:04 19024]
R2 HDDlife HDD Access service;HDDlife HDD Access service;c:\program files\Common Files\BinarySense\hldasvc.exe [19.8.2009 19:04 822936]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 15:28 1021256]
R3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\drivers\gHidPnp.sys [21.2.2010 14:09 18944]
R3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\drivers\gMouUsb.sys [21.2.2010 14:09 11520]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]
S3 BS_Flash;BS_Flash;c:\program files\Tseries BIOS Update\Award\BS_Flash.sys [1.3.2010 17:11 3604]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [10.2.2010 19:53 23456]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.2.2010 22:24 691696]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-02-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-06 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 14:35]

2010-03-06 c:\windows\Tasks\User_Feed_Synchronization-{1B255865-963C-43CA-8CB9-18642688F034}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - c:\program files\Common Files\BinarySense\hlAPP.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-06 11:50
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2972)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
.
**************************************************************************
.
Celkový čas: 2010-03-06 11:53:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-06 10:53
ComboFix2.txt 2010-03-04 23:04

Před spuštěním: Volných bajtů: 88 087 289 856
Po spuštění: Volných bajtů: 88 009 474 048

- - End Of File - - 2A85AC1C56951686AE3B834E8B95B807

____________________________________________________________________
DrvAgent32.sys :
https://www.virustotal.com/cs/analisis/ ... 1267873050

Amfilt.sys :
tenhle soubor jsem nenašel.. a to žádné soubory nebyli skryté.

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 12:37
od Damned
Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Stáhni si T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG, Aviru.)
*****************************************************************************************************************************************
Stáhni si OTL na Plochu.
Ujisti se , že máš zavřena všechna ostatní okna a poklepej na ikonu OTL.Nahoře v okně pod Output klikni na minimal Output.Pod Standard Registry změň na All. Zatrhni LOP Check a Purity Check. File age změň na 14 days. Všechny ostatní nastavení ponech jak jsou. Klikni na Run Scan. Sken může trvat dlouho, až skončí otevřou se dva logy:
OTL.Txt
Extras.Txt
Jsou uloženy ve stejném místě jako OTL. Oba logy sem prosím zkopíruj

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 12:58
od martin.efres
Logy zabírají asi 3příspěvky..proto to dávám na Edisk.cz :

http://www.edisk.cz/stahni/05903/Plocha ... .47KB.html

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 13:21
od Damned
I sem se vejdou přílohy až do velikosti 512 kB :wink:
A to že by to byly 3 příspěvky nevadí. V příspěvku je to přehlednější

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 13:28
od martin.efres
OTL LOG - ČÁST PRVNÍ :


OTL logfile created on: 6.3.2010 12:50:29 - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Butterfly\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

1 022,00 Mb Total Physical Memory | 591,00 Mb Available Physical Memory | 58,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 83,48 Gb Free Space | 85,48% Space Free | Partition Type: NTFS
Drive D: | 51,39 Gb Total Space | 18,88 Gb Free Space | 36,74% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: M-847EBEFBA67E4
Current User Name: Butterfly
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 14 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Butterfly\Plocha\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AIMP2\AIMP2.exe (AIMP DevTeam)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Program Files\Common Files\BinarySense\hldasvc.exe (BinarySense, Inc.)
PRC - C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe (BinarySense, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Butterfly\Plocha\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (aspnet_state) -- File not found
SRV - (TuneUp.Defrag) -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (HDDlife HDD Access service) -- C:\Program Files\Common Files\BinarySense\hldasvc.exe (BinarySense, Inc.)


========== Driver Services (SafeList) ==========

DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (aswTdi) -- C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) -- C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (DrvAgent32) -- C:\WINDOWS\system32\drivers\DrvAgent32.sys (Phoenix Technologies)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (xfilt) -- C:\WINDOWS\system32\DRIVERS\xfilt.sys (VIA Technologies,Inc)
DRV - (videX32) -- C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.)
DRV - (gHidPnp) -- C:\WINDOWS\system32\drivers\gHidPnp.sys ()
DRV - (gMouUsb) -- C:\WINDOWS\system32\drivers\gMouUsb.sys ()
DRV - (BS_I2cIo) -- C:\WINDOWS\system32\drivers\BS_I2cIo.sys (BIOSTAR Group)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (ViPrt) -- C:\WINDOWS\system32\DRIVERS\ViPrt.sys (VIA Technologies, Inc.)
DRV - (ViBus) -- C:\WINDOWS\system32\DRIVERS\ViBus.sys (VIA Technologies, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (BS_Flash) -- C:\Program Files\Tseries BIOS Update\Award\BS_Flash.sys ()
DRV - (StarOpen) -- C:\WINDOWS\system32\drivers\StarOpen.sys ()
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (BIOS) -- C:\WINDOWS\system32\drivers\BIOS.sys (BIOSTAR Group)
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010.02.20 15:00:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

[2010.03.03 14:40:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\Mozilla\Extensions
[2010.03.03 14:40:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Butterfly\Data aplikací\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010.03.02 22:02:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.02.20 15:01:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
[2010.03.02 21:56:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\FirefoxPortable\App\Firefox\extensions
[2010.03.02 21:56:47 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\FirefoxPortable\App\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010.03.02 21:57:41 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\FirefoxPortable\Data\Profile\extensions
[2010.02.20 15:00:50 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2009.12.21 18:34:06 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2010.02.02 19:00:00 | 000,140,864 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
[2010.02.02 19:00:00 | 000,094,208 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll

O1 HOSTS File: ([2010.03.06 11:50:04 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Adresa) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
O3 - HKCU\..\Toolbar\WebBrowser: (&Adresa) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
O3 - HKCU\..\Toolbar\WebBrowser: (&Odkazy) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Butterfly\Nabídka Start\Programy\Po spuštění\HDDlife.lnk = C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe (BinarySense, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/ ... ontrol.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/ ... ontrol.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 6781085453 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.82.65 62.240.184.2
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\hddlife {BD758015-47D9-477A-8873-4B688A2BC0E2} - C:\Program Files\Common Files\BinarySense\hlAPP.dll (BinarySense, Inc.)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Proces mezipaměti kategorií součástí - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Nebe.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010.03.06 12:48:07 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Butterfly\Plocha\OTL.exe
[2010.03.06 12:20:30 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.03.06 12:20:30 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Butterfly\Recent
[2010.03.06 12:11:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Blizzard
[2010.03.06 12:08:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Blizzard Entertainment
[2010.03.06 11:09:22 | 000,017,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010.03.06 11:09:12 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010.03.06 11:09:02 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe
[2010.03.06 11:08:25 | 000,000,000 | ---D | C] -- C:\Program Files\BinarySense
[2010.03.06 10:44:52 | 001,131,176 | ---- | C] (Blizzard Entertainment) -- C:\Documents and Settings\Butterfly\Plocha\InstallWoW.exe
[2010.03.04 22:47:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM
[2010.03.04 22:47:10 | 001,826,816 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SkyTel.exe
[2010.03.04 22:47:10 | 001,191,936 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RtlUpd.exe
[2010.03.04 22:47:10 | 000,282,624 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\RTSndMgr.cpl
[2010.03.04 22:47:10 | 000,086,016 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SoundMan.exe
[2010.03.04 22:47:08 | 009,715,200 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTLCPL.exe
[2010.03.04 22:47:08 | 004,615,168 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys
[2010.03.04 22:47:04 | 002,165,760 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\MicCal.exe
[2010.03.04 22:47:02 | 002,808,832 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2010.03.04 22:47:02 | 000,299,008 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\ALSndMgr.cpl
[2010.03.04 22:47:02 | 000,069,632 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\Alcmtr.exe
[2010.03.04 22:47:02 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2010.03.04 22:46:44 | 000,319,488 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\HideWin.exe
[2010.03.04 22:11:44 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\framedyn.dll
[2010.03.04 22:11:33 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2010.03.04 22:09:28 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung
[2010.03.04 20:46:12 | 000,000,000 | ---D | C] -- C:\Program Files\Garena
[2010.03.04 20:32:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2010.03.04 18:32:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\DivX
[2010.03.04 18:02:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\Help
[2010.03.04 18:02:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\Help
[2010.03.04 17:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\All Ten Fingers
[2010.03.04 17:17:48 | 000,262,144 | ---- | C] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.03.04 17:17:48 | 000,086,016 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.03.04 17:16:19 | 000,012,744 | ---- | C] (EnTech Taiwan) -- C:\WINDOWS\System32\drivers\Entech64.sys
[2010.03.04 17:16:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Futuremark
[2010.03.04 17:14:27 | 000,000,000 | ---D | C] -- C:\Program Files\Futuremark
[2010.03.03 22:57:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\custom matrices
[2010.03.03 22:57:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\QuickTime
[2010.03.03 22:57:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\C2MP
[2010.03.03 22:54:08 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2010.03.03 22:54:08 | 000,185,920 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2010.03.03 22:54:08 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2010.03.03 22:54:08 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2010.03.03 22:53:59 | 000,151,552 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm
[2010.03.03 22:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2010.03.03 22:24:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\FreshDiagnose
[2010.03.03 21:57:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\0loqLkE0pHh
[2010.03.03 21:56:07 | 000,000,000 | ---D | C] -- C:\VIRTINS Multi-Instrument 3.2
[2010.03.03 21:55:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\PassMark
[2010.03.03 21:55:24 | 000,000,000 | ---D | C] -- C:\Program Files\SoundCheck
[2010.03.03 21:09:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Dokumenty\sctest
[2010.03.03 15:31:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\teamspeak2
[2010.03.03 14:44:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010.03.02 23:58:01 | 000,000,000 | ---D | C] -- C:\HLITE
[2010.03.02 22:47:24 | 031,113,168 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Documents and Settings\Butterfly\Dokumenty\wdm_r242.exe
[2010.03.02 22:04:19 | 000,000,000 | ---D | C] -- C:\Program Files\OperaPortable
[2010.03.02 22:04:19 | 000,000,000 | ---D | C] -- C:\Program Files\ChromePortable
[2010.03.02 22:04:18 | 000,000,000 | ---D | C] -- C:\Program Files\FirefoxPortable
[2010.03.01 21:36:36 | 000,000,000 | ---D | C] -- C:\Program Files\Prime95
[2010.03.01 21:31:50 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010.03.01 21:31:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\SystemRequirementsLab
[2010.03.01 21:16:53 | 000,360,580 | ---- | C] (eSellerate Inc.) -- C:\WINDOWS\eSellerateEngine.dll
[2010.03.01 21:16:53 | 000,000,000 | ---D | C] -- C:\Program Files\Hot CPU Tester Pro 4 LE
[2010.03.01 19:12:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Dokumenty\Zrychlení PC
[2010.03.01 18:36:17 | 000,000,000 | ---D | C] -- C:\Program Files\System Stability Tester
[2010.03.01 18:29:41 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\difxapi.dll
[2010.03.01 17:35:27 | 000,005,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\viaide.sys
[2010.03.01 15:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\Astroburn Lite
[2010.03.01 15:13:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\Astroburn Lite
[2010.03.01 15:12:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Astroburn Lite
[2010.02.28 22:24:33 | 000,691,696 | ---- | C] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.02.28 22:24:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\DAEMON Tools Lite
[2010.02.28 22:24:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2010.02.28 22:01:08 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2010.02.28 21:41:48 | 000,026,472 | ---- | C] (BIOSTAR Group) -- C:\WINDOWS\System32\drivers\BS_I2c64.sys
[2010.02.28 21:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\WarpSpeeder
[2010.02.28 21:38:34 | 000,102,912 | R--- | C] (Zeal SoftStudio) -- C:\WINDOWS\System32\Ntport.dll
[2010.02.28 21:38:34 | 000,006,080 | ---- | C] (Zeal SoftStudio) -- C:\WINDOWS\System32\drivers\zntport.sys
[2010.02.28 21:38:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64
[2010.02.28 21:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\ITE
[2010.02.28 21:04:13 | 000,000,000 | ---D | C] -- C:\Program Files\PKR
[2010.02.28 20:58:27 | 000,000,000 | ---D | C] -- C:\MFT 2867
[2010.02.28 15:36:57 | 000,000,000 | ---D | C] -- C:\Program Files\Valve
[2010.02.28 14:40:35 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2010.02.28 14:38:38 | 000,356,352 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\NVUNINST.EXE
[2010.02.28 14:23:24 | 000,000,000 | ---D | C] -- C:\Program Files\BIOS Update
[2010.02.27 14:58:54 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_6.dll
[2010.02.27 14:58:54 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_4.dll
[2010.02.27 14:58:53 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_6.dll
[2010.02.27 14:58:53 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_7.dll
[2010.02.27 14:58:52 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_42.dll
[2010.02.27 14:58:52 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_5.dll
[2010.02.27 14:58:52 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_5.dll
[2010.02.27 14:58:46 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dcsx_42.dll
[2010.02.27 14:58:45 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_42.dll
[2010.02.27 14:58:45 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx11_42.dll
[2010.02.27 14:58:44 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_42.dll
[2010.02.27 14:58:43 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_41.dll
[2010.02.27 14:58:43 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_41.dll
[2010.02.27 14:58:43 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_41.dll
[2010.02.27 14:58:42 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_4.dll
[2010.02.27 14:58:42 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_3.dll
[2010.02.27 14:58:41 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_4.dll
[2010.02.27 14:58:40 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_40.dll
[2010.02.27 14:58:40 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_6.dll
[2010.02.27 14:58:39 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_3.dll
[2010.02.27 14:58:39 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_3.dll
[2010.02.27 14:58:39 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_2.dll
[2010.02.27 14:58:38 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_2.dll
[2010.02.27 14:58:38 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_1.dll
[2010.02.27 14:58:38 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_5.dll
[2010.02.27 14:58:37 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_39.dll
[2010.02.27 14:58:37 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_2.dll
[2010.02.27 14:58:36 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_1.dll
[2010.02.27 14:58:36 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_1.dll
[2010.02.27 14:58:36 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_0.dll
[2010.02.27 14:58:36 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_4.dll
[2010.02.27 14:58:35 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_38.dll
[2010.02.27 14:58:35 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_0.dll
[2010.02.27 14:58:34 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_0.dll
[2010.02.27 14:58:34 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_3.dll
[2010.02.27 14:58:33 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_37.dll
[2010.02.27 14:58:32 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_36.dll
[2010.02.27 14:58:32 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_10.dll
[2010.02.27 14:58:31 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_9.dll
[2010.02.27 14:58:30 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_35.dll
[2010.02.27 14:58:29 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_34.dll
[2010.02.27 14:58:29 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_8.dll
[2010.02.27 14:58:29 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_2.dll
[2010.02.27 14:58:28 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_7.dll
[2010.02.27 14:58:28 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_3.dll
[2010.02.27 14:58:26 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_33.dll
[2010.02.27 14:58:26 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_33.dll
[2010.02.27 14:58:24 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_33.dll
[2010.02.27 14:58:24 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_6.dll
[2010.02.27 14:58:23 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_32.dll
[2010.02.27 14:58:23 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_5.dll
[2010.02.27 14:58:23 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_4.dll
[2010.02.27 14:58:23 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_1.dll
[2010.02.27 14:58:22 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_31.dll
[2010.02.27 14:58:22 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_3.dll
[2010.02.27 14:58:21 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_2.dll
[2010.02.27 14:58:21 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_2.dll
[2010.02.27 14:58:21 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_1.dll
[2010.02.27 14:58:20 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_30.dll
[2010.02.27 14:58:20 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_0.dll
[2010.02.27 14:58:20 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_1.dll
[2010.02.27 14:58:20 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_0.dll
[2010.02.27 14:58:19 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_29.dll
[2010.02.27 14:58:19 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_28.dll
[2010.02.27 14:58:18 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_27.dll
[2010.02.27 14:58:18 | 000,061,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput9_1_0.dll
[2010.02.27 14:58:17 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_25.dll
[2010.02.27 14:58:17 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_26.dll
[2010.02.27 14:58:16 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_24.dll
[2010.02.27 14:54:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2010.02.27 14:16:34 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dwmapi.dll
[2010.02.27 12:00:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\GlarySoft
[2010.02.27 11:56:06 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
[2010.02.27 11:16:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\Speeditup Free
[2010.02.27 11:16:14 | 000,000,000 | ---D | C] -- C:\Program Files\Speeditup Free
[2010.02.27 10:19:37 | 000,029,512 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\TURegOpt.exe
[2010.02.27 10:19:35 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2010.02.27 10:18:33 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010
[2010.02.27 10:07:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010.02.27 10:04:58 | 000,162,512 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010.02.27 10:04:58 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010.02.27 10:04:57 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010.02.27 10:04:56 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010.02.27 10:04:54 | 000,100,432 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010.02.27 10:04:54 | 000,094,800 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010.02.27 10:04:54 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010.02.27 10:04:29 | 000,153,184 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010.02.27 10:04:29 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr
[2010.02.25 21:28:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.02.25 21:28:44 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.02.24 19:07:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data
[2010.02.24 17:14:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\CheckPoint
[2010.02.24 17:13:53 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010.02.23 20:47:38 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Butterfly\IECompatCache
[2010.02.22 15:10:55 | 000,000,000 | ---D | C] -- C:\Program Files\Motherboard Monitor 5
[2010.02.22 14:57:56 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2010.02.22 14:57:56 | 000,017,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2010.02.21 21:11:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010.02.21 14:14:14 | 000,000,000 | ---D | C] -- C:\Program Files\WhoCrashed
[2010.02.21 14:08:19 | 000,000,000 | ---D | C] -- C:\Genius
[2010.02.21 14:08:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\InstallShield
[2010.02.21 13:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\PCHealth
[2010.02.21 12:53:14 | 000,052,224 | R--- | C] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\drivers\ViPrt.sys
[2010.02.21 12:53:10 | 000,018,432 | R--- | C] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\vIdeInst.dll
[2010.02.21 12:53:09 | 000,016,896 | R--- | C] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\drivers\ViBus.sys
[2010.02.21 12:52:41 | 000,068,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pci.sys
[2010.02.21 12:52:36 | 000,037,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isapnp.sys
[2010.02.21 12:47:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\vnDrvBas
[2010.02.21 12:44:30 | 000,105,088 | R--- | C] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\drivers\Rtnicxp.sys
[2010.02.21 12:44:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\OPTIONS
[2010.02.21 12:42:13 | 000,306,688 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUninst.exe
[2010.02.21 11:40:20 | 000,181,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[2010.02.21 11:30:02 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
[2010.02.21 09:50:01 | 001,985,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
[2010.02.21 09:50:01 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010.02.21 09:49:59 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010.02.21 09:49:56 | 011,070,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2010.02.20 23:05:23 | 000,000,000 | ---D | C] -- C:\Program Files\TrackMania Nations ESWC
[2010.02.20 15:22:36 | 000,299,520 | ---- | C] (InstallShield Corporation, Inc.) -- C:\WINDOWS\uninst.exe
[2010.02.20 15:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\Data aplikací\WinPatrol
[2010.02.20 15:22:12 | 000,000,000 | ---D | C] -- C:\Program Files\BillP Studios
[2010.02.20 15:21:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Butterfly\WINDOWS
[2010.02.20 15:01:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010.02.20 15:01:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.02.20 15:01:13 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.02.20 15:01:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.02.20 15:01:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.02.20 15:01:13 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.02.20 15:00:46 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010.02.20 14:52:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Sun
[2010.02.20 14:51:16 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010.02.20 14:38:02 | 000,976,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
[2010.02.20 11:33:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft
[2010.02.12 16:00:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Data aplikací\TuneUp Software
[2010.02.09 22:20:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft
[2010.02.09 22:16:42 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Data aplikací\Microsoft
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

Re: Prosím o kontrolu logu - 2 Trojani Hiloti

Napsal: 06 bře 2010 13:29
od martin.efres
OTL LOG ČÁST DRUHÁ :

========== Files - Modified Within 14 Days ==========

[2010.03.06 12:48:10 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Butterfly\Plocha\OTL.exe
[2010.03.06 12:11:22 | 000,000,882 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\World of Warcraft Installer.lnk
[2010.03.06 11:51:22 | 000,000,494 | ---- | M] () -- C:\WINDOWS\tasks\Automatic troubleshooting.job
[2010.03.06 11:50:58 | 000,000,841 | ---- | M] () -- C:\Documents and Settings\Butterfly\Nabídka Start\Programy\Po spuštění\HDDlife.lnk
[2010.03.06 11:50:51 | 000,000,246 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.03.06 11:50:35 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.03.06 11:50:25 | 000,271,671 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.03.06 11:50:04 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.03.06 11:49:38 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.03.06 11:49:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.03.06 11:47:52 | 004,194,304 | ---- | M] () -- C:\Documents and Settings\Butterfly\NTUSER.DAT
[2010.03.06 11:47:52 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Butterfly\ntuser.ini
[2010.03.06 11:12:30 | 000,004,608 | ---- | M] () -- C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.06 10:44:56 | 001,131,176 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Butterfly\Plocha\InstallWoW.exe
[2010.03.06 09:38:45 | 000,000,474 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1B255865-963C-43CA-8CB9-18642688F034}.job
[2010.03.04 23:48:54 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\HiJackThis.lnk
[2010.03.04 22:46:44 | 000,319,488 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\HideWin.exe
[2010.03.04 22:36:48 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2010.03.04 22:12:00 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Data aplikací\LauncherAccess.dt
[2010.03.04 22:10:45 | 000,000,673 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Samsung PC Studio 3.lnk
[2010.03.04 17:59:19 | 000,000,712 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\All Ten Fingers.lnk
[2010.03.04 17:17:48 | 000,262,144 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.03.04 17:17:48 | 000,086,016 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.03.03 21:56:25 | 000,000,628 | ---- | M] () -- C:\Documents and Settings\Butterfly\Dokumenty\MI.lnk
[2010.03.03 21:55:24 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\Butterfly\Dokumenty\SoundCheck.lnk
[2010.03.03 20:23:48 | 000,268,600 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.03.03 18:17:24 | 000,069,624 | ---- | M] () -- C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.03.03 18:17:24 | 000,003,298 | ---- | M] () -- C:\WINDOWS\System32\StyleVista.png
[2010.03.03 18:17:24 | 000,003,137 | ---- | M] () -- C:\WINDOWS\System32\StyleVistaDown.png
[2010.03.03 18:09:19 | 000,001,375 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Counter-Strike 1.6.lnk
[2010.03.03 14:42:23 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\Firefox Portable.lnk
[2010.03.03 14:13:45 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\CCleaner.lnk
[2010.03.02 22:48:50 | 031,113,168 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Documents and Settings\Butterfly\Dokumenty\wdm_r242.exe
[2010.03.02 17:36:20 | 000,000,418 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\My !.lnk
[2010.03.01 17:06:41 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Adobe Reader 9.lnk
[2010.03.01 16:46:58 | 000,001,503 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\Malování.lnk
[2010.03.01 15:13:13 | 000,001,637 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Astroburn Lite.lnk
[2010.03.01 14:57:43 | 000,001,498 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\Kalkulačka.lnk
[2010.02.28 22:24:33 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.02.28 22:08:43 | 000,305,152 | ---- | M] () -- C:\Documents and Settings\Butterfly\Dokumenty\windiag.iso
[2010.02.28 21:04:13 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\Play PKR.lnk
[2010.02.27 18:28:27 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\Butterfly\Dokumenty\urolithiasa1.doc
[2010.02.27 13:35:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.02.27 10:28:04 | 003,932,160 | ---- | M] () -- C:\Documents and Settings\Butterfly\NTUSER.DAT_tureg_old
[2010.02.27 10:19:32 | 000,001,731 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\TuneUp 1-Click Maintenance.lnk
[2010.02.27 10:19:32 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\TuneUp Utilities.lnk
[2010.02.27 10:04:59 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\avast! Free Antivirus.lnk
[2010.02.27 10:04:55 | 000,002,553 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010.02.27 09:58:18 | 000,000,603 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.02.27 09:58:18 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010.02.26 20:53:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010.02.25 22:18:23 | 004,802,342 | -H-- | M] () -- C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\IconCache.db
[2010.02.25 21:28:49 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.02.24 17:13:48 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.02.23 20:44:31 | 000,002,563 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\Microsoft Office Word 2007.lnk
[2010.02.23 19:01:45 | 000,800,036 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.02.23 19:01:45 | 000,339,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.02.23 19:01:45 | 000,337,152 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.02.23 19:01:45 | 000,061,056 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.02.23 19:01:45 | 000,052,104 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.02.20 23:08:03 | 000,000,852 | ---- | M] () -- C:\Documents and Settings\Butterfly\Plocha\TrackMania Nations ESWC.lnk
[2010.02.20 15:00:50 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010.02.20 15:00:50 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.02.20 15:00:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.02.20 15:00:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.02.20 15:00:50 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.03.06 12:11:22 | 000,000,882 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\World of Warcraft Installer.lnk
[2010.03.06 11:08:38 | 000,000,841 | ---- | C] () -- C:\Documents and Settings\Butterfly\Nabídka Start\Programy\Po spuštění\HDDlife.lnk
[2010.03.04 22:47:35 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010.03.04 22:12:00 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\LauncherAccess.dt
[2010.03.04 22:11:00 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.03.04 22:10:45 | 000,000,673 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Samsung PC Studio 3.lnk
[2010.03.04 20:33:07 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2010.03.04 17:59:19 | 000,000,712 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\All Ten Fingers.lnk
[2010.03.04 17:16:19 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2010.03.04 17:16:18 | 000,006,173 | ---- | C] () -- C:\WINDOWS\System32\drivers\Entech.vxd
[2010.03.03 22:54:06 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.03.03 22:53:56 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2010.03.03 21:56:25 | 000,000,628 | ---- | C] () -- C:\Documents and Settings\Butterfly\Dokumenty\MI.lnk
[2010.03.03 21:55:24 | 000,000,650 | ---- | C] () -- C:\Documents and Settings\Butterfly\Dokumenty\SoundCheck.lnk
[2010.03.03 18:17:24 | 000,003,298 | ---- | C] () -- C:\WINDOWS\System32\StyleVista.png
[2010.03.03 18:17:24 | 000,003,137 | ---- | C] () -- C:\WINDOWS\System32\StyleVistaDown.png
[2010.03.03 18:09:19 | 000,001,375 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Counter-Strike 1.6.lnk
[2010.03.03 14:42:23 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\Firefox Portable.lnk
[2010.03.02 17:36:19 | 000,000,418 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\My !.lnk
[2010.03.01 15:13:13 | 000,001,637 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Astroburn Lite.lnk
[2010.03.01 14:57:43 | 000,001,498 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\Kalkulačka.lnk
[2010.02.28 21:38:31 | 000,046,080 | R--- | C] () -- C:\WINDOWS\System32\itevio.dll
[2010.02.28 21:04:13 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\Play PKR.lnk
[2010.02.27 19:14:17 | 000,001,503 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\Malování.lnk
[2010.02.27 18:28:27 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Butterfly\Dokumenty\urolithiasa1.doc
[2010.02.27 11:54:41 | 000,305,152 | ---- | C] () -- C:\Documents and Settings\Butterfly\Dokumenty\windiag.iso
[2010.02.27 10:19:42 | 000,000,494 | ---- | C] () -- C:\WINDOWS\tasks\Automatic troubleshooting.job
[2010.02.27 10:19:32 | 000,001,731 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\TuneUp 1-Click Maintenance.lnk
[2010.02.27 10:19:32 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\TuneUp Utilities.lnk
[2010.02.27 10:04:59 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\avast! Free Antivirus.lnk
[2010.02.26 20:53:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.02.25 21:28:49 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.02.24 17:13:48 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.02.23 19:10:50 | 000,000,474 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1B255865-963C-43CA-8CB9-18642688F034}.job
[2010.02.21 14:09:47 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\drivers\gHidPnp.sys
[2010.02.21 14:09:47 | 000,011,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\gMouUsb.sys
[2010.02.21 13:47:52 | 000,061,440 | ---- | C] () -- C:\WINDOWS\String.dll
[2010.02.21 13:47:52 | 000,040,960 | ---- | C] () -- C:\WINDOWS\StopHid.exe
[2010.02.21 13:47:52 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2010.02.21 13:47:52 | 000,004,016 | ---- | C] () -- C:\WINDOWS\mHotkey.reg
[2010.02.21 13:47:51 | 000,550,912 | ---- | C] () -- C:\WINDOWS\mHotkey.exe
[2010.02.21 13:47:51 | 000,536,064 | ---- | C] () -- C:\WINDOWS\SETFORM.exe
[2010.02.21 13:47:51 | 000,294,912 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2010.02.21 13:47:51 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2010.02.21 13:47:51 | 000,005,280 | ---- | C] () -- C:\WINDOWS\hotbtnv.vxd
[2010.02.21 13:47:51 | 000,005,085 | ---- | C] () -- C:\WINDOWS\hotbtnv2.vxd
[2010.02.20 23:08:03 | 000,000,852 | ---- | C] () -- C:\Documents and Settings\Butterfly\Plocha\TrackMania Nations ESWC.lnk
[2010.02.17 20:01:34 | 000,004,940 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\mtbjfghn.xbe
[2010.02.17 15:51:08 | 000,003,604 | ---- | C] () -- C:\WINDOWS\System32\drivers\BS_Flash.sys
[2010.02.12 22:46:02 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Butterfly\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.02.10 20:46:28 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\M2000Twn.dll
[2010.02.10 20:46:26 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\CompressATI2.dll
[2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008.05.26 21:33:08 | 003,607,040 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2008.05.26 21:33:08 | 000,741,376 | ---- | C] () -- C:\WINDOWS\System32\audxlib.dll
[2008.05.26 21:33:08 | 000,711,168 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008.05.26 21:33:08 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2008.05.26 21:33:08 | 000,455,680 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2008.05.26 21:33:08 | 000,245,760 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
[2008.05.26 21:33:08 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2008.05.26 21:33:08 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
[2008.05.26 21:33:08 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
[2008.05.26 21:33:08 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2008.05.26 21:33:08 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
[2008.05.26 21:33:08 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
[2008.05.26 21:33:08 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2008.05.26 21:33:08 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll
[2008.05.26 21:33:08 | 000,081,408 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
[2008.05.26 21:33:08 | 000,041,984 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
[2008.05.26 21:33:08 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
[2008.05.26 21:33:08 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2008.05.26 21:33:08 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008.03.29 16:42:22 | 000,245,248 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
[2008.03.29 16:42:20 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
[2008.03.29 16:42:14 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
[2008.03.29 16:42:08 | 000,148,992 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
[2008.03.29 16:42:04 | 000,141,312 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
[2008.03.29 16:42:04 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
[2008.03.29 16:42:02 | 000,120,832 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
[2008.03.29 16:42:00 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
[2008.03.29 16:41:54 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
[2008.03.29 16:41:52 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2008.03.29 16:41:52 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2008.03.21 21:30:08 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.03.21 21:28:54 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.03.21 21:28:54 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2007.10.13 10:30:20 | 000,000,137 | ---- | C] () -- C:\WINDOWS\System32\Registration.ini
[2007.06.28 19:54:10 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006.01.08 15:53:24 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\hash2.dll
[2005.10.14 11:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 11:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005.10.14 11:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005.10.14 11:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005.10.14 11:56:50 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005.10.14 11:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll

========== LOP Check ==========

[2010.03.03 21:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\0loqLkE0pHh
[2010.02.16 22:52:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
[2010.03.01 15:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Astroburn Lite
[2010.02.28 22:24:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2010.02.10 20:19:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.02.10 21:12:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ICQ
[2010.03.03 21:55:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PassMark
[2010.03.06 11:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2010.02.12 17:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
[2010.02.12 15:50:06 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.03.01 15:13:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\Astroburn Lite
[2010.02.11 20:56:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\BinarySense
[2010.02.27 10:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\CheckPoint
[2010.02.28 22:45:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\DAEMON Tools Lite
[2010.02.10 20:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\ESET
[2010.03.03 22:27:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\FreshDiagnose
[2010.02.20 09:27:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\GetRightToGo
[2010.02.28 13:35:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\GlarySoft
[2010.02.10 21:13:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\ICQ
[2010.02.12 05:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\Opera
[2010.02.12 15:52:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\TuneUp Software
[2010.02.13 10:32:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\Uniblue
[2010.02.20 15:22:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Butterfly\Data aplikací\WinPatrol
[2010.03.06 11:51:22 | 000,000,494 | ---- | M] () -- C:\WINDOWS\Tasks\Automatic troubleshooting.job
[2010.03.06 09:38:45 | 000,000,474 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1B255865-963C-43CA-8CB9-18642688F034}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:2BE9FEFC
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:3D29BF00
< End of report >
Časové pásmo: UTC+02:00
Stránka 1 z 2
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/