PC-HELP.CZ

Prosím o kontrolu logu. Pomalá práce na PC včetně sur.po internetu. AVG nehlásí žádný problém .Děkuji S pozdravem Z.Kucler

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:50:31, on 20.10.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Zdeněk - Kucler\Local Settings\Temporary Internet Files\Content.IE5\L11IT2CC\HijackThis[1].exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = About:Blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = About:Blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll
O2 - BHO: Google Toolbar Helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [ROC_ROC_JULY_P1] "C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1
O4 - HKLM\..\Run: [Garmin Lifetime Updater] C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - F:\KRISTYNA\aplikace\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - F:\KRISTYNA\aplikace\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/4.0 ... rol_32.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O16 - DPF: {5F509E42-537E-482B-B66C-145BC170054C} (PhotoUploader Control) - http://sberna.fotostar.cz/snadno-vlozit ... loader.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2688612968
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
O20 - AppInit_DLLs: winmm.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.0\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.0\system32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Služba inteligentního přenosu na pozadí (BITS) (BITS) - Unknown owner - C:\WINDOWS.0\
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service (icq service) - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: vToolbarUpdater12.2.6 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
O23 - Service: Automatické aktualizace (wuauserv) - Unknown owner - C:\WINDOWS.0\

--
End of file - 12247 bytes

Vítej na fóru PC-Help.cz,

Aktualizuj AVG na verzi 2013. Verze 2011 je přeci jen staršího data (2 roky zpět) a nemusí detekovat nové hrozby.

Odinstaluj:
ICQToolBar
AVG Security Toolbar
Google Toolbar
Megaupload Toolbar

Fixni:



Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

===================================================

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Řádky, tykající se odinstalovaných aplikací, nebylo možné zafixovat. Ostatní provedené dle popisu. Dále nainstalována nová verze AVG 2013, nalezeny 3 potenciální hrozby v JAVA = Trojský kůň Java/exploit.BU. Přesunuto do virového trezoru bez potíží.

Log z Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.10.21.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Zdeněk - Kucler :: KUCLER-9CCB7FB5 [administrátor]

Ochrana: Povolena

21.10.2012 19:40:35
mbam-log-2012-10-21 (19-40-35).txt

Typ: Vlastní kontrola (C:\Documents and Settings\Zdeněk - Kucler\Plocha\HiJackThis.lnk|)
Nastavení kontroly povoleno: Systémové soubory | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: Paměť | Po spuštění | Registr | Heuristická analýza Extra | P2P
Kontrolované objekty: 1
Uplynulý čas: 16 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Stáhni si TDSSKiller

Na svojí plochu. Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

Log z TDSSKiller, z Combofix v následném příspěvku:


2012/10/22 06:51:32.0078 2152 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2012/10/22 06:51:33.0390 2152 ================================================================================
2012/10/22 06:51:33.0390 2152 SystemInfo:
2012/10/22 06:51:33.0390 2152
2012/10/22 06:51:33.0390 2152 OS Version: 5.1.2600 ServicePack: 3.0
2012/10/22 06:51:33.0390 2152 Product type: Workstation
2012/10/22 06:51:33.0390 2152 ComputerName: KUCLER-9CCB7FB5
2012/10/22 06:51:33.0390 2152 UserName: Zdeněk - Kucler
2012/10/22 06:51:33.0390 2152 Windows directory: C:\WINDOWS.0
2012/10/22 06:51:33.0390 2152 System windows directory: C:\WINDOWS.0
2012/10/22 06:51:33.0390 2152 Processor architecture: Intel x86
2012/10/22 06:51:33.0390 2152 Number of processors: 2
2012/10/22 06:51:33.0390 2152 Page size: 0x1000
2012/10/22 06:51:33.0390 2152 Boot type: Normal boot
2012/10/22 06:51:33.0390 2152 ================================================================================
2012/10/22 06:51:33.0859 2152 Initialize success
2012/10/22 06:51:47.0609 3992 ================================================================================
2012/10/22 06:51:47.0609 3992 Scan started
2012/10/22 06:51:47.0609 3992 Mode: Manual;
2012/10/22 06:51:47.0609 3992 ================================================================================
2012/10/22 06:51:48.0875 3992 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS.0\system32\DRIVERS\ACPI.sys
2012/10/22 06:51:49.0000 3992 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS.0\system32\drivers\ACPIEC.sys
2012/10/22 06:51:49.0234 3992 aeaudio (e696e749bedcda8b23757b8b5ea93780) C:\WINDOWS.0\system32\drivers\aeaudio.sys
2012/10/22 06:51:49.0406 3992 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS.0\system32\drivers\aec.sys
2012/10/22 06:51:49.0578 3992 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS.0\System32\drivers\afd.sys
2012/10/22 06:51:49.0781 3992 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS.0\system32\DRIVERS\agp440.sys
2012/10/22 06:51:50.0859 3992 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS.0\system32\DRIVERS\asyncmac.sys
2012/10/22 06:51:50.0984 3992 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS.0\system32\DRIVERS\atapi.sys
2012/10/22 06:51:51.0250 3992 ati2mtag (fb4768173f1cc4d1af9e1f78b7b82d53) C:\WINDOWS.0\system32\DRIVERS\ati2mtag.sys
2012/10/22 06:51:51.0453 3992 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS.0\system32\DRIVERS\atmarpc.sys
2012/10/22 06:51:51.0625 3992 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS.0\system32\DRIVERS\audstub.sys
2012/10/22 06:51:51.0812 3992 Avgfwdx (8be661c16fbf84a73bcec84b6b4a9db5) C:\WINDOWS.0\system32\DRIVERS\avgfwdx.sys
2012/10/22 06:51:51.0843 3992 Avgfwfd (8be661c16fbf84a73bcec84b6b4a9db5) C:\WINDOWS.0\system32\DRIVERS\avgfwdx.sys
2012/10/22 06:51:52.0015 3992 AVGIDSDriver (2f47851015d8837976e481f6daa46a67) C:\WINDOWS.0\system32\DRIVERS\avgidsdriverx.sys
2012/10/22 06:51:52.0187 3992 AVGIDSHX (303bde0dcdc04ce597c6c1cd06c6f186) C:\WINDOWS.0\system32\DRIVERS\avgidshx.sys
2012/10/22 06:51:52.0359 3992 AVGIDSShim (a8de230cc8536790ca07d37fbcd87a74) C:\WINDOWS.0\system32\DRIVERS\avgidsshimx.sys
2012/10/22 06:51:52.0500 3992 Avgldx86 (d53d35031365a0eccb1dc1bc1b15b18e) C:\WINDOWS.0\system32\DRIVERS\avgldx86.sys
2012/10/22 06:51:52.0718 3992 Avglogx (95889a9d23f3133250fa8ad13c982d58) C:\WINDOWS.0\system32\DRIVERS\avglogx.sys
2012/10/22 06:51:52.0890 3992 Avgmfx86 (6df7236d3a16c8417ff72f2eb2add244) C:\WINDOWS.0\system32\DRIVERS\avgmfx86.sys
2012/10/22 06:51:53.0062 3992 Avgrkx86 (f3d57358de0b8b3491013c615754a7c7) C:\WINDOWS.0\system32\DRIVERS\avgrkx86.sys
2012/10/22 06:51:53.0234 3992 Avgtdix (ba73b38e9033fc6018db736b635706ae) C:\WINDOWS.0\system32\DRIVERS\avgtdix.sys
2012/10/22 06:51:53.0390 3992 avgtp (008fe10ed973699b46b4308ed73f5098) C:\WINDOWS.0\system32\drivers\avgtpx86.sys
2012/10/22 06:51:53.0531 3992 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS.0\system32\drivers\Beep.sys
2012/10/22 06:51:53.0734 3992 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS.0\system32\drivers\cbidf2k.sys
2012/10/22 06:51:53.0984 3992 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS.0\system32\drivers\Cdaudio.sys
2012/10/22 06:51:54.0125 3992 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS.0\system32\drivers\Cdfs.sys
2012/10/22 06:51:54.0250 3992 cdrbsdrv (351735695e9ead93de6af85d8beb1ca8) C:\WINDOWS.0\system32\drivers\cdrbsdrv.sys
2012/10/22 06:51:54.0375 3992 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS.0\system32\DRIVERS\cdrom.sys
2012/10/22 06:51:55.0093 3992 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS.0\system32\DRIVERS\disk.sys
2012/10/22 06:51:55.0328 3992 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS.0\system32\drivers\dmboot.sys
2012/10/22 06:51:55.0625 3992 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS.0\system32\drivers\dmio.sys
2012/10/22 06:51:55.0781 3992 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS.0\system32\drivers\dmload.sys
2012/10/22 06:51:55.0984 3992 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS.0\system32\drivers\DMusic.sys
2012/10/22 06:51:56.0281 3992 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS.0\system32\drivers\drmkaud.sys
2012/10/22 06:51:56.0468 3992 E100B (98b46b331404a951cabad8b4877e1276) C:\WINDOWS.0\system32\DRIVERS\e100b325.sys
2012/10/22 06:51:56.0703 3992 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS.0\system32\drivers\Fastfat.sys
2012/10/22 06:51:56.0906 3992 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS.0\system32\DRIVERS\fdc.sys
2012/10/22 06:51:57.0062 3992 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS.0\system32\drivers\Fips.sys
2012/10/22 06:51:57.0234 3992 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS.0\system32\DRIVERS\flpydisk.sys
2012/10/22 06:51:57.0437 3992 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS.0\system32\drivers\fltmgr.sys
2012/10/22 06:51:57.0640 3992 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS.0\system32\drivers\Fs_Rec.sys
2012/10/22 06:51:57.0843 3992 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS.0\system32\DRIVERS\ftdisk.sys
2012/10/22 06:51:58.0046 3992 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS.0\system32\DRIVERS\msgpc.sys
2012/10/22 06:51:58.0250 3992 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS.0\system32\DRIVERS\hidusb.sys
2012/10/22 06:51:58.0468 3992 HSFHWBS2 (970178e8e003eb1481293830069624b9) C:\WINDOWS.0\system32\DRIVERS\HSFBS2S2.sys
2012/10/22 06:51:58.0750 3992 HSF_DP (ebb354438a4c5a3327fb97306260714a) C:\WINDOWS.0\system32\DRIVERS\HSFDPSP2.sys
2012/10/22 06:51:58.0968 3992 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS.0\system32\Drivers\HTTP.sys
2012/10/22 06:51:59.0343 3992 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS.0\system32\DRIVERS\i8042prt.sys
2012/10/22 06:51:59.0562 3992 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS.0\system32\DRIVERS\imapi.sys
2012/10/22 06:51:59.0843 3992 IntelIde (57d928e548b38502abba7a77a6eb7312) C:\WINDOWS.0\system32\DRIVERS\intelide.sys
2012/10/22 06:52:00.0015 3992 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS.0\system32\DRIVERS\intelppm.sys
2012/10/22 06:52:00.0171 3992 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS.0\system32\drivers\ip6fw.sys
2012/10/22 06:52:00.0296 3992 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS.0\system32\DRIVERS\ipfltdrv.sys
2012/10/22 06:52:00.0531 3992 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS.0\system32\DRIVERS\ipinip.sys
2012/10/22 06:52:00.0718 3992 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS.0\system32\DRIVERS\ipnat.sys
2012/10/22 06:52:00.0921 3992 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS.0\system32\DRIVERS\ipsec.sys
2012/10/22 06:52:01.0093 3992 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS.0\system32\DRIVERS\irenum.sys
2012/10/22 06:52:01.0234 3992 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS.0\system32\DRIVERS\isapnp.sys
2012/10/22 06:52:01.0390 3992 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS.0\system32\DRIVERS\kbdclass.sys
2012/10/22 06:52:01.0562 3992 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS.0\system32\drivers\kmixer.sys
2012/10/22 06:52:01.0781 3992 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS.0\system32\drivers\KSecDD.sys
2012/10/22 06:52:01.0984 3992 kvpndev (36bbd6a7d86afae8fb6680c6e40dbc02) C:\WINDOWS.0\system32\DRIVERS\kvpndrv.sys
2012/10/22 06:52:02.0421 3992 MBAMProtector (500d089ce760d83da2b6cba681aa9949) C:\WINDOWS.0\system32\drivers\mbam.sys
2012/10/22 06:52:02.0640 3992 mdmxsdk (195741aee20369980796b557358cd774) C:\WINDOWS.0\system32\DRIVERS\mdmxsdk.sys
2012/10/22 06:52:02.0812 3992 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS.0\system32\drivers\mnmdd.sys
2012/10/22 06:52:02.0937 3992 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS.0\system32\drivers\Modem.sys
2012/10/22 06:52:03.0046 3992 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS.0\system32\DRIVERS\mouclass.sys
2012/10/22 06:52:03.0156 3992 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS.0\system32\DRIVERS\mouhid.sys
2012/10/22 06:52:03.0312 3992 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS.0\system32\drivers\MountMgr.sys
2012/10/22 06:52:03.0625 3992 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS.0\system32\DRIVERS\mrxdav.sys
2012/10/22 06:52:03.0843 3992 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS.0\system32\DRIVERS\mrxsmb.sys
2012/10/22 06:52:04.0046 3992 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS.0\system32\drivers\Msfs.sys
2012/10/22 06:52:04.0218 3992 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS.0\system32\drivers\MSKSSRV.sys
2012/10/22 06:52:04.0328 3992 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS.0\system32\drivers\MSPCLOCK.sys
2012/10/22 06:52:04.0468 3992 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS.0\system32\drivers\MSPQM.sys
2012/10/22 06:52:04.0671 3992 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS.0\system32\DRIVERS\mssmbios.sys
2012/10/22 06:52:04.0812 3992 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS.0\system32\drivers\Mup.sys
2012/10/22 06:52:05.0000 3992 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS.0\system32\drivers\NDIS.sys
2012/10/22 06:52:05.0171 3992 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS.0\system32\DRIVERS\ndistapi.sys
2012/10/22 06:52:05.0343 3992 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS.0\system32\DRIVERS\ndisuio.sys
2012/10/22 06:52:05.0484 3992 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS.0\system32\DRIVERS\ndiswan.sys
2012/10/22 06:52:05.0656 3992 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS.0\system32\drivers\NDProxy.sys
2012/10/22 06:52:05.0781 3992 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS.0\system32\DRIVERS\netbios.sys
2012/10/22 06:52:05.0984 3992 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS.0\system32\DRIVERS\netbt.sys
2012/10/22 06:52:06.0187 3992 nmwcd (b0a67de1a128389aea4d42c5a56215fd) C:\WINDOWS.0\system32\drivers\ccdcmb.sys
2012/10/22 06:52:06.0343 3992 nmwcdc (025c54f9f8c8bc1894ea38529c742c54) C:\WINDOWS.0\system32\drivers\ccdcmbo.sys
2012/10/22 06:52:06.0515 3992 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS.0\system32\drivers\Npfs.sys
2012/10/22 06:52:06.0734 3992 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS.0\system32\drivers\Ntfs.sys
2012/10/22 06:52:06.0937 3992 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS.0\system32\drivers\Null.sys
2012/10/22 06:52:07.0062 3992 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS.0\system32\DRIVERS\nwlnkflt.sys
2012/10/22 06:52:07.0171 3992 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS.0\system32\DRIVERS\nwlnkfwd.sys
2012/10/22 06:52:07.0296 3992 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS.0\system32\DRIVERS\parport.sys
2012/10/22 06:52:07.0468 3992 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS.0\system32\drivers\PartMgr.sys
2012/10/22 06:52:07.0625 3992 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS.0\system32\drivers\ParVdm.sys
2012/10/22 06:52:07.0796 3992 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS.0\system32\DRIVERS\pccsmcfd.sys
2012/10/22 06:52:07.0921 3992 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS.0\system32\DRIVERS\pci.sys
2012/10/22 06:52:08.0187 3992 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS.0\system32\drivers\PCIIde.sys
2012/10/22 06:52:08.0359 3992 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS.0\system32\drivers\Pcmcia.sys
2012/10/22 06:52:08.0546 3992 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS.0\system32\Drivers\pcouffin.sys
2012/10/22 06:52:09.0406 3992 pfc (957b82ec80ad7ead64e5e47df6b0dc40) C:\WINDOWS.0\system32\drivers\pfc.sys
2012/10/22 06:52:09.0593 3992 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS.0\system32\DRIVERS\raspptp.sys
2012/10/22 06:52:09.0765 3992 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS.0\system32\DRIVERS\psched.sys
2012/10/22 06:52:09.0953 3992 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS.0\system32\DRIVERS\ptilink.sys
2012/10/22 06:52:10.0656 3992 QV2KUX (0087f01d35a65b32393cc8bba46ee4a6) C:\WINDOWS.0\system32\DRIVERS\qv2kux.sys
2012/10/22 06:52:10.0828 3992 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS.0\system32\DRIVERS\rasacd.sys
2012/10/22 06:52:11.0000 3992 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS.0\system32\DRIVERS\rasl2tp.sys
2012/10/22 06:52:11.0171 3992 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS.0\system32\DRIVERS\raspppoe.sys
2012/10/22 06:52:11.0343 3992 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS.0\system32\DRIVERS\raspti.sys
2012/10/22 06:52:11.0468 3992 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS.0\system32\DRIVERS\rdbss.sys
2012/10/22 06:52:11.0671 3992 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS.0\system32\DRIVERS\RDPCDD.sys
2012/10/22 06:52:11.0796 3992 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS.0\system32\drivers\RDPWD.sys
2012/10/22 06:52:11.0968 3992 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS.0\system32\DRIVERS\redbook.sys
2012/10/22 06:52:12.0171 3992 SE2Ebus (97ec6c60112ebd40c07fe295a38ab1ea) C:\WINDOWS.0\system32\DRIVERS\SE2Ebus.sys
2012/10/22 06:52:12.0296 3992 SE2Emdfl (abfe402ba200e82568a5606719397afa) C:\WINDOWS.0\system32\DRIVERS\SE2Emdfl.sys
2012/10/22 06:52:12.0421 3992 SE2Emdm (4acfe8a2a3c1624964429e83bc7148a4) C:\WINDOWS.0\system32\DRIVERS\SE2Emdm.sys
2012/10/22 06:52:12.0546 3992 SE2Emgmt (9b7d9390cc663e5352d965683f94a8f2) C:\WINDOWS.0\system32\DRIVERS\SE2Emgmt.sys
2012/10/22 06:52:12.0765 3992 se2End5 (76e23aa90d58fddeeabd32a33f357fa5) C:\WINDOWS.0\system32\DRIVERS\se2End5.sys
2012/10/22 06:52:12.0875 3992 SE2Eobex (baa5c376bd54bd3327a8680ae73b114b) C:\WINDOWS.0\system32\DRIVERS\SE2Eobex.sys
2012/10/22 06:52:13.0062 3992 se2Eunic (ee8208650571f71d430cf2da15c1f02a) C:\WINDOWS.0\system32\DRIVERS\se2Eunic.sys
2012/10/22 06:52:13.0171 3992 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS.0\system32\DRIVERS\secdrv.sys
2012/10/22 06:52:13.0296 3992 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS.0\system32\DRIVERS\serenum.sys
2012/10/22 06:52:13.0437 3992 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS.0\system32\DRIVERS\serial.sys
2012/10/22 06:52:13.0625 3992 sf (e8cc4ba7b2e962bd932c7bf678e762e0) C:\WINDOWS.0\system32\drivers\sf.sys
2012/10/22 06:52:13.0828 3992 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS.0\system32\drivers\Sfloppy.sys
2012/10/22 06:52:14.0062 3992 SMBios (13d149d7114a72dace8464b8464b7767) C:\WINDOWS.0\system32\DRIVERS\SMBios.sys
2012/10/22 06:52:14.0281 3992 smwdm (7d9b50329af9fd94b0529282530d2cb7) C:\WINDOWS.0\system32\drivers\smwdm.sys
2012/10/22 06:52:14.0609 3992 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS.0\system32\drivers\splitter.sys
2012/10/22 06:52:14.0750 3992 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS.0\system32\DRIVERS\sr.sys
2012/10/22 06:52:14.0906 3992 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS.0\system32\DRIVERS\srv.sys
2012/10/22 06:52:15.0109 3992 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS.0\system32\DRIVERS\swenum.sys
2012/10/22 06:52:15.0234 3992 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS.0\system32\drivers\swmidi.sys
2012/10/22 06:52:15.0812 3992 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS.0\system32\drivers\sysaudio.sys
2012/10/22 06:52:16.0015 3992 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS.0\system32\DRIVERS\tcpip.sys
2012/10/22 06:52:16.0234 3992 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS.0\system32\drivers\TDPIPE.sys
2012/10/22 06:52:16.0359 3992 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS.0\system32\drivers\TDTCP.sys
2012/10/22 06:52:16.0484 3992 TermDD (88155247177638048422893737429d9e) C:\WINDOWS.0\system32\DRIVERS\termdd.sys
2012/10/22 06:52:16.0765 3992 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS.0\system32\drivers\Udfs.sys
2012/10/22 06:52:17.0062 3992 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS.0\system32\DRIVERS\update.sys
2012/10/22 06:52:17.0265 3992 upperdev (78b74af8727a28c128e164e9b53a5413) C:\WINDOWS.0\system32\DRIVERS\usbser_lowerflt.sys
2012/10/22 06:52:17.0390 3992 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS.0\system32\DRIVERS\usbehci.sys
2012/10/22 06:52:17.0515 3992 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS.0\system32\DRIVERS\usbhub.sys
2012/10/22 06:52:17.0703 3992 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS.0\system32\DRIVERS\usbprint.sys
2012/10/22 06:52:17.0890 3992 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS.0\system32\drivers\usbser.sys
2012/10/22 06:52:18.0046 3992 UsbserFilt (4f8fbc51a1c0a17310846b417a447f91) C:\WINDOWS.0\system32\DRIVERS\usbser_lowerfltj.sys
2012/10/22 06:52:18.0234 3992 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS.0\system32\DRIVERS\USBSTOR.SYS
2012/10/22 06:52:18.0406 3992 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS.0\system32\DRIVERS\usbuhci.sys
2012/10/22 06:52:18.0562 3992 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS.0\System32\drivers\vga.sys
2012/10/22 06:52:18.0843 3992 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS.0\system32\drivers\VolSnap.sys
2012/10/22 06:52:19.0046 3992 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS.0\system32\DRIVERS\wanarp.sys
2012/10/22 06:52:19.0281 3992 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS.0\system32\DRIVERS\Wdf01000.sys
2012/10/22 06:52:19.0609 3992 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS.0\system32\drivers\wdmaud.sys
2012/10/22 06:52:19.0843 3992 winachsf (1225ebea76aac3c84df6c54fe5e5d8be) C:\WINDOWS.0\system32\DRIVERS\HSFCXTS2.sys
2012/10/22 06:52:20.0078 3992 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS.0\system32\DRIVERS\wpdusb.sys
2012/10/22 06:52:20.0312 3992 WudfPf (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS.0\system32\DRIVERS\WudfPf.sys
2012/10/22 06:52:20.0453 3992 WudfRd (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS.0\system32\DRIVERS\wudfrd.sys
2012/10/22 06:52:21.0421 3992 ================================================================================
2012/10/22 06:52:21.0421 3992 Scan finished
2012/10/22 06:52:21.0421 3992 ================================================================================
2012/10/22 06:52:30.0062 1492 Deinitialize success

Log z COMBOFIX - byl proveden i výmaz z disku ze složky C:\fakturka = běžný účetní program s daty. Soubory bude třeba obnovit. Díky

ComboFix 12-10-21.02 - Zdeněk - Kucler 22.10.2012 7:23.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.767.189 [GMT 2:00]
Spuštěný z: c:\documents and settings\Zdeněk - Kucler\Plocha\ComboFix.exe
AV: AVG Internet Security 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: AVG Internet Security 2013 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\kucler\WINDOWS
C:\fakturka
c:\fakturka\ASWData.mdb
c:\program files\OLEAUT32.dll
c:\program files\Seekeen
c:\program files\Seekeen\home.js
c:\program files\Seekeen\readme.html
c:\windows.0\iun6002.exe
c:\windows.0\msvcr71.dll
c:\windows.0\pkunzip.pif
c:\windows.0\pkzip.pif
c:\windows.0\ST6UNST.000
c:\windows.0\system32\956081611.dat
c:\windows.0\system32\aaffeedcf8_s.dll
c:\windows.0\system32\avgfwdx.dll
c:\windows.0\system32\Cache
c:\windows.0\system32\Cache\272512937d9e61a4.fb
c:\windows.0\system32\Cache\287204568329e189.fb
c:\windows.0\system32\Cache\28bc8f716fd76a47.fb
c:\windows.0\system32\Cache\2b536440e960f229.fb
c:\windows.0\system32\Cache\2c53092c95605355.fb
c:\windows.0\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows.0\system32\Cache\32c84fe32bb74d60.fb
c:\windows.0\system32\Cache\36c28d9ef24c5fb0.fb
c:\windows.0\system32\Cache\3917078cb68ec657.fb
c:\windows.0\system32\Cache\4a249b7cb07fafe3.fb
c:\windows.0\system32\Cache\590ba23ce359fd0c.fb
c:\windows.0\system32\Cache\610289e025a3ee9a.fb
c:\windows.0\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows.0\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows.0\system32\Cache\6d03dad1035885d3.fb
c:\windows.0\system32\Cache\9e91386199ba0aad.fb
c:\windows.0\system32\Cache\a8556537add6dfc5.fb
c:\windows.0\system32\Cache\ad10a52aff5e038d.fb
c:\windows.0\system32\Cache\c1fa887b03019701.fb
c:\windows.0\system32\Cache\c4d28dca2e7648be.fb
c:\windows.0\system32\Cache\ccc42c98f99e1472.fb
c:\windows.0\system32\Cache\d201ef9910cd39de.fb
c:\windows.0\system32\Cache\d2e94710a5708128.fb
c:\windows.0\system32\Cache\d79b9dfe81484ec4.fb
c:\windows.0\system32\Cache\e0de16f883bea794.fb
c:\windows.0\system32\Cache\e3dd1cbdd37be603.fb
c:\windows.0\system32\Cache\f998975c9cc711ee.fb
c:\windows.0\system32\roboot.exe
c:\windows.0\system32\SET3F.tmp
c:\windows.0\system32\SET44.tmp
c:\windows.0\system32\SET4B.tmp
c:\windows.0\system32\SET55.tmp
c:\windows.0\system32\SET57.tmp
c:\windows.0\system32\SET5A.tmp
c:\windows.0\system32\URTTemp
c:\windows.0\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SEEKEEN_SERVICE
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-22 do 2012-10-22 )))))))))))))))))))))))))))))))
.
.
2012-10-22 05:38 . 2012-10-22 05:38 63115 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2012-10-22 05:38 . 2012-10-22 05:38 4599 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2012-10-22 05:38 . 2012-10-22 05:38 8646 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-10-22 05:38 . 2012-10-22 05:38 6429 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2012-10-22 05:38 . 2012-10-22 05:38 9310 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\Malwarebytes
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Malwarebytes
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-21 15:11 . 2012-09-29 17:54 22856 ----a-w- c:\windows.0\system32\drivers\mbam.sys
2012-10-20 19:23 . 2012-10-20 19:23 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\AVG2013
2012-10-20 19:20 . 2012-10-20 19:20 -------- d-----w- c:\windows.0\system32\config\systemprofile\Data aplikací\AVG2013
2012-10-20 19:19 . 2012-10-20 19:19 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\AVG Secure Search
2012-10-20 19:19 . 2012-10-20 20:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\AVG Secure Search
2012-10-20 19:18 . 2012-10-20 19:18 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\AVG Secure Search
2012-10-20 19:18 . 2012-10-20 19:18 26984 ----a-w- c:\windows.0\system32\drivers\avgtpx86.sys
2012-10-20 19:18 . 2012-10-20 19:18 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-10-20 19:18 . 2012-10-21 15:24 -------- d-----w- c:\program files\AVG Secure Search
2012-10-20 19:12 . 2012-10-20 19:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\AVG2013
2012-10-20 19:08 . 2012-10-20 19:28 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\Avg2013
2012-10-20 19:08 . 2012-10-20 19:08 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\MFAData
2012-10-20 17:30 . 2012-10-21 15:40 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\Systweak
2012-10-08 17:12 . 2012-10-08 17:12 -------- d-----w- c:\program files\FOTOPAK s.r.o
2012-09-22 20:17 . 2012-09-22 20:17 -------- d-----w- c:\program files\Garmin GPS Plugin
2012-09-22 20:17 . 2012-09-22 20:17 -------- d-----w- c:\program files\Garmin
2012-09-22 18:10 . 2012-09-22 18:10 -------- d-----w- c:\program files\Microsoft.NET
2012-09-22 17:44 . 2012-09-22 18:07 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\Garmin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-05 01:26 . 2010-09-07 02:48 93536 ----a-w- c:\windows.0\system32\drivers\avgmfx86.sys
2012-10-02 01:30 . 2010-09-07 02:48 159712 ----a-w- c:\windows.0\system32\drivers\avgldx86.sys
2012-09-21 01:46 . 2010-11-09 21:20 164832 ----a-w- c:\windows.0\system32\drivers\avgtdix.sys
2012-09-21 01:46 . 2012-09-21 01:46 177376 ----a-w- c:\windows.0\system32\drivers\avglogx.sys
2012-09-21 01:45 . 2012-09-21 01:45 19936 ----a-w- c:\windows.0\system32\drivers\avgidsshimx.sys
2012-09-21 01:45 . 2012-09-21 01:45 55008 ----a-w- c:\windows.0\system32\drivers\avgidshx.sys
2012-09-14 01:05 . 2010-09-07 02:48 35552 ----a-w- c:\windows.0\system32\drivers\avgrkx86.sys
2012-09-13 01:11 . 2012-09-13 01:11 177504 ----a-w- c:\windows.0\system32\drivers\avgidsdriverx.sys
2005-02-06 09:53 . 2005-02-06 09:52 226544 ----a-w- c:\program files\java aplet z in..exe
2004-10-01 14:00 . 2006-10-22 16:19 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2003-06-12 19:50 . 2005-02-04 19:55 466944 ----a-w- c:\program files\SETUP1.EXE
2003-06-12 11:37 . 2005-02-04 19:55 45056 ----a-w- c:\program files\CDVPlayer.exe
2000-08-20 23:00 . 2005-02-04 19:55 1388544 ----a-w- c:\program files\msvbvm60.dll
2000-07-14 23:00 . 2005-02-04 19:55 101888 ----a-w- c:\program files\VB6STKIT.DLL
1999-06-02 23:00 . 2005-02-04 19:55 17920 ----a-w- c:\program files\stdole2.tlb
1999-03-07 23:00 . 2005-02-04 19:55 164112 ----a-w- c:\program files\olepro32.dll
1999-03-07 23:00 . 2005-02-04 19:55 147728 -c--a-w- c:\program files\asycfilt.dll
1998-06-17 23:00 . 2005-02-04 19:55 73216 ----a-w- c:\program files\ST6UNST.EXE
1998-05-30 23:00 . 2005-02-04 19:55 22288 ----a-w- c:\program files\COMCAT.DLL
2011-12-21 07:39 . 2012-01-19 10:08 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows.0\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Garmin Lifetime Updater"="c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe" [2012-06-04 1466760]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\c:^documents and settings^all users.windows.0^application data^microsoft^shortcuts^icwsetup.exe]
path=c:\documents and settings\All Users.WINDOWS.0\Application Data\Microsoft\Shortcuts\icwsetup.exe
backup=c:\windows.0\pss\icwsetup.exeCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS.0\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows.0\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users.WINDOWS.0\Nabídka Start\Programy\Po spuštění\WinZip Quick Pick.lnk
backup=c:\windows.0\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Zdeněk - Kucler^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Zdeněk - Kucler\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.4.lnk
backup=c:\windows.0\pss\OpenOffice.org 2.4.lnkStartup
.
[HKLM\~\startupfolder\c:^documents and settings^zdeněk - kucler^nabídka start^programy^po spuštění^rncsys32.exe]
path=c:\documents and settings\Zdeněk - Kucler\Nabídka Start\Programy\Po spuštění\rncsys32.exe
backup=c:\windows.0\pss\rncsys32.exeStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nokiamserver]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- c:\windows.0\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows.0\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2011-06-14 09:18 1156096 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2006-07-30 17:00 98304 ----a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2011-06-16 14:21 1500160 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task]
2008-03-28 21:37 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-03 11:23 17417392 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 15:17 159744 ----a-r- c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-06-10 02:27 144784 ----a-w- c:\program files\Java\jre1.6.0_07\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-13 20:25 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.e=¬7 `»jčţŬË3ó
5ç4Ś3ţ˝g1§$Q/Ţ˝†rkŽ¶±ţ´ŁéýVo˘»ÇdH«_˜6łŤ3,ÂýIUáoąëŚz0Ç•MTW-&r×9”aâĐ-o=ˆ\äţő[*(ß¤ďáŹŐÚď™ĆHç|2ŔĂmÚĂíA˜ááA§rţNI{Vvx¸¨n«Na™ŹtZTóC¤S3Dh;«SŰϨ˙ŞS=$ŁiwŐc^ąřÓĎĄĺ+Śĺőâ˘KÖI.ßTŤ«fÝVÇĽŘ“ďˇi˛áݨ›ŢRE
DS0wł3ź-( çmĚYő<7ëůÖ¬çůěq{îýQÖ+ÝĹKllj黳ň3×Aćâ%öLŠ±©«s6«k8st»€Hř0kŤr×P0Ôvo‘H
~0ť‚ǘBd@z´dµďn)tř‡Ú6ćUC…ź$¦b>ô·}+ŇmĐDcDŞ€5)soűˆ
BĹÍ»¸+-Üm/ń?ąxIËläŽ" C…I<“âVěëń^´ÖoNVďŤŰAŰ« ˆâÖŁm§Űi…†q("[J4ťć*Ýu3"wăŐŤŘŐÁtWűÔ®¦˛±âÖ}ľWŐľÄZeő4Ň6‚WG˙OGÄ÷?O~?ŃSV7™y_ˆó~„Ż·«sîVçnł{͸×QAŹj
t–»ôYYDRţ(®Síĺ«ô )ŚĂ˜*ĎZ´˝ˇĺË],Ś‚ď:ńčCěýŔ_7g
ŹwT
72ÉSÂ)"m_—{ŁEc=Yµäސ~€»FôIî…Ę«Ë¨i;Ćý'ô­'ąë$šźź\„ÔČ5’ř‘ČEš^*Ŕ^5BJKJYőr˘mHîMöáFt˛†!Ě$łz‰ˇ'ÁôƒŤěöôÔů?0¶Ž°Ö“ E˝ţ=~r›G7 'żÝţ^Ô4MÄý˙m›ŻÖ1Jlŕ«jçîµě9Šă_bgUŰůÎ!Ü˙Ż·ĐÉâGí»÷ rö¬šŕă 5ĄKkěĎކƒÂŠš˙ÁŐEÉb˜‘‘»bYů˝íĚŕ¸?c9//hŕV[ńr›ä»ƒŇ˝Ž ¨*b‚ ˆa])˙v5U[{:U[â%q†ÖvîŮÎrĚúÁ—ĄyVŁÖň¶¬–ý˙ťSÜ?_‘Ď‹˜żőłu:N÷Ô|!ímWGóˇVLd1«ŤĄďˆ!…ś…řÔĎč(¶C‡ REąíôЁL ľ[­öŞvGnµgI8ˆ÷űźĘt§˘s˝Ľ2«d^C7á!kŘ °4Z_ÖÉÝ?4ŇQ!Ú€­/wü5%ĂR¶ţZ$ŚŽ¸^G‰B*µĎj­‘ą~V?ą?ßĹŁ¤™‡˜ôÉůć˘N›ýő6
az‚I?sâĽĐ8f7w
Ł`čűNÖǵWţ¸ç˛Źąţďvĺ–Iż¤Ú4‹Ž9ÍÇĺ^×Ď€şńÄdďŮ”ż‡W=!:ŽlÇŮ=*–ż™{ę˝;S®×xëk˜ť`Rl)˙¶­şľ×~¬\AímOźůÁχoÁéĺ´SŠËmr Ť}üšđyGŘXnGɃ·>ÁĎ˝ń<™EXwO>:öhDü›ĚĹIĘG+ÉW(bl”ĚŤ{DľA#šŢé$Ll>RW ĚW.JgłůÚč8ťŻŮ)®ƒ©uľqí&´đďć­!ą×ŢĚ]]Š=ŠW%˝ ’ńńŞ}rźôˆ°ů]/0#UóCµSüq ĎĺŢÝŔŇ šGTÓO0§”ríƵđďvř“Íż´†RęMR!mŇ4śSÓ‘îÓʨOů‡Ň;Ľő ľu'ĐíB×I.(Ň˝÷$÷ź3ÇÉÇÉżëhĚ1şvň?PiE>Úl"¶}Üdńżđh©?~HTL˦ʽ]ÜŢŻŽÖŹŁUMf@Î[G`B˜}‚ŻžVÜOCĹq>–®PŐĹV*U°VLéh5ůî—xRŠ 5đ•ů… +xFŐĹ0íQW^ĎÉ/dţťú(+ÍŹŰ_Ŕ‰‰ú•Dö_dË'·j’Ë0ĄT43ďQŚ¦*Í—űUňi¬jH\óÜHgÂ0'¶ë(Ż/É;4]Śţf»˝¨
.0:Î5]ŻňżaŤ….â8Őgź¬ˇčçĄĚ–3qŃw#÷•űĘfÉ}ŐßT[$#]=Z\*É?ľŠđôh ´ “şÍ‰«yŮĄĆbƒ¬ŕÝ~ƒăÝćQJA`Š´§­íšU#2(5˙OÖŢ=>ŞęZźÇ!`ä0b°©¦mÚ’Bk˘iej^“D$:Iś‘¨˝â”ëµ˝Hf>If&Éfs0(í嶴嶴¦H@$Đ$*_BŞSť1©FÔ™ßZkź3s&pď÷űű|żüAÎěłĎ~¬˝özíµ×ŞCú$7.Bv[Ú»¬fXnZ@!&-ŁŮ6“8@2}źqQ
v˛°“Č€ű@0wtÉţSCżxxĄ':Od€M›•j#t˛Ăâ˝ßčßvƒT$´Č9śƒËg^óÎdšz_7-2ć^ęőŤ)9x9Zń&ľÁ˱‰ťÚ'kbT3Ś°/ąJ(
Ź*8źš2tZĹ˝đâmtş‘ma›É÷RBžy<€ÉôS%˛,ĄT´ţd[‰Aťë ‡{pĹO2^㕃idždÇÉ›roxŻ“wKSw˜|á6_Č˙óaÓÉ7¸#Ĺ÷>>ýťWmhş#"îŻ.”0
:6ľÍŠCŽ7ŞîΈMßaó¦gt{X–˙ ĹQZqSĽ;a‡ÉűdBĘM°ůNśď:Ş[ČÍČ•;±—đ„ß;—;É/á`Ővł!íHńfPOJÔLjڇ„i5/ë#Ĺ÷ôqd|(<_[5uB€Ž9ÇR›bĚÍrř>ˇ¸łg<ĚeâĹý†ĆzĘęzB¸ć?Aźź+O0Bů@Ž]>P’‰¤úłr,ňş˝éZ*H–qëř(¦Ź˘zŚ¸ŹÂzŘĆYH”Tm:϶˛`vŚÜČm
ßĆ€p˝U3Ž«qĹé)vź‰Zp”ŰäJ8ˇPƒwŰGmF9đgäŮÁątá×OóÔ'OŹóęv(CĂ˙Ó˙ĂŘö]ĘnÁ9ÂRŔźćéŹ]x>Ů…­?b(Ź<łEµaQEŕˆ×đ†
:ÔöÂVn8K§|ÎŹŮhí«ł„
˙1“Ö!/Č÷ »ő
ç9V˜ ĽöcV1~Ť°Ćm4k``ŤxäX»:ŰŕKě.Ě6˛ŠyJE2wQםÁŇíTMW®?KNä§ŮŰě`ÚŰś.ĂÂęâ…ťŕÍ„BJ·ÜS8Gü9˜ÓEÜăĚóý¬0ż§°Hüśk.Ěg…z
E\˙F-§ń±ĆťTŞĺš›MceŤ(ńDMĐ
NĹ3<Z„“h—˘UŁ}ü—ߐŽC¶ËýŠ¦ł­¸f<;“Ń’…GéŹ˙ŐŁ„
<}â[qî v\ äͬ˛ƒ˝íď”äÝ÷Š,J%)ŕBÎ×j´…µpŚ;;üq«žo¤ľë¨i}Ęţ!rď
żą˝Äŕ2?pO™XőŠČs32ĹŤd„ě2şŻl…WhçĐnČ,ç…©ł3˙Ź Z˜nţßµ0…˘‘\1óˇ7k¬79đE´XÂâ­ęřΈÁ
„ÁîáRŠN)0ŘXiV18üĚ3–Ö…JŽIŢíRSGeSę(e
tU=/@Vćč•ýżŃxĺˇ#ď+Vƒă
ąáq=ŇĐaBw=qš™Âg°ź…K`HJńŔ#’ظˇĚ_•ÄĂ4ů"ŢOŕ&ca>Ď•Ś…EŔŤ…x®ŐXčâą6#AŹçÚŤ3ž›d$°ńÜd#Áµˇ2UfPe¦pĺo‘.ƧĂęßń{ĽÚLËľ»č…ęČĆä[|Ł(+ýšm´QčLÄĄb.®ÎpÉďĹ5ö]ˆŞ‘ę|qb\˜ď}Zѵh
Č}»Ź#m8bQJƒY}Ń{ŃjĐďm)=Ůr`@ôdśáîß•čťßmőwf2%Çwŕ1“b'žąDâwçóÂ"–+±IüîĽĐĹr­lľ…?M0¤1°\;›oăO©s–›Ěć'ń­ÉtwĎŇ-ĄcRĐîütŁř›`R˙š)íšď0OÄógmçżmPw~đ·Ř¤h˝X“Ó]Ż’ś€»Ü•®ę̸ËŃ€ěx§ę(–j7§vd^Ö®tHţntdq|V}LNłĆ©ÎใfsžâąĂ¦“ž?Âs?đfbŢóÇxîE
hFó†áš„ë©JȃBć{żlđ̇n×ň
{ůĺ8ĽđKŚ)t8řš÷'Ł qˆ1ň;$¦Ř)˛„°ŻŠŇ$n˝ÖÚöµ’Ń%8|‡)u"Ň ˝HĹäAm˙…ű5›Ž+î›áa[Óé®6ŇîaÁ#U˛Ĺ,ďm Ů#ć(…ŢG mÄa…ú »ü…OIA"%oĐfƒSQĆ€üÚţ rql˘+N„$†|¸ôŻŇŇű2Á0
!:U’Ż^Q^héɦüšQˆŢµ„QŔ
AÄÔxŢ‘`#b¸ç' Ď J.ëäŮsřc0ÜÇŠ čů4AY`JéˇŔ,"ăŔhΠÉ;ƒSރ±›Ť%!žo–Ś9Ă*őw¦dQhß1umŘ‘đ‚ż Ď‘|ŮÖ|”°ŕƒÄ?čç˘90ňRš
ă M<oJ8Pm@#hď|«Ü'bŽĐŔŞ‹xE>s·ň»]¬¸…?°€UîTw¤sßDŢFîíüiÂŇâmü…r¶ß"áágđět^ĽŹŰŤĽ¸nŮoÄ!Ç ě×˝OÔ3Ă6s­Ë•F™|˝·âq·°
/މ;Ä˝ƒm"ZZĽ]Ý!îmlńžâ-b‡ČNł­€B¬Ź|ŕľl+žś8¨TR qĐłšůü$VĽV>°h«lâĹ}kJ¤şł˝đşÉÝč˝]ÔŻş™‹Öśk•Ě~ĄÄĆ6&EԘ"řPN÷śóÔť^ŮTýhHnË‘v˜ä tńĘ>Ľ§M*ĚeÇFlmĹżˆ˜ĆNGqÓ
7ŻlćyIŠ˝O‘zů$ž”ö6ÚęJ%^$Ą˝Î6Rt*_mpÔ7‰S¨Şŕiď·bò÷§U6EvQ-řĚŮD&÷FhýÎ})"Ŕ‡ƒbńČÁ9xEqmŘÓ›5’ĽëŚJŇ7š7
öEţ ă&Ĺä‘ý7`ÉÝVĺ1»‡˜<¨5~C>Đ’5hŤ%¤5*’™TĆQŠr†Z˙Ś9ĹĘMŚnwž5›Ë˙Żˆ|…+)BÄBíBAwľÍ¨{6éžÍţ Ů%ÚpŠeqÖF9řÓĎŐđ-!WYčv€Łš
m|Á|xÉ=YÍBOý1ü$·Ż9đŕ’ŰΕóFTč"-¨Đ•©![´–ńă
‹¨ÂkIç«'wŔ—Ö
ĽówفŞÉ¤~%\ÉŹ§lâ P7Au îł°ĘZЈŃ<°Q €Ź.Ć'a’šFƒwÂč!‹ď~ÁĚŽ P|kY&ąY¤G|µę%âÚ…‹Ę˘ˆ‚ŕSZĐšľŃ Čŕs(':kSü×v¨ž@T'ůjR}<‡˘a¨NgqHąöE÷ŞxŮXJ
m˜‚}m¦ęÉ÷Ý_;éʵ7Üż0â۬)'ľ
Wk8µĄŹn”<M ŹAźťƒˇ"â °2e1éh}$Î˙Z3Ž’żůLÚňg’Ô–?ťÄ¶üé$·ĺO×·üéšä–?]ÝňŻŤÉn o»bl/*ŔÝőGŤ-©’íĺ’LvĽä…ÂŘ%Ż˜H6NňÂľţ1NW˝HF?»jK› fđđ.9ߍľ|ľ;ÉÖ$± 
iĹÂĄäażĚ˙eÄk=ßm!…ĺf<‡öYP‚JŢ”óÝdÖMw7ľŮ˙ćdĘ!mÔ>ń¨Áwň•Ô¸
hÄz\â…KYĐ‚˜ľ´]b؈|&4ź[k÷¨®ßFvđK͐~[) ú"Č»ý¨ î0zÍţ7M;LŢk˘žb:Ď
\á¨mňă©l·?ţ7˛ĘVN^MŔÝ1Dváx–zôg‘MŤ1
%řM5Í:Ő݃4CłŃ)š|n“XrjhóőđBp[
oÄö“Y KZ.÷YŘ®9Ä…-‹—Ż§€"¶črː;7n›BĚ—řbt,?2Q°‹ş'ŠD.´udřłř;ĺ»Ň)¦’v‡nř,už§"¸ń7âÚŽÖ#¶š|S„„Á®Fń{˛_0˘Łś†ČvŮh $˝­ř)ˇ.0ƒ¤
ŰUCW°bÝăęhĐ ƒ(čë…1ąB÷ˆx1\»R„ÂJţő^Űh#š|‰r™8)+,w.&ÉMˇp™©ś„ëŮ€ƒĺÎäľv™%ĽS<ţ=w Ĺ
“ňË."mÎv¨ţ‘DĹ©kĐŔŃ?Řý
r”Ý˝›l.)$ÔˇëJZ·| ‹ťĂ+»ťˇë•y¶#uTËçEa0B×´ĎĚvF/1
@°ś9ěńtöX¦:SŐ¦â{H|jň-âš ňu#dAiď¤7’˛‰1ň˝Ăä¨ęM“ŰFř3źăhw›Ýr E֌׆¬hňĂß(5Çń7ß'Ü98ŰyFG’€ ËIć´cwܨšú¬˙Ş)×ČŤ…)ľf]ŃSčľD4Ł‚7‹Ń°‹Đj«l•Dv!EJ—ŞÁđ>ů
QŰâéÉůÚ…rĹ
:˙Ů9 }ĂÓ0=%ËŻÖ|ĚĆč9E~µňÖOĎ©.”žfÉŻŠ—řĐ'?wŽüŞó^Ľ„˘nËM‡ŠźŃSfO.ň`óÝ€{iŐv˙ŇŚÓ4p6ŠN;ÂźöŮ+żŚ#:lţ®`›lľö…şĄv¶ń%Ľş¦_sFˇ¸1ç}ř÷P$‚|ŕQÔŞĶ)°ťD=úŤńšÂŹďB}ś×Śß°žÂ/d§3şÎoĹ÷ÝZΐXZűŢ
ě—î*ŃŁoßlBB3ʱćÇS <ľuô­^ś1~hW‰ hh'ÁSnřvąü˘@'B$%ŠĹŘ‚-ľŘm@«ŰkVxŇîCů#†ó§J]ˇ‘™j™VÝ ŇúÄŢ
ěĂwء¸ś˘–Hžś*/Ňů‰¤ëKđô
O&–ň_!*ńúvňżňNAúR+zoő‰xYV‘Y=RfÇB˜\-3tmcŮŇЃ]Őč©?cRíM‹–Ţű@ä%Ü‘ŞdőPŘŇSűąúţEp'ř†źŢ{Ý(AźxĽ­˝Í¤ťGl‰}‡^e®rí;ČćX
Ťa­öUým4/őŞ^X -µ©^˘+$­/J8Lśz…%VfŃś0
0LR1ż
6ů
ř٬އÁVĽIŃfŕMO~5…Éü·Uź¤~ě±6íş“µɱňdáhY‘+Kc*×JD2­žÚ^uR—廨Ţ)lÝ'ř˘dNő˜sŚý»Ľq›XŮo`ŃŇĄËşâ!ŤwR.CxugŹóŚ8rŢ ţl¶h3őm¶.<pŰËJ·ĄL]Ż3qľ›ß`ąz’/:đ˝ŔËSĹ&äSD„Iň)Úž@S»™”÷‡˙ó  şzžŢż·Dc`˜©f›ČTS¦?›Çd&^[|C{éNŮ™<Ú&<´Ź6G?š¨Ő^K®g@\ĺĹŰ„ź€V{‹V[>¤ÍEŘQřDÍý WŤTĆşłtŔďČ
şíHH#{„ÜÖa¦ śĚŮÔă\ťkĚ™@kŤ~µhGý’AtŐĎîqŽűPŐćĹ˜´>—ąţlsŘŞĎśw¶Lř0ŔŤR{/îqö^ţ1ž[nfŇšVÜ«~l©>Ă1>ôvč
˝B-žz;ëMó· ¦ ŢŔp X=ăo˜7Ç“âíBîŢit7Eśką;ŕpŻ•ƒ_ ŻRî+%mČ?¤!ŔX\=Îć¸1DśÍ°J܈Ů0lYÎfPĺť;ŤÎ¦ˇ?ó»RĐË(9űĚÎ&V˘¸؈z⻝c<_ßDŢŃ#ę)ýîŢ<ę}%ńihů®ŮŇČ/Ĺá4tżPóÝpďăĹŰĺ6©„oÚFĆę\ˇëx¸ĹĂŠëi/´R­±łxŹŮYĎIô0SÄąŹDé}ŽâęéƒíŃ\Źôs‡¶Ép> ‡ĄąŹó)Ftś:łÁýđƒýđşq‹Řćo ˇĹÝ®žäóâA k‘ˆ˘éáS=lăŞFWÜ.0j#>AŇŤW\‡ßŮn˘
v8žĆŞ˙žűj‰€H°™2ţÔçÝaÝě$!Jťł4Ĺ»âˇňČs‚Ú¨)řŇz4’ŢÓ%óŞË{\nhî9bT›6ă0lFtó6©‘ľ&?¦aXEĽ‘Ă©ň‘
W…J€˘ŮůžÇşâµ"ĺ1ç€ă`ŐµÂç«bÜi{ĺ@u˜ŠU‚ŁZĺŔý¸OŃ«uń^‘9ďâćîĹK'>ŰŇ?Wř`d™ŞÍŽé€!>ޢsÉ´ÄE‰NŠřěĺÄq%qőq€oB’Xwč¤
˙š^KÝ…‡}Ë˝ľëî¶,čđµ˛m|-Bôµqq&EěŐXâr°Ü¦¸ŃIléĘź/YĺŞJóĄpˇőŹ%Ę
˙ÄŻŰHö*-§č¦N(ŃŐžŤXÔH5ś@I™»ü.“żCZStiMv¤ÉyśűzýÝ–5›ś;Ö|Ýäüýš‚KMÎß­)€·oéŁ'y&vůîfŻă©
sź€"çqĎDç ąÍy(÷­h鬾AŢíţÔ`î
kś;:@Ľu˙žNTŕá­‰}ťęj Š’AnXINVfŤą˘ Ŕrô4†ţŇYuŔŔ©<ˆ ›-FźŁ§Ďćýőz¨‡Gq;č ŹÉúţˆOh·÷áŠ˙ÉżYŹ|ÁŔF<ĄB0é5WŐWDŁţŤ<+üôˇT_Á÷®Ç@=ü­Xƒ[#łˇş§3dbŤ(są”Ć
Ńţ ¶âÓí(­Ź…_E“­ď9ä˙ŘĹ϶̣ďBä!@›µ­Ř¨IQF,{xů˛ř/>¤z›Ł_hŇV¸»}·iFƒÜx lagřţ.•oočfᘿMěĺĆĎŐ˝,ŔţĐ%TkNĽ+¸ł×ěěcHá7?utV/áî
Ćׁ­i¬:™lPĆ}ŚľĂÜy8mÄál^ţ
ö&;Â7aËk¸oK“4Ł€ů¶8|›}}Üą…5“ëĘ k‘ĆľmB}/Ľ«ł$*4ś¤÷8żeN¸Ôe!»‡“»JDK»reSójmČŇÚ»âé%îżeIÜeeî3|e˛jŤR=oĂŻ˜<ź˜‚ą MDŁr`˘QĎ}YžEçoŤBşÜV&Q˘‘«0˝iW¶ĽÝH_6ý;aţ ů)8C˙
m·‹gA|‹Ůť@ęCěN;^ŹĽ3 Ó„9GRügSäŔ“¨“SŠ.Ňî;Ę_xí{„}éK+óʐŚĚ]ńƒő.ä’^˘1ű?IŰ0•“­©Ë-Dź˜vŔŘŃü˛#Ű»Ň˙‰sg’PuĽË˛ ßĺÂ!ĺŐŃ_z`ŹśĚÂśƒ „mŤ^3Qk‡Ź0€…1ŁýźXÂy‡Jă?ŤÂ~B3^ąňsúożĂDˇq?CřłűöHĆ·#Ľf˜k
ż?EDô”ĐÝmöý©¨Âţ’ÍOŽw×pĚ.ň„–/}°®ĹÚcIŢI1ľ KŚ+R-QžQá]n±bOŕ…
h¦Hó䏼Ő)1”4_µ”€ZąC˘ň*!hčÎ6j¶ĚďP¦ Ţ€o"ˬčP(Ň84GsŞÇĺŻ5akđe‘
Ť×4ö[Vła´Ë$O"°Ďĺŕ_IköwŮął㊦+Ň
%ąÝUŮř|‹b$×iť˜07źý ń\6P’Q^ÜĚs¬˜ÉŇ{;˘¸’2NĄ6ßşÔ»¤Ú[rëUËţÝ[~«÷ŹVyďËów%A÷ŽëW¤ú;'0<ü»Ő»ôgŐľľžÜĐN§)­Qý®Włš¦96¨wę
µbŚ¤ÜĐ?ńy‡xžP Ď[x͆íá%=°Mp’8· Zý†>T*‡Ë*PwűYTšŇrËĽ
H*Ţy.{÷˘Ŕů
aE˝ĹŠZÓŇm€!k–>UŢă­«9C2¦¶¤řésp,ţšł&ß?áĎvßr[ńGr[ĺ bßJg˜ &ô
[wtúŢ †’_ě‰Puł±_‘ęɘĺ®nˇd’˜¸C]ńƒ¬AUËŐ
0ÁI›šÍ†BĆס!Ĺ^˘ä×Ú{3+łRÎŮŇĘl‹}űy‚޸·1¨@Č&őä"ÍŔFC čł\;ć?hg‹¬Št‡’|Ă˝]‘ŽŹ®JR슘L{ĆQ&3;ŰsłÜŰ}ź_[ő}ÖĄIű n-„Ż™±äufźěďšŕďLb »wůţIŞÎ-®Š¸4žr0Ť’äl<Ƣ'
‚ʢ$UHw)îŢŇĄµWX“OČOĄ—•Ť
OcyĂř`ŢJţyźC[§XŢEžęü(©ÉĆËB@G/4ĺá‰çŤu†,Mą&ńÜ”k†j®Éĺ”č&á0˛ś«PgşĂĆŠ[aqC a ń±ÇąSK+Ѣ•ĄµQÝ{QĹ*•ˆsw+ž΋j˝ĐÚ Á;§ÇŮ"NÇ[đAq«y&}…Z?3Gś-8R×ZVźŽĘŰçN\2*ß)Ż;ř•Ŕ‹pë뱾€ŕ.|ƒEdĘj
A§»ž„t^ß+.Ś":+˙%!Fž…§gů¬^;|úKúTwç!8꽁˘;O@ěżĹëę“G)Ź'/¶qi˝îĹ«ąŽľ0ĎKŐâTó'‘Cé¦÷űř1+Q>OW↦-6Ai–´^2•Á7ˆv“đʧŢ~ƒůt×â4Ś8đşmęLČoá‚Ń»ˆŇ/ĺ
Ő
d‹–Ë­eܵ”ä=Tź}ŁDhĄˇţnÝQ[ŕCđ-]ÇĎ8\B€*YĘzIłˇwŰĄčÉîJfî‘ĺě‘ j ~d˝žÖxoŁ[®ˇţe.ƒv>űš/ńÚD‹šBXMو'äŕ0
:1Ą
ćrHĄS˝D§Ž»–ŔžŔbý®đ='0? é+Ká5ƒu5ÇăÉÖ?pJ°äŹĂŮďG/$arY1¤őÚrjěNRžň×ô˛šÖQ'"O :™—˘mFü6˜; ä5}ťšĚO¦ŞÓ@7;[Yb„.g€Öî(K©z[}«ÝK)K­ő
7\——żV×Eí9ß`şB·.a·‡E·‡ăşŐöcq«"ĺ`çÂđsŘ‘—Rul¨NMśŠ7¦ťýň‹}Ąń HŽ"]\´ Ăčě%×˙CăhÚ5˙´ó8rV~±ë
c
!ĺ{2)ńşŁD´_ŤNÔˇŢt_tî‚«Ě©˜źLÖM†¤"˜G;öC$ˇ˝úoç>îŢç(KŞ~) áoľŁ‹aŁ?ő·ŤhGs÷Ţ^Y„rç!Î3˛”ďä9$#6ćŢ–ĺ¶bňŹĐżˇD·#jÝńµ«.Ŕ(tÓ-Ŕ—¶ `¶«&ÂŃ‹D]Ľ¸eŚ™x2JôÄT^du‘×îĹß%Ç)y-ŢáeÝŞřźşčFńŽɁż#čÖ\µĹa‘ÖÓŇŔŇă] hÍ^ÇďJuĽľúßůýÉţî$Ç©§ćGßęo;z˝{ËŇ:KD<Ľ®R5ŕŘ&Ý‚^Ú;ŘhIÚÁ˛¸·çűcď›®H?"ýŘCŕ ýŁčEÂŮ˝Îjt jÇşő$šµđI a=ŽN±˜H˜î7mí—ŰîcĹŰý_WÜÁť­Đ5źWĺüŽ‹¬řžOZřÇßäµĎ‹xGţ.Ý^˛łQ%ůŻÄ¶OđIţ.‹ăËŐŮYÎíľPÄŮęwö[¨˝‡©z“‹–oŞcEohS ›*Źł~łóż_š˝đ"Ď+ŤB«§".z`™7¦ź—\äĹÇÍů“.çƒ5bŇzĂŐ;Žôgč/ˆ[˜ţÝ(˜ó0âŢ3„jî^U>î周– Iýé•HŞÜĄÝwFßúř­őK!Úáb¨ˆ>:Ń[÷‘Äéjm‹|ÚG
çx.ôw(Ëâ‹ĺ'/ˇ«±·zY®=šýv/Ż<<˝ęeU`a=q·TÝ«Ń•—ľVKŰüSŹ˙vƒ7_#•ű:ß7łwĚŐ’ţć n÷óŇýq%xsiźÜ–H`ßęƒ(ÄôX¸»Ăá>$®Ű‡ź:Šű˛Łhe+ÉoŤáŐľQ4cçŘé¨Ć,á hűâěíZŔ¤˙zeů:|')MJoä1{´ŞłWŤ„ Ă>Ćĺý¨Rƒ¦L†?±<e°ŞKç˘@ˆŞ"ă)†ˇx›U[z1ŠKŠAwMö‘Ś’ˇŢ’m\kTí 5—§§QÓ(ÇôŠŘŤŃ/…"JGc4řK˘(–t†Uöä¬đŮc%čž„ń]´ŢńšŁgůŹc%"ŹŞwËácÂ=fśŮń]4€kgNţáTćcĹ8´tz‰Aźź€ť`SęŃűŕÖKŁˇzŞRý!7 ĐCfԾ㈸. ?Ů-
ŠEŘ~¬“ť“_<!żŘ©H&qŚ×ÔF„ˆ&D&PŮll´€Ş±^QńV”üWŰo>őaÎĐ?îb#ň‹ÝěuŠé{kävƒm•^…îú ™Ť:|×Nűf Îfń°=lľ)vkőüŰCˇóďN{Ď}ŢůĄóC‹nč Ŕ·â†O-˜ĆM
sqđCż?˙ÝĆčŁčćtţí—ŤáĺoéĎgŮA>_â&OV^QU‚'ëÎ%Ë“ĆDZŚĹçë oçÖe.[ ·u*óA3ç-ĺ7ÎN‡–fIŁ~Šžé#·x?FpQ¤®ĐqBsž‹]0—=ĘÓgßČ‹¤ŮóŃŁ}“Jß\ŠűFä(ě­
@Ľ~ţű”ť:ĘFŁĎĎÄâÝ÷yyKV$xwU_˙ßĺÔrËČmGĐá°Ě%&‡ascqZŚľëˆ`XŁŁ—§&ÚżÖ7oę'űľíń·SLďw=śÂ&cÜÄóâXÖâôżÚŻ=|ĺĐO)-pd7ÖŘ,XU¬jqů
4`oęË.Śu†XC
!MĐ·(bEˇ°RimÉĽ™"ůÝ

Soubory obnov pomocí tohoto nástroje:
http://download.bleepingcomputer.com/sU ... UsrPrf.exe

Poté je zálohuj mimo disk (CD/DVD/flashka,...)


Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť?.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

ComboFix 12-10-22.02 - Zdeněk - Kucler 22.10.2012 19:52:02.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.767.176 [GMT 2:00]
Spuštěný z: c:\documents and settings\Zdeněk - Kucler\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Zdeněk - Kucler\Plocha\CFScript.txt
AV: AVG Internet Security 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: AVG Internet Security 2013 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-22 do 2012-10-22 )))))))))))))))))))))))))))))))
.
.
2012-10-22 15:00 . 2012-10-22 15:00 63115 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2012-10-22 15:00 . 2012-10-22 15:00 4599 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2012-10-22 15:00 . 2012-10-22 15:00 6429 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2012-10-22 15:00 . 2012-10-22 15:00 8646 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-10-22 15:00 . 2012-10-22 15:00 9310 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2012-10-22 15:00 . 2012-10-22 15:00 5927 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2012-10-22 15:00 . 2012-10-22 15:00 8613 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2012-10-22 15:00 . 2012-10-22 15:00 1651 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2012-10-22 15:00 . 2012-10-22 15:00 6910 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2012-10-22 15:00 . 2012-10-22 15:00 6208 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2012-10-22 15:00 . 2012-10-22 15:00 18541 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2012-10-22 15:00 . 2012-10-22 15:00 8288 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2012-10-22 14:59 . 2012-10-22 14:59 51852 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2012-10-22 14:59 . 2012-10-22 14:59 20719 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-10-22 14:59 . 2012-10-22 14:59 23327 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-10-22 14:59 . 2012-10-22 14:59 7271 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-10-22 14:59 . 2012-10-22 14:59 8782 ----a-w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\Malwarebytes
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\Malwarebytes
2012-10-21 15:11 . 2012-10-21 15:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-21 15:11 . 2012-09-29 17:54 22856 ----a-w- c:\windows.0\system32\drivers\mbam.sys
2012-10-20 19:23 . 2012-10-20 19:23 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\AVG2013
2012-10-20 19:20 . 2012-10-20 19:20 -------- d-----w- c:\windows.0\system32\config\systemprofile\Data aplikací\AVG2013
2012-10-20 19:19 . 2012-10-20 19:19 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\AVG Secure Search
2012-10-20 19:19 . 2012-10-20 20:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\AVG Secure Search
2012-10-20 19:18 . 2012-10-20 19:18 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\AVG Secure Search
2012-10-20 19:18 . 2012-10-20 19:18 26984 ----a-w- c:\windows.0\system32\drivers\avgtpx86.sys
2012-10-20 19:18 . 2012-10-20 19:18 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-10-20 19:18 . 2012-10-21 15:24 -------- d-----w- c:\program files\AVG Secure Search
2012-10-20 19:12 . 2012-10-20 19:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Data aplikací\AVG2013
2012-10-20 19:08 . 2012-10-20 19:28 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\Avg2013
2012-10-20 19:08 . 2012-10-20 19:08 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Local Settings\Data aplikací\MFAData
2012-10-20 17:30 . 2012-10-21 15:40 -------- d-----w- c:\documents and settings\Zdeněk - Kucler\Data aplikací\Systweak
2012-10-08 17:12 . 2012-10-08 17:12 -------- d-----w- c:\program files\FOTOPAK s.r.o
2012-09-22 20:17 . 2012-09-22 20:17 -------- d-----w- c:\program files\Garmin GPS Plugin
2012-09-22 20:17 . 2012-09-22 20:17 -------- d-----w- c:\program files\Garmin
2012-09-22 18:10 . 2012-09-22 18:10 -------- d-----w- c:\program files\Microsoft.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-05 01:26 . 2010-09-07 02:48 93536 ----a-w- c:\windows.0\system32\drivers\avgmfx86.sys
2012-10-02 01:30 . 2010-09-07 02:48 159712 ----a-w- c:\windows.0\system32\drivers\avgldx86.sys
2012-09-21 01:46 . 2010-11-09 21:20 164832 ----a-w- c:\windows.0\system32\drivers\avgtdix.sys
2012-09-21 01:46 . 2012-09-21 01:46 177376 ----a-w- c:\windows.0\system32\drivers\avglogx.sys
2012-09-21 01:45 . 2012-09-21 01:45 19936 ----a-w- c:\windows.0\system32\drivers\avgidsshimx.sys
2012-09-21 01:45 . 2012-09-21 01:45 55008 ----a-w- c:\windows.0\system32\drivers\avgidshx.sys
2012-09-14 01:05 . 2010-09-07 02:48 35552 ----a-w- c:\windows.0\system32\drivers\avgrkx86.sys
2012-09-13 01:11 . 2012-09-13 01:11 177504 ----a-w- c:\windows.0\system32\drivers\avgidsdriverx.sys
2005-02-06 09:53 . 2005-02-06 09:52 226544 ----a-w- c:\program files\java aplet z in..exe
2004-10-01 14:00 . 2006-10-22 16:19 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2003-06-12 19:50 . 2005-02-04 19:55 466944 ----a-w- c:\program files\SETUP1.EXE
2003-06-12 11:37 . 2005-02-04 19:55 45056 ----a-w- c:\program files\CDVPlayer.exe
2000-08-20 23:00 . 2005-02-04 19:55 1388544 ----a-w- c:\program files\msvbvm60.dll
2000-07-14 23:00 . 2005-02-04 19:55 101888 ----a-w- c:\program files\VB6STKIT.DLL
1999-06-02 23:00 . 2005-02-04 19:55 17920 ----a-w- c:\program files\stdole2.tlb
1999-03-07 23:00 . 2005-02-04 19:55 164112 ----a-w- c:\program files\olepro32.dll
1999-03-07 23:00 . 2005-02-04 19:55 147728 -c--a-w- c:\program files\asycfilt.dll
1998-06-17 23:00 . 2005-02-04 19:55 73216 ----a-w- c:\program files\ST6UNST.EXE
1998-05-30 23:00 . 2005-02-04 19:55 22288 ----a-w- c:\program files\COMCAT.DLL
2011-12-21 07:39 . 2012-01-19 10:08 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Garmin Lifetime Updater"="c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe" [2012-06-04 1466760]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\c:^documents and settings^all users.windows.0^application data^microsoft^shortcuts^icwsetup.exe]
path=c:\documents and settings\All Users.WINDOWS.0\Application Data\Microsoft\Shortcuts\icwsetup.exe
backup=c:\windows.0\pss\icwsetup.exeCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS.0\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows.0\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users.WINDOWS.0\Nabídka Start\Programy\Po spuštění\WinZip Quick Pick.lnk
backup=c:\windows.0\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Zdeněk - Kucler^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Zdeněk - Kucler\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.4.lnk
backup=c:\windows.0\pss\OpenOffice.org 2.4.lnkStartup
.
[HKLM\~\startupfolder\c:^documents and settings^zdeněk - kucler^nabídka start^programy^po spuštění^rncsys32.exe]
path=c:\documents and settings\Zdeněk - Kucler\Nabídka Start\Programy\Po spuštění\rncsys32.exe
backup=c:\windows.0\pss\rncsys32.exeStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nokiamserver]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- c:\windows.0\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows.0\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2011-06-14 09:18 1156096 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2006-07-30 17:00 98304 ----a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2011-06-16 14:21 1500160 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task]
2008-03-28 21:37 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-03 11:23 17417392 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 15:17 159744 ----a-r- c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-06-10 02:27 144784 ----a-w- c:\program files\Java\jre1.6.0_07\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-13 20:25 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS.0\\system32\\dpvsetup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\KRISTYNA\\aplikace\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12587:TCP"= 12587:TCP:BitComet 12587 TCP
"12587:UDP"= 12587:UDP:BitComet 12587 UDP
.
R0 AVGIDSHX;AVGIDSHX;c:\windows.0\system32\drivers\avgidshx.sys [21.9.2012 3:45 55008]
R0 Avglogx;AVG Logging Driver;c:\windows.0\system32\drivers\avglogx.sys [21.9.2012 3:46 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows.0\system32\drivers\avgrkx86.sys [7.9.2010 4:48 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows.0\system32\drivers\avgidsdriverx.sys [13.9.2012 3:11 177504]
R1 AVGIDSShim;AVGIDSShim;c:\windows.0\system32\drivers\avgidsshimx.sys [21.9.2012 3:45 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows.0\system32\drivers\avgldx86.sys [7.9.2010 4:48 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows.0\system32\drivers\avgtdix.sys [9.11.2010 23:20 164832]
R1 avgtp;avgtp;c:\windows.0\system32\drivers\avgtpx86.sys [20.10.2012 21:18 26984]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2013\avgfws.exe [2.10.2012 3:32 1314720]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2.10.2012 3:32 193568]
R2 icq service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [3.7.2008 8:50 222968]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [21.10.2012 17:11 676936]
R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [20.10.2012 21:18 711112]
R3 Avgfwdx;Avgfwdx;c:\windows.0\system32\drivers\avgfwdx.sys [12.7.2010 5:33 30944]
R3 MBAMProtector;MBAMProtector;c:\windows.0\system32\drivers\mbam.sys [21.10.2012 17:11 22856]
R3 pcouffin;VSO Software pcouffin;c:\windows.0\system32\drivers\pcouffin.sys [24.2.2007 14:18 47360]
S0 lbd;Lbd;c:\windows.0\system32\DRIVERS\Lbd.sys --> c:\windows.0\system32\DRIVERS\Lbd.sys [?]
S1 7a8c3124;7a8c3124;c:\windows.0\system32\drivers\7a8c3124.sys [14.6.2009 13:16 0]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2.10.2012 3:32 5783672]
S2 Guezdfi;Guezdfi;c:\windows.0\System32\svchost.exe -k netsvcs [18.8.2004 16:00 14336]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24.12.2010 15:48 136176]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [3.7.2012 13:19 160944]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe --> c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows.0\system32\drivers\avgfwdx.sys [12.7.2010 5:33 30944]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [24.12.2010 15:48 136176]
S3 kvpndev;Kerio VPN adapter;c:\windows.0\system32\drivers\kvpndrv.sys [16.6.2006 21:55 59392]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Guezdfi
.
Obsah adresáře 'Naplánované úlohy'
.
2012-10-09 c:\windows.0\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2012-10-22 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 13:47]
.
2012-10-22 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 13:47]
.
2012-10-22 c:\windows.0\Tasks\User_Feed_Synchronization-{5440F777-C8E6-40CA-8DD0-1735E828964C}.job
- c:\windows.0\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 217.11.224.1 217.11.224.2
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0 ... rol_32.CAB
DPF: {50E43D86-A74D-11D0-98CE-004005249458} - hxxps://www.mojebanka.cz/jars/confwiz/MVSGif.cab
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.fotostar.cz/snadno-vlozit ... loader.dll
FF - ProfilePath - c:\documents and settings\Zdeněk - Kucler\Data aplikací\Mozilla\Firefox\Profiles\fopyvst7.default\
FF - prefs.js: browser.search.selectedEngine - WebHledani
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=&mid= ... &sap=ku&q=
FF - ExtSQL: 2012-10-20 21:19; avg@toolbar; c:\documents and settings\All Users.WINDOWS.0\Data aplikací\AVG Secure Search\FireFoxExt\13.2.0.3
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-22 20:03
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(304)
c:\windows.0\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(4068)
c:\windows.0\system32\ieframe.dll
c:\windows.0\system32\webcheck.dll
c:\windows.0\system32\WPDShServiceObj.dll
c:\windows.0\system32\PortableDeviceTypes.dll
c:\windows.0\system32\PortableDeviceApi.dll
.
Celkový čas: 2012-10-22 20:06:43
ComboFix-quarantined-files.txt 2012-10-22 18:06
ComboFix2.txt 2012-10-22 05:47
.
Před spuštěním: Volných bajtů: 34 176 626 688
Po spuštění: Volných bajtů: 34 171 506 688
.
- - End Of File - - D3DC0E3A295AA7372F7197776780B7BA

Odinstaluj AVG Security Toolbar. Dostal se Ti tam při instalaci 2013.

Předtím ten log z CF nebyl celej, takže ještě jednu věc:

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť?.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Jak to máš s Windowsama? Vidím složku Windows.0 namísto Windows. Nedělal si nějaký čachry s OS?

Pardon že se vmíchávám do této diskuze ale všiml jsem si že sken MbAM nebyl celý, byl testován jen HJT.

Scanner: Díky za všimavost. Toho jsme si nevšimli.

Tazatel: Proveď řádně sken pomocí MBAM.

Přikládám log z MBAM a vyčkávám na další instrukce. Co se týče dotazů k WIN, počítač byl dvakrát v servisu v záruce (před několika lety) kvůli grafické kartě a přidání druhého hard disku. Žádnou novou instalaci win jsme neprováděli.

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.10.22.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Zdeněk - Kucler :: KUCLER-9CCB7FB5 [administrátor]

Ochrana: Povolena

22.10.2012 22:29:05
mbam-log-2012-10-22 (22-43-02).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 300623
Uplynulý čas: 11 minut, 37 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Documents and Settings\Zdeněk - Kucler\Data aplikací\wiaserva.log (Malware.Trace) -> Žádná instrukce nebyla provedena.

(konec)