Prosím o kontrolu

[xbart]

Cau lidi, mám problém, když na něco kliknu v FF na nějakej odkaz tak musím kliknout 3x aby se mě otevřel

Kód: Vybrat vše

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:47:07, on 27.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\PROGRA~1\KEMailKb\KEMailKb.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil VoIP Plugin.exe
C:\Documents and Settings\Administrator.XBART-XP.000\Plocha\USDownloader135\USDownloader.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\365dníNET\365dniNET.exe
C:\Program Files\JetAudio\jetAudio.exe
C:\Program Files\QIP Infium\Plugins\Updater\Updater.exe
C:\WINDOWS\explorer.exe
C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe
C:\Program Files\QIP Infium\infium.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator.XBART-XP.000\Plocha\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/cz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [FlashGet] "C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" /min
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMailKb\KEMailKb.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FlashGet] "C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" /min
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
O4 - HKCU\..\Run: [Windows Defragment Tool] C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\QIP\Profiles\xbartosekj\RcvdFiles\Ivoš_493034059\update windows server.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
O8 - Extra context menu item: Send by Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O8 - Extra context menu item: Send via &Message... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5182 bytes


Moc prosím o radu Díky moc

[Reklama]

[jaro3]

Příště ten log nedávej do code...
Antivirový program nemáš, na spyware taky nic, tak to podle toho vypadá...
Odinstaluj BearShare

Stáhni si SDFix
- Spusť ho a rozbalí se ti na disk kde je nainstalovaný Windows (typicky to je C:\SDfix)
- Pak restartuj PC do nouzového režimu (zvol možnost: Stav nouze, ne Stav nouze s práci v síti)
- Otevři adresář kde je vybalený SDFix a spusť soubor RunThis.bat tím spustíš program.
* Pak stiskni klávesu Y a pak Enter pro zahájení čistícího procesu.
* Pro dokončení kontroly budeš vyzván ke stisknutí libovolné klávesy a počítač se restartuje.
* Při nabíhání operačního systému se program spustí znovu a dokončí čistící proces. Až se objeví Finish, budeš muset po vyzvání stisknout libovolnou klávesu, tim se ukončí program a zobrazí se ti ikony na ploše
- Když se skončí načítání ikon na ploše, otevře se ti na obrazovce log z SDFix a zároveň ho uloží do adresáře kde je rozbalený SDFix jako soubor Report.txt
Pak sem zkopíruj jeho obsah + mrkni se jestli ti pod Startem nechybí nějaké ikony, zobrazují se ti disky pod Tento počítač....
Budeme pokračovat zítra..

[xbart]

Hážu sem ten LOG

SDFix: Version 1.238
Run by Administrator on Łt 28.10.2008 at 09:35

Microsoft Windows XP [Verze 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Program Files\zango\bin\10.3.75.0\arrow.ico - Deleted
C:\Program Files\zango\bin\10.3.75.0\CntntCntr.dll - Deleted
C:\Program Files\zango\bin\10.3.75.0\copyright.txt - Deleted
C:\Program Files\zango\bin\10.3.75.0\CoreSrv.dll - Deleted
C:\Program Files\zango\bin\10.3.75.0\HostOL.dll - Deleted
C:\Program Files\zango\bin\10.3.75.0\link.ico - Deleted
C:\Program Files\zango\bin\10.3.75.0\Toolbar.dll - Deleted
C:\Program Files\zango\bin\10.3.75.0\Weather.exe - Deleted
C:\Program Files\zango\bin\10.3.75.0\ZangoSADF.exe - Deleted
C:\Program Files\zango\bin\10.3.75.0\ZangoUninstaller.exe - Deleted
C:\Program Files\zango\bin\10.3.75.0\firefox\extensions\chrome.manifest - Deleted
C:\Program Files\zango\bin\10.3.75.0\firefox\extensions\install.rdf - Deleted
C:\Program Files\zango\bin\10.3.75.0\firefox\extensions\components\npclntax.xpt - Deleted
C:\Program Files\zango\bin\10.3.75.0\firefox\extensions\plugins\npclntax_ZangoSA.dll - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 17:37:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"\f\1e?r?n?é? ?u?k?a?z?a?t?e?l?e? ?"="C:\WINDOWS\cursors\arrow_r.cur,C:\WINDOWS\cursors\help_r.cur,C:\WINDOWS\cursors\wait_r.cur,C:\WINDOWS\cursors\busy_r.cur,C:\WINDOWS\cursors\cross_r.cur,C:\WINDOWS\cursors\beam_r.cur,C:\WINDOWS\cursors\pen_r.cur,C:\WINDOWS\cursors\no_r.cur,C:\WINDOWS\cursors\size4_r.cur,C:\WINDOWS\cursors\size3_r.cur,C:\WINDOWS\cursors\size2_r.cur,C:\WINDOWS\cursors\size1_r.cur,C:\WINDOWS\cursors\move_r.cur,C:\WINDOWS\cursors\up_r.cur"
"\f\1e?r?n?é? ?u?k?a?z?a?t?e?l?e? ?(?v?e?l?k?é?)?"="C:\WINDOWS\cursors\arrow_rm.cur,C:\WINDOWS\cursors\help_rm.cur,C:\WINDOWS\cursors\wait_rm.cur,C:\WINDOWS\cursors\busy_rm.cur,C:\WINDOWS\cursors\cross_rm.cur,C:\WINDOWS\cursors\beam_rm.cur,C:\WINDOWS\cursors\pen_rm.cur,C:\WINDOWS\cursors\no_rm.cur,C:\WINDOWS\cursors\size4_rm.cur,C:\WINDOWS\cursors\size3_rm.cur,C:\WINDOWS\cursors\size2_rm.cur,C:\WINDOWS\cursors\size1_rm.cur,C:\WINDOWS\cursors\move_rm.cur,C:\WINDOWS\cursors\up_rm.cur"
"\f\1e?r?n?é? ?u?k?a?z?a?t?e?l?e? ?(?n?e?j?v?\e\1t?a\1í?)?"="C:\WINDOWS\cursors\arrow_rl.cur,C:\WINDOWS\cursors\help_rl.cur,C:\WINDOWS\cursors\wait_rl.cur,C:\WINDOWS\cursors\busy_rl.cur,C:\WINDOWS\cursors\cross_rl.cur,C:\WINDOWS\cursors\beam_rl.cur,C:\WINDOWS\cursors\pen_rl.cur,C:\WINDOWS\cursors\no_rl.cur,C:\WINDOWS\cursors\size4_rl.cur,C:\WINDOWS\cursors\size3_rl.cur,C:\WINDOWS\cursors\size2_rl.cur,C:\WINDOWS\cursors\size1_rl.cur,C:\WINDOWS\cursors\move_rl.cur,C:\WINDOWS\cursors\up_rl.cur"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe:*:Enabled:BlueSoleilCS"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 3 Oct 2008 355 ..SH. --- "C:\Boot.BAK"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Sun 26 Oct 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Fri 27 Oct 2006 15,360 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Tue 28 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\114735f9eba4babd3a2417a42a17e116\BIT8.tmp"
Tue 28 Oct 2008 1,473,576 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f3f2a89f8825ebe61b46200907d95fd7\BIT7.tmp"

Finished!


BearShare sem odinstaloval, ikonky nechybi... co dal ?

[jaro3]

Najdi a smaž: C:\SDFix

Stáhni si ComboFix (by sUBs)

a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[xbart]

Přihazuju další LOG
Do příspěvku se nevlezl, a txt není jako přiloha povoleno...

ComboFix.txt

Co dál ???

[jaro3]

To je síla..
znovu ComboFix, už se sem mohl vejít..

[xbart]

cože ???

[jaro3]

Znovu rozjeď ComboFix a vlož sem nový log, měl by se vejít , bude již bez těch výmazů.

[xbart]

kdyť sem ti sem dal link na ftp, kam jsem ho uploadnul....
To ho musím udělat znova ?

EDIT:\\ proč mě to smzalo flashget ???

[jaro3]

Combofix nemaže nic nepatřičného, asi byl infikovaný. ZKus ten Combofix znovu a vlož sem , třeba ještě něco najde, v tom .txt je to značně nepřehledný a já potřebuji udělat script.

[xbart]

Nový LOG

ComboFix 08-10-28.01 - Administrator 2008-10-28 20:09:35.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.376 [GMT 1:00]
Spuštěný z: C:\Documents and Settings\Administrator.XBART-XP.000\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\.#
C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\.#\MBX@678@3C3238.###

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-09-28 do 2008-10-28 )))))))))))))))))))))))))))))))
.

2008-10-28 20:19 . 2008-10-28 20:19 <DIR> d--hsc--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\.#
2008-10-28 19:36 . 2008-10-28 19:36 <DIR> d----c--- C:\Program Files\uTorrent
2008-10-28 19:36 . 2008-10-28 20:15 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\uTorrent
2008-10-28 19:16 . 2008-10-28 19:16 410,976 --a--c--- C:\WINDOWS\system32\deploytk.dll
2008-10-28 19:16 . 2008-10-28 19:16 73,728 --a--c--- C:\WINDOWS\system32\javacpl.cpl
2008-10-28 19:09 . 2008-10-28 19:09 13,646 --a--c--- C:\WINDOWS\system32\wpa.bak
2008-10-28 18:02 . 2008-10-28 18:11 <DIR> d----c--- C:\WINDOWS\system32\CatRoot_bak
2008-10-28 18:00 . 2005-02-25 04:34 22,752 --a--c--- C:\WINDOWS\system32\spupdsvc.exe
2008-10-28 09:32 . 2008-10-28 09:32 <DIR> d----c--- C:\WINDOWS\ERUNT
2008-10-27 18:50 . 2008-10-27 18:50 <DIR> d----c--- C:\Program Files\Resource Tuner
2008-10-27 18:50 . 2008-10-27 18:51 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Resource Tuner
2008-10-27 16:22 . 2008-10-28 19:42 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Vista Start Menu
2008-10-27 13:36 . 2008-10-27 13:36 <DIR> d----c--- C:\WINDOWS\365dní
2008-10-27 13:36 . 2008-10-27 13:36 <DIR> d----c--- C:\Program Files\365dníNET
2008-10-27 13:36 . 2008-10-27 13:56 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\365dni
2008-10-27 12:28 . 2008-10-27 12:45 <DIR> d----c--- C:\Program Files\SphereXP
2008-10-27 12:15 . 2008-10-28 09:10 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Teleca
2008-10-27 12:14 . 2008-10-27 12:14 <DIR> d----c--- C:\Program Files\Common Files\Teleca Shared
2008-10-27 12:14 . 2008-10-27 12:14 <DIR> d----c--- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-10-27 12:14 . 2008-10-27 12:14 <DIR> d----c--- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Teleca
2008-10-27 12:14 . 2008-10-27 12:14 <DIR> d----c--- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Sony Ericsson
2008-10-27 12:12 . 2008-10-27 12:12 <DIR> d----c--- C:\WINDOWS\Downloaded Installations
2008-10-27 12:12 . 2008-10-27 12:12 89,872 --a------ C:\WINDOWS\system32\drivers\k750mdm.sys
2008-10-27 12:12 . 2008-10-27 12:12 81,728 --a------ C:\WINDOWS\system32\drivers\k750mgmt.sys
2008-10-27 12:12 . 2008-10-27 12:12 79,488 --a------ C:\WINDOWS\system32\drivers\k750obex.sys
2008-10-27 12:12 . 2008-10-27 12:12 6,576 --a------ C:\WINDOWS\system32\drivers\k750mdfl.sys
2008-10-27 12:12 . 2008-10-27 12:12 6,144 --a------ C:\WINDOWS\system32\drivers\k750cmnt.sys
2008-10-27 12:12 . 2008-10-27 12:12 6,144 --a------ C:\WINDOWS\system32\drivers\k750cm.sys
2008-10-27 12:11 . 2005-07-07 15:26 55,216 -ra------ C:\WINDOWS\system32\drivers\k750bus.sys
2008-10-27 12:11 . 2005-07-07 15:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750whnt.sys
2008-10-27 12:11 . 2005-07-07 15:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750wh.sys
2008-10-27 12:06 . 2008-10-27 12:14 <DIR> d----c--- C:\Program Files\Sony Ericsson
2008-10-26 22:16 . 2008-07-08 01:12 188,547 --a------ C:\wubildr
2008-10-26 22:16 . 2008-07-08 01:12 8,192 --a------ C:\wubildr.mbr
2008-10-26 21:50 . 2008-10-26 21:50 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\COWON
2008-10-26 21:41 . 2008-10-26 21:41 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Canneverbe_Limited
2008-10-26 20:14 . 2008-09-16 01:14 3,596,288 --a--c--- C:\WINDOWS\system32\qt-dx331.dll
2008-10-26 19:36 . 2008-10-26 19:36 <DIR> d----c--- C:\Program Files\MyPhoneExplorer
2008-10-26 19:36 . 2008-10-26 19:37 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\MyPhoneExplorer
2008-10-26 19:36 . 2008-10-26 19:36 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\AD ON Multimedia
2008-10-26 19:30 . 2008-10-26 19:30 <DIR> d----c--- C:\Program Files\Common Files\Macrovision Shared
2008-10-26 19:28 . 2008-10-26 20:17 1,628 --a--c--- C:\WINDOWS\system32\SHORTCUT.INI
2008-10-26 19:27 . 2008-10-28 20:16 4,535 --a--c--- C:\WINDOWS\system32\LOCALSERVICE.INI
2008-10-26 19:27 . 2008-10-28 09:15 124 --a--c--- C:\WINDOWS\system32\REMOTEDEVICE.INI
2008-10-26 19:27 . 2008-10-28 18:59 100 --a--c--- C:\WINDOWS\system32\LOCALDEVICE.INI
2008-10-26 19:11 . 2007-04-18 01:20 566,624 --a--c--- C:\WINDOWS\system32\d3d10.dll
2008-10-26 19:11 . 2007-04-19 01:59 519,912 --a--c--- C:\WINDOWS\system32\d3dx10d_33.dll
2008-10-26 19:11 . 2007-04-19 01:59 519,912 --a--c--- C:\WINDOWS\system32\d3dx10d.dll
2008-10-26 19:11 . 2007-04-18 01:13 494,557 --a--c--- C:\WINDOWS\system32\dxgi.dll
2008-10-26 19:11 . 2006-11-29 13:06 440,080 --a--c--- C:\WINDOWS\system32\d3dx10.dll
2008-10-26 19:11 . 2007-12-22 20:30 34,854 --a--c--- C:\WINDOWS\system32\directx10logo.bmp
2008-10-26 19:11 . 2007-04-18 01:13 25,037 --a--c--- C:\WINDOWS\system32\Nucleus.dll
2008-10-26 19:09 . 2008-10-26 19:09 <DIR> d----c--- C:\Program Files\KEMailKb
2008-10-26 19:09 . 2008-10-26 19:09 77 --a--c--- C:\WINDOWS\KEMailKb.UNI
2008-10-26 19:08 . 2002-10-14 16:23 126,976 --a--c--- C:\WINDOWS\UNINST32.EXE
2008-10-26 19:08 . 2002-11-08 16:21 17,071 --a------ C:\WINDOWS\system32\drivers\DKbFltr.SYS
2008-10-26 19:08 . 2008-10-26 19:08 0 --a--c--- C:\WINDOWS\SelSet.INI
2008-10-26 19:02 . 2008-10-26 19:02 0 --a--c--- C:\WINDOWS\system32\BSPRINT.INI
2008-10-26 18:45 . 2004-08-03 23:07 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2008-10-26 18:45 . 2004-08-03 23:07 2,944 --a--c--- C:\WINDOWS\system32\dllcache\drmkaud.sys
2008-10-26 18:45 . 2008-10-26 19:02 32 --a--c--- C:\WINDOWS\0
2008-10-26 18:45 . 2008-10-26 18:45 0 --a--c--- C:\WINDOWS\system32\0
2008-10-26 18:11 . 2008-10-26 18:11 <DIR> d----c--- C:\Program Files\Realtek AC97
2008-10-26 18:07 . 2008-10-26 18:07 <DIR> d----c--- C:\Documents and Settings\ADMINI~1~000\LOCALS~1
2008-10-26 18:07 . 2008-10-26 18:07 <DIR> d----c--- C:\Documents and Settings\ADMINI~1~000
2008-10-26 17:48 . 2008-10-26 17:48 <DIR> d----c--- C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\QIP
2008-10-26 17:31 . 2008-10-26 17:31 <DIR> d----c--- C:\Program Files\Lavalys
2008-10-26 17:29 . 2004-08-03 22:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2008-10-26 17:29 . 2004-08-03 22:58 5,376 --a--c--- C:\WINDOWS\system32\dllcache\mspclock.sys
2008-10-26 17:28 . 2004-08-03 23:15 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2008-10-26 17:28 . 2004-08-03 23:15 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys
2008-10-26 17:28 . 2004-08-17 15:49 130,048 --a--c--- C:\WINDOWS\system32\ksproxy.ax
2008-10-26 17:28 . 2004-08-17 15:49 130,048 --a--c--- C:\WINDOWS\system32\dllcache\ksproxy.ax
2008-10-26 17:28 . 2004-08-03 23:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-10-26 17:28 . 2004-08-03 23:08 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys
2008-10-26 17:28 . 2004-08-17 15:49 4,096 --a--c--- C:\WINDOWS\system32\ksuser.dll
2008-10-26 17:28 . 2004-08-17 15:49 4,096 --a--c--- C:\WINDOWS\system32\dllcache\ksuser.dll
2008-10-26 17:20 . 2008-10-26 17:20 0 --a--c--- C:\WINDOWS\nsreg.dat
2008-10-26 17:17 . 2008-10-26 17:27 <DIR> d----c--- C:\WINDOWS\system32\NtmsData
2008-10-26 17:13 . 2004-04-23 07:00 116,736 --a--c--- C:\WINDOWS\system32\CNMLM64.DLL
2008-10-26 17:13 . 2004-03-11 18:06 86,016 -ra--c--- C:\WINDOWS\system32\CNMCP64.exe
2008-10-26 17:13 . 2004-04-23 07:00 7,680 --a--c--- C:\WINDOWS\system32\CNMVS64.DLL
2008-10-26 07:10 . 2005-04-05 20:22 261,888 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2008-10-26 07:10 . 2005-04-05 20:22 208,256 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2008-10-26 07:10 . 2005-04-05 20:19 201,728 -ra--c--- C:\WINDOWS\system32\fdco1ins.dll
2008-10-26 07:10 . 2005-04-05 20:19 201,728 -ra--c--- C:\WINDOWS\system32\fdco1.dll
2008-10-26 07:10 . 2005-05-13 03:52 176,128 -ra--c--- C:\WINDOWS\system32\nvusmb.exe
2008-10-26 07:10 . 2005-06-03 15:07 176,128 --a--c--- C:\WINDOWS\system32\nvunrm.exe
2008-10-26 07:10 . 2005-04-05 20:22 33,536 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2008-10-26 07:10 . 2005-04-04 12:00 32,256 -ra--c--- C:\WINDOWS\system32\nvconrm.dll
2008-10-26 07:10 . 2005-04-05 20:22 12,928 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2008-10-26 07:10 . 2005-04-05 20:19 9,728 -ra--c--- C:\WINDOWS\system32\bdco1ins.dll
2008-10-26 07:10 . 2005-04-05 20:19 9,728 -ra--c--- C:\WINDOWS\system32\bdco1.dll
2008-10-26 07:10 . 2005-02-08 07:26 3,596 --a--c--- C:\WINDOWS\system32\nvnrm.nvu
2008-10-26 07:09 . 2008-10-26 07:09 <DIR> d----c--- C:\Program Files\Western Digital Technologies
2008-10-26 07:09 . 2005-02-08 07:26 1,231 -ra--c--- C:\WINDOWS\system32\nvsmb.nvu
2008-10-26 07:08 . 2008-10-28 20:19 558 --a--c--- C:\WINDOWS\DFC.INI
2008-10-26 07:07 . 2008-10-26 07:07 <DIR> d----c--- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\nView_Profiles
2008-10-26 07:06 . 2005-05-17 10:45 300,032 --a--c--- C:\WINDOWS\system32\idecoi.dll
2008-10-26 07:06 . 2005-05-17 10:45 92,800 -ra------ C:\WINDOWS\system32\drivers\nvatabus.sys
2008-10-26 07:06 . 2005-05-17 10:45 92,800 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2008-10-26 07:06 . 2003-05-25 03:11 60,416 --a--c--- C:\WINDOWS\system32\antiwpa.dll
2008-10-26 07:05 . 2006-11-17 05:40 18,804,736 --a--c--- C:\WINDOWS\system32\alsndmgr.cpl
2008-10-26 07:05 . 2006-12-08 15:20 10,528,768 --a--c--- C:\WINDOWS\system32\RTLCPL.exe
2008-10-26 07:05 . 2008-09-24 10:40 4,122,368 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2008-10-26 07:05 . 2007-04-16 15:28 577,536 --a--c--- C:\WINDOWS\soundman.exe
2008-10-26 07:05 . 2006-07-31 11:19 315,392 --a--c--- C:\WINDOWS\alcupd.exe
2008-10-26 07:05 . 2006-07-31 11:27 217,088 --a--c--- C:\WINDOWS\Alcrmv.exe
2008-10-26 07:05 . 2006-10-18 02:53 147,456 --a--c--- C:\WINDOWS\system32\RtlCPAPI.dll
2008-10-26 07:05 . 2002-02-05 13:54 141,016 --a--c--- C:\WINDOWS\system32\alsndmgr.wav
2008-10-26 07:05 . 2006-08-01 15:02 49,152 --a--c--- C:\WINDOWS\system32\ChCfg.exe
2008-10-26 05:16 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-10-26 05:14 . 2004-08-17 16:43 58,240 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-10-26 05:14 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-10-26 05:13 . 2001-08-17 22:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-10-26 05:12 . 2004-08-17 16:49 153,088 --a--c--- C:\WINDOWS\system32\irftp.exe
2008-10-26 05:12 . 2004-08-04 00:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2008-10-26 05:12 . 2004-08-17 16:49 75,264 --a--c--- C:\WINDOWS\system32\usbui.dll
2008-10-26 05:12 . 2004-08-17 16:49 26,624 --a--c--- C:\WINDOWS\system32\irmon.dll
2008-10-26 05:12 . 2001-08-17 22:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2008-10-26 05:12 . 2001-08-17 22:51 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys
2008-10-26 05:12 . 2004-08-17 16:49 8,192 --a--c--- C:\WINDOWS\system32\wshirda.dll
2008-10-26 05:09 . 2008-10-26 05:09 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Plocha
2008-10-26 05:09 . 2008-10-26 05:09 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS\Okolní tiskárny
2008-10-26 05:09 . 2008-10-26 05:09 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS\Okolní síť

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-27 16:57 --------- dc----w C:\Program Files\Steam
2008-10-27 15:22 --------- dc----w C:\Program Files\Vista Start Menu
2008-10-27 08:04 --------- dc----w C:\Program Files\JetAudio
2008-10-27 08:04 --------- dc----w C:\Program Files\Common Files\COWON
2008-10-26 20:33 --------- dc----w C:\Program Files\CDBurnerXP
2008-10-26 19:36 --------- dc----w C:\Program Files\Common Files\Adobe
2008-10-26 19:15 --------- dc----w C:\Program Files\K-Lite Codec Pack
2008-10-26 18:59 --------- dc----w C:\Program Files\TC PowerPack
2008-10-26 06:05 219,648 -c--a-w C:\WINDOWS\system32\uxtheme.dll
2008-10-26 06:05 --------- dc----w C:\Program Files\AvRack
2008-10-24 14:06 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Vista Start Menu
2008-10-23 18:27 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\FileZilla
2008-10-20 17:18 --------- dc----w C:\Program Files\Java
2008-10-19 19:05 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-10-18 17:27 --------- dc----w C:\Program Files\Canon
2008-10-18 17:08 --------- dc----w C:\Program Files\Common Files\InstallShield
2008-10-16 18:10 --------- dc----w C:\Program Files\MSBuild
2008-10-15 14:56 --------- dc----w C:\Program Files\QIP Infium
2008-10-14 17:31 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Hamachi
2008-10-14 06:14 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Corel
2008-10-11 21:49 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Nero
2008-10-11 11:46 --------- dc----w C:\Program Files\Common Files\Nero
2008-10-11 11:27 --------- dc----w C:\Program Files\Nero
2008-09-27 18:42 --------- dc----w C:\Program Files\Common Files\Thraex Software
2008-09-27 18:23 --------- dc----w C:\Program Files\NSIS
2008-09-27 17:01 --------- dc----w C:\Program Files\Common Files\Java
2008-09-26 18:16 --------- dc----w C:\Program Files\QuickTime
2008-09-26 18:13 --------- dc----w C:\Program Files\Common Files\Apple
2008-09-26 18:10 --------- dc----w C:\Program Files\Apple Software Update
2008-09-26 14:14 --------- dc----w C:\Program Files\Ashampoo
2008-09-25 13:21 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Ahead
2008-09-24 19:13 --------- dc----w C:\Program Files\Corel
2008-09-24 19:13 --------- dc----w C:\Program Files\Common Files\Corel
2008-09-23 18:08 --------- dc----w C:\Program Files\CDex_170b2
2008-09-23 17:42 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\CD-LabelPrint
2008-09-23 17:25 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Canneverbe_Limited
2008-09-22 20:15 --------- dc----w C:\Program Files\MSECache
2008-09-21 18:46 --------- dc----w C:\Program Files\VTFEdit
2008-09-20 16:45 --------- dc----w C:\Program Files\DAEMON Tools Toolbar
2008-09-20 16:45 --------- dc----w C:\Program Files\DAEMON Tools Lite
2008-09-19 17:02 --------- dc----w C:\Program Files\Hamachi
2008-09-19 16:57 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\DAEMON Tools
2008-09-19 13:03 --------- dc----w C:\Program Files\Common Files\Adobe AIR
2008-09-19 13:03 --------- dc----w C:\Program Files\Adobe Media Player
2008-09-18 16:49 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Thinstall
2008-09-18 16:49 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\Media Player Classic
2008-09-18 16:49 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\ICQ
2008-09-18 16:49 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\COWON
2008-09-18 12:25 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\QIP
2008-09-18 12:23 --------- dc----w C:\Program Files\muvee Technologies
2008-09-18 12:23 --------- dc----w C:\Program Files\Common Files\muvee Technologies
2008-09-18 12:21 --------- dc----w C:\Documents and Settings\Administrator.XBART-XP\Data aplikací\InstallShield
2008-09-16 19:40 --------- dc----w C:\Program Files\VideoLAN
2008-09-16 00:12 81,920 -c--a-w C:\WINDOWS\system32\dpl100.dll
2008-09-16 00:11 683,520 -c--a-w C:\WINDOWS\system32\divx.dll
2008-09-14 18:14 --------- dc----w C:\Program Files\Microsoft Works
2008-09-13 07:06 --------- dc----w C:\Program Files\MSXML 4.0
2008-09-11 18:29 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\Nero
2008-09-11 17:37 --------- dc----w C:\Program Files\Philips
2008-09-10 18:55 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\FileZilla
2008-09-10 17:46 --------- dc----w C:\Program Files\Alwil Software
2008-09-10 16:52 --------- dc----w C:\Program Files\Microsoft.NET
2008-09-09 19:10 --------- dc----w C:\Program Files\MagicDisc
2008-09-09 19:02 --------- dc----w C:\Program Files\Elaborate Bytes
2008-09-08 18:24 --------- dc----w C:\Program Files\Apache Software Foundation
2008-09-07 15:38 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\COWON
2008-09-06 19:43 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\InstallShield
2008-09-04 16:58 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\Thinstall
2008-09-04 11:27 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\Media Player Classic
2008-09-03 18:02 --------- dc----w C:\Program Files\Uloz.to Uploader
2008-09-03 17:31 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\ICQ
2008-09-03 17:24 --------- dc----w C:\Program Files\Restorator 2007
2008-09-03 17:06 --------- dc----w C:\Documents and Settings\Administrator\Data aplikací\QIP
2008-09-02 19:17 --------- dc----w C:\Program Files\Realtek Sound Manager
2008-09-02 19:16 --------- dc----w C:\Program Files\AMD
2008-09-02 19:07 --------- dc----w C:\Program Files\microsoft frontpage
2008-08-04 16:36 405,589 -c--a-w C:\WINDOWS\system32\BsUI.dll
2008-08-04 16:33 143,450 -c--a-w C:\WINDOWS\system32\BsCommon.dll
2008-08-01 14:59 9,728 -c--a-w C:\WINDOWS\system32\BsMonUI.dll
2008-08-01 14:59 18,432 -c--a-w C:\WINDOWS\system32\BsMonSvr.dll
2008-08-01 14:58 622,693 -c--a-w C:\WINDOWS\system32\BSShell.dll
2008-08-01 14:58 57,430 -c--a-w C:\WINDOWS\system32\btfunc.dll
2008-08-01 14:58 540,758 -c--a-w C:\WINDOWS\system32\Bscdlg.dll
2008-08-01 14:58 53,248 -c--a-w C:\WINDOWS\system32\HtmPrintHelper.dll
2008-08-01 14:58 278,647 -c--a-w C:\WINDOWS\system32\outlookAddin.dll
2008-08-01 14:58 114,774 -c--a-w C:\WINDOWS\system32\versit.dll
2008-08-01 14:57 94,314 -c--a-w C:\WINDOWS\system32\BsHelpCSps.dll
2008-08-01 14:57 520,307 -c--a-w C:\WINDOWS\system32\BlueSoleilCSps.dll
2008-08-01 14:57 114,788 -c--a-w C:\WINDOWS\system32\BsProfileFunc.dll
2008-08-01 14:56 98,403 -c--a-w C:\WINDOWS\system32\Bs2Res.dll
2008-08-01 14:56 28,766 -c--a-w C:\WINDOWS\system32\PlayerCtrl.dll
2008-08-01 14:56 225,364 -c--a-w C:\WINDOWS\system32\BsSDK.dll
2008-08-01 14:55 28,760 -c--a-w C:\WINDOWS\system32\BsTrace.dll
2008-08-01 14:55 28,672 -c--a-w C:\WINDOWS\system32\BsMobileCSps.dll
2008-08-01 14:55 118,880 -c--a-w C:\WINDOWS\system32\BsMobileSDK.dll
2008-08-01 14:46 65,536 -c--a-w C:\WINDOWS\system32\BsVistaCommon.dll
2008-08-01 14:46 41,049 -c--a-w C:\WINDOWS\system32\skypeagent.dll
2008-08-01 14:46 17,907,824 -c--a-w C:\WINDOWS\system32\BsLangInDepRes.dll
2008-08-01 14:46 1,717,848 -c--a-w C:\WINDOWS\system32\skype4com.dll
2006-05-03 09:06 163,328 -csh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 -csh--r C:\WINDOWS\system32\msfDX.dll
.

Kód: Vybrat vše

<pre>
-c--a-w           291,928 2008-10-03 19:19:44  C:\Documents and Settings\Administrator.XBART-XP\Dokumenty\VirtualDJ\Plugins\VideoEffect\PictureRotation v1.1 .exe
-c--a-w           291,928 2008-10-03 19:20:02  C:\Documents and Settings\Administrator.XBART-XP\Dokumenty\VirtualDJ\Plugins\VideoEffect\PictureRotation v1.1\PictureRotation v1.1 .exe
-c--a-w           291,928 2008-10-03 19:19:42  C:\Documents and Settings\Administrator.XBART-XP\Dokumenty\VirtualDJ1\Plugins\VideoEffect\PictureRotation v1.1 .exe
-c--a-w           291,928 2008-10-03 19:20:01  C:\Documents and Settings\Administrator.XBART-XP\Dokumenty\VirtualDJ1\Plugins\VideoEffect\PictureRotation v1.1\PictureRotation v1.1 .exe
</pre>

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 15360]
"FlashGet"="C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" [N/A]
"VistaStartMenu"="C:\Program Files\Vista Start Menu\VistaStartMenu.exe" [2008-06-23 1245209]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2008-01-09 2189864]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-09 13508608]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-09 86016]
"FlashGet"="C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" [N/A]
"BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-08-04 226816]
"KEMailKb"="C:\PROGRA~1\KEMailKb\KEMailKb.EXE" [2002-12-31 253952]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-28 136600]
"nwiz"="nwiz.exe" [2008-01-09 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-18 15360]

C:\Documents and Settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2008-09-09 575488]
registrycleaner.exe [2008-10-27 1301464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 BtHidBus;Bluetooth HID Bus Service;C:\WINDOWS\system32\Drivers\BtHidBus.sys [2008-07-31 20616]
R2 BlueSoleilCS;BlueSoleilCS;C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2008-10-26 775168]
R2 BsMobileCS;BsMobileCS;C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-08-01 143467]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-28 152984]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096]
R3 BsHelpCS;BsHelpCS;C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2008-08-01 69735]
R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\WINDOWS\system32\Drivers\IvtBtBus.sys [2008-07-02 26248]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-18 69120]
S3 TVICHW32;TVICHW32;C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4ec11fc-a312-11dd-953c-806d6172696f}]
\Shell\AutoRun\command - J:\setup.exe
.
.
------- Doplňkový sken -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Mozilla\Firefox\Profiles\z485lcld.default\
FF -: plugin - C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 20:18:03
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


C:\Documents and Settings\Administrator.XBART-XP.000\Data aplikací\Mozilla\Firefox\Profiles\z485lcld.default\parent.lock 0 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Celkový čas: 2008-10-28 20:25:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-10-28 19:25:25
ComboFix2.txt 2008-10-28 18:11:57

Před spuštěním: Volných bajtů: 15 949 230 080
Po spuštění: Volných bajtů: 15,943,524,352

337 --- E O F --- 2008-10-28 17:00:30

[jaro3]

Script vypracuji zítra a pošlu.