Kontrola logu + nefinkční torrenty, nastavení routeru

[MaxDamageCZ]

Daemon tools toolbar=Zničen pomocí revo uninstaller
Free download toolbar=taktéž


Ten C:\WINDOWS\System32\productregistry neznám, co je s ním?


OTL bude za moment

[Reklama]

[MaxDamageCZ]

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL| /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D5D47440-0750-463D-BAEF-A47D02414806} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D5D47440-0750-463D-BAEF-A47D02414806}\ deleted successfully.
========== FILES ==========
C:\NV32483252.TMP folder moved successfully.
C:\NV32563260.TMP folder moved successfully.
C:\WINDOWS\002564_.tmp moved successfully.
C:\WINDOWS\msdownld.tmp folder moved successfully.
C:\WINDOWS\NV33883400.TMP folder moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
File\Folder C:\WINDOWS\System32\*.tmp not found.
C:\WINDOWS\tasks\SA.DAT moved successfully.
C:\WINDOWS\System32\ezsidmv.dat moved successfully.
C:\Documents and Settings\Matěj\Dokumenty\pinfect.zip moved successfully.
C:\WINDOWS\System32\mlfcache.dat moved successfully.
C:\WINDOWS\VDLL.DLL folder moved successfully.
C:\WINDOWS\System32\runouce.exe folder moved successfully.
C:\WINDOWS\RUNDL132.EXE folder moved successfully.
C:\WINDOWS\logo_1.exe folder moved successfully.
C:\WINDOWS\System32\eEmpty.exe moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Kuma
->Temp folder emptied: 2014 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 15414529 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Marek
->Temp folder emptied: 4377712 bytes
->Temporary Internet Files folder emptied: 360819987 bytes
->Java cache emptied: 13689500 bytes
->FireFox cache emptied: 95167197 bytes

User: Matěj
->Temp folder emptied: 286161162 bytes
->Temporary Internet Files folder emptied: 7884932 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 76688907 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 499982 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 560273 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1849907 bytes

Total Files Cleaned = 823,26 mb


OTL by OldTimer - Version 3.1.17.0 log created on 12152009_154129

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Matěj\Local Settings\Temp\~DF2706.tmp not found!
File\Folder C:\Documents and Settings\Matěj\Local Settings\Temp\~DF281A.tmp not found!

Registry entries deleted on Reboot...

[Damned]

Co obsahuje ta složka? Prohlídni i skryté soubory, pokud je prázdná, smaž ji.

Vlož mi log z HJT a popiš chování PC.

[MaxDamageCZ]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:24:07, on 15.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Matěj\Plocha\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Matěj\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0551591984
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 4831 bytes





A ta vec co jsi psal, to byl soubor, tak jsem ho smazal...

Bohuzel, chovani stale stejne, 10.0.0.1 udajne neexistuje

[Damned]

1) stáhni si FixIEDef

2) Ukonči všechny aplikace a spusť FixIEDef

3) potvrdit licenční ujednání tlačítkem [Accept]

4) zahájit scan tlačítkem [Scan] (během scanu budou ukončeny všechny instance Internet Eploreru a Windows Exploreru (zmizí ikony na ploše, taskbar, atd), takže doporučuju veškerou práci uložit a před spuštěním scanu aplikace ukončit)

5) po dokončení scanu ukončit FixIEDef tlačítkem [Exit]

6) pokud se po dokončení nespustí windows explorer, zmáčknout CTRL+SHIFT+ESC a spustit windows explorer (plochu) pomocí menu Soubor > nová úloha > explorer

7) zkopíruj sem FixIEDef log, kterej se uložil na plochu...

[MaxDamageCZ]

*******************************************************************************
* *
* FixIEDef Log *
* Version 1.7.22.7514 *
* *
********************************************************************************

Created at 21:42:32 on Tuesday, December 15, 2009

Time Zone :

Logged On User : Matěj

Operating System : Microsoft Windows XP Home Edition Service Pack 3
OS Architecture : X86
System Langauge : Czech
Keyboard Layout : Czech
Processor : X64 AMD Athlon(tm) 64 Processor 3000+

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

System Drive Type : Fixed
System Drive Status : READY
System Drive Label :
System Drive Size : 238.46 GB
System Drive Free : 161.92 GB

Total Physical Memory: 1023 MB
Free Physical Memory : 628 MB
Total Page File : 1023 MB
Free Page File : 2145 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1960 MB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! userinit.exe is Clean !!!

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

No malicious files found

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done :)

ShadowPuterDude

Safe Surfing!!!

[MaxDamageCZ]

Bohužel stále nic ještě zkusím MWAV a kdyžtak dám log

[MaxDamageCZ]

Objekt "Spyware.KeyProwler Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" odkazuje na neplatný objekt "C:\WINDOWS\Downloaded Program Files\AcDcToday.ocx". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" odkazuje na neplatný objekt "C:\WINDOWS\Downloaded Program Files\AcPreview.ocx". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" odkazuje na neplatný objekt "C:\WINDOWS\Downloaded Program Files\InstFred.ocx". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" odkazuje na neplatný objekt "C:\Program Files\Microsoft Office\Office\MSO9.DLL". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" odkazuje na neplatný objekt "C:\Program Files\Microsoft Office\Office\1033\OFMAIN9.CHM". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" odkazuje na neplatný objekt "C:\Program Files\Microsoft Office\Office\1033\VBAOFF9.CHM". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" odkazuje na neplatný objekt "C:\Program Files\Microsoft Office\Office\SIGNER.DLL". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" odkazuje na neplatný objekt "C:\Program Files\Microsoft Office\Office\1033\MSO9INTL.DLL". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" odkazuje na neplatný objekt "C:\DOCUME~1\MATJ~1\LOCALS~1\Temp\SqlSetup\Temp\". Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" odkazuje na neplatný objekt "C:\DOCUME~1\MATJ~1\LOCALS~1\Temp\SqlSetup\". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Documents and Settings\Matěj\Dokumenty\Stažené soubory\brutus.zip je infikovaný virem Application.PWCrack.Brutus.A (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Documents and Settings\Matěj\Dokumenty\Stažené soubory\stealthkeylogger.exe je infikovaný virem Application.Keylogger.PXO (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\System Volume Information\_restore{9486C892-8CBE-41B9-8055-E33AB273F1A6}\RP1\A0000023.bat je infikovaný virem Trojan.Script.9311 (DB) !! Provedené akce: Ponecháno, neodstraněno!.

[Damned]

Omlouvám se, že jsem tu nebyl, ale jsem nějakej nachcípanej. Takže jen kousek než se zas půjdu potit.

Vypni si a poté zapni Body obnovení.
Soubory:
C:\Documents and Settings\Matěj\Dokumenty\Stažené soubory\brutus.zip
C:\Documents and Settings\Matěj\Dokumenty\Stažené soubory\stealthkeylogger.exe

smaž.

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si KittyFix (by sUBs)
nebo [http://tinyurl.com/ycc4ls4]KittyFix (subs)[/url]
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování KittyFix neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

KittyFix je betaverze ComboFixu. Zkoušel jsem jí teď hodinu na třech PC a nic se jim nestalo.

[MaxDamageCZ]

Píše mi to chyba 404 soubor nebyl nalezen, jak v Google chrome tak v IE 8

[Damned]

Seš prostě pomalej.....


Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[MaxDamageCZ]

ComboFix 09-12-26.04 - Matěj 27.12.2009 12:43:06.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.645 [GMT 1:00]
Spuštěný z: c:\documents and settings\Matěj\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents
c:\windows\regedit.com
c:\windows\system32\SIntf16.dll
c:\windows\system32\taskmgr.com

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-11-27 do 2009-12-27 )))))))))))))))))))))))))))))))
.

2009-12-17 12:58 . 2009-12-17 12:58 -------- d---a-w- c:\windows\rundll16.exe
2009-12-17 12:58 . 2009-12-17 12:58 -------- d---a-w- c:\windows\logo1_.exe
2009-12-17 12:26 . 2009-12-23 14:06 -------- d-----w- c:\program files\World of Warcraft
2009-12-17 09:09 . 2009-12-17 09:09 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-17 09:04 . 2009-12-17 09:04 -------- d---a-w- c:\windows\VDLL.DLL
2009-12-17 09:04 . 2009-12-17 09:04 -------- d---a-w- c:\windows\system32\runouce.exe
2009-12-17 09:04 . 2009-12-17 09:04 -------- d---a-w- c:\windows\RUNDL132.EXE
2009-12-17 09:04 . 2009-12-17 09:04 -------- d---a-w- c:\windows\logo_1.exe
2009-12-17 09:01 . 2009-12-17 09:01 34048 ----a-w- c:\windows\system32\eEmpty.exe
2009-12-16 13:39 . 2009-12-26 20:15 -------- d-----w- c:\program files\SpeedFan
2009-12-16 13:32 . 2009-12-16 13:32 -------- d-----w- c:\program files\Lavalys
2009-12-16 08:40 . 2009-12-16 08:40 160 ----a-w- c:\windows\y.reg
2009-12-15 20:41 . 2009-12-15 20:41 -------- d-----w- C:\ERDNT
2009-12-15 20:41 . 2009-12-15 20:41 -------- d-----w- c:\windows\ERUNT
2009-12-15 20:41 . 2009-12-15 20:41 -------- d-----w- C:\!FixIEDef
2009-12-15 14:47 . 2009-12-15 14:47 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-15 14:41 . 2009-12-15 14:41 -------- d-----w- C:\_OTL
2009-12-15 10:03 . 2009-12-15 10:03 -------- d-----w- c:\program files\GIMP-2.0
2009-12-15 09:58 . 2009-12-15 09:59 -------- d-----w- c:\program files\GIMP-2
2009-12-15 09:24 . 2008-04-14 03:22 54272 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-12-15 09:24 . 2008-04-14 03:22 54272 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-12-15 09:24 . 2008-04-13 18:46 38912 -c--a-w- c:\windows\system32\dllcache\avc.sys
2009-12-15 09:24 . 2008-04-13 18:46 38912 ----a-w- c:\windows\system32\drivers\avc.sys
2009-12-15 09:24 . 2008-04-13 18:46 48128 -c--a-w- c:\windows\system32\dllcache\61883.sys
2009-12-15 09:24 . 2008-04-13 18:46 48128 ----a-w- c:\windows\system32\drivers\61883.sys
2009-12-15 07:56 . 2002-12-17 15:23 33340 ------w- c:\windows\system32\dbmsqlgc.dll
2009-12-15 07:56 . 2002-10-20 13:05 24576 ------w- c:\windows\system32\dbmsgnet.dll
2009-12-15 07:55 . 2009-12-15 07:55 -------- d-----w- c:\program files\Microsoft SQL Server
2009-12-15 07:54 . 2009-12-15 07:54 -------- d-----w- c:\program files\Vstplugins
2009-12-15 07:53 . 2009-12-15 07:53 -------- d-----w- c:\program files\Sony
2009-12-15 07:52 . 2009-12-15 07:52 -------- d-----w- c:\program files\Sony Setup
2009-12-15 07:45 . 2009-12-17 14:29 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-12-11 17:30 . 2009-12-11 17:30 -------- d-----w- C:\VideoCAM Express V2
2009-12-11 17:14 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-11 14:19 . 2009-12-11 14:19 -------- d-----w- c:\program files\Common Files\Skype
2009-12-11 14:19 . 2009-12-11 14:19 -------- d-----r- c:\program files\Skype
2009-12-11 14:07 . 2009-12-11 14:13 -------- d-----w- c:\program files\ICQ6.5
2009-12-10 15:19 . 2009-12-10 15:19 -------- d-----w- c:\program files\ESET
2009-12-09 19:17 . 2009-12-09 19:17 -------- d-----w- c:\windows\system32\IOSUBSYS
2009-12-09 19:17 . 2009-12-09 19:17 -------- d-----w- c:\program files\Google
2009-12-09 14:13 . 2009-12-09 14:13 632064 ----a-w- c:\windows\system32\msvcr80.dll
2009-12-09 14:13 . 2009-12-09 14:13 554240 ----a-w- c:\windows\system32\msvcp80.dll
2009-12-09 14:13 . 2008-04-14 03:22 137216 ----a-w- c:\windows\system32\T.COM
2009-12-09 14:13 . 2008-04-14 03:22 147968 ----a-w- c:\windows\R.COM
2009-12-09 14:13 . 2009-12-09 14:13 -------- d-----w- c:\program files\Common Files\MicroWorld
2009-12-08 15:22 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-08 15:22 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-08 15:22 . 2009-12-08 15:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-07 17:36 . 2009-12-07 17:37 -------- d-----w- c:\windows\system32\drivers\umdf
2009-12-07 17:16 . 2009-12-07 17:16 -------- d-----w- c:\program files\Common Files\CyberLink
2009-12-07 16:59 . 2009-12-07 17:17 -------- d-----w- c:\program files\CyberLink
2009-12-07 16:58 . 2009-12-07 16:58 29480 ----a-w- c:\windows\system32\msxml3a.dll
2009-12-07 16:00 . 2009-12-07 16:00 -------- d-----w- c:\program files\HyCam2
2009-12-05 11:50 . 2009-12-05 11:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-04 17:51 . 2009-12-04 18:26 -------- d-----w- C:\My Video
2009-12-04 17:50 . 2009-12-04 18:26 5 ----a-w- c:\windows\system32\SySwmvtoavi.dat
2009-12-04 17:50 . 2009-12-04 17:50 -------- d-----w- c:\program files\Crystal Software
2009-12-04 17:46 . 2009-12-04 17:46 -------- d-----w- c:\program files\Pure Motion
2009-12-04 17:46 . 2009-12-04 17:46 -------- d-----w- c:\program files\Sonic Foundry
2009-12-04 17:46 . 2009-12-04 17:46 -------- d-----w- c:\program files\DebugMode
2009-12-04 17:18 . 2009-12-04 17:18 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared
2009-11-30 17:47 . 2009-11-30 17:47 -------- d-----w- c:\program files\Autodesk
2009-11-28 14:53 . 1999-06-03 11:05 170496 ----a-w- c:\windows\system32\awrtl30.dll
2009-11-28 14:53 . 1998-08-04 10:22 111616 ----a-w- c:\windows\system32\Ltih30tb.dll
2009-11-28 14:53 . 2009-11-28 14:53 -------- d-----w- c:\program files\Common Files\WexTech Shared
2009-11-28 14:53 . 2009-11-28 14:53 -------- d-----w- c:\program files\WexTech
2009-11-28 14:53 . 2009-11-28 14:53 -------- d-----w- c:\program files\Common Files\LHSPF
2009-11-28 14:53 . 2009-11-28 14:53 -------- d-----w- c:\windows\system32\Downloaded Program Files
2009-11-28 14:52 . 2009-11-28 14:52 -------- d-----w- c:\windows\occache
2009-11-28 14:51 . 2009-11-29 18:21 -------- d-----w- c:\program files\Autodesk Architectural Desktop 3
2009-11-28 13:49 . 2009-11-28 13:49 -------- d-----w- c:\temp\RTS327000
2009-11-28 13:49 . 2009-11-28 13:49 -------- d-----w- C:\temp
2009-11-28 13:32 . 2009-11-28 13:32 -------- d-----w- c:\program files\Common Files\AB Studio Shared
2009-11-28 13:31 . 1998-10-09 17:04 327168 ----a-w- c:\windows\IsUn0405.exe
2009-11-28 13:31 . 2009-11-28 14:46 -------- d-----w- C:\C_DILLA
2009-11-28 13:29 . 2009-11-28 14:54 -------- d-----w- c:\program files\Common Files\Autodesk Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-17 12:46 . 2009-11-04 15:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-17 10:34 . 2009-11-04 15:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-17 07:27 . 2009-11-12 11:19 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-12-15 07:57 . 2004-08-18 12:00 482838 ----a-w- c:\windows\system32\perfh005.dat
2009-12-15 07:57 . 2004-08-18 12:00 105884 ----a-w- c:\windows\system32\perfc005.dat
2009-12-13 14:52 . 2009-11-20 09:38 -------- d-----w- c:\program files\IObit
2009-12-08 16:13 . 2009-11-12 11:19 215104 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-12-07 16:58 . 2003-03-18 19:14 505128 ----a-w- c:\windows\system32\msvcp71.dll
2009-12-07 16:58 . 2003-02-21 03:42 353576 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-07 16:41 . 2009-11-06 19:48 691696 ----a-w- c:\windows\system32\drivers\sptd.sys.13370192
2009-11-27 16:00 . 2009-11-12 11:20 138576 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-11-26 17:09 . 2004-08-18 12:00 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-11-26 16:56 . 2009-11-23 16:19 -------- d-----w- c:\program files\Java
2009-11-25 17:38 . 2009-11-25 17:36 -------- d-----w- c:\program files\DivX
2009-11-25 17:36 . 2009-11-25 17:36 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-11-23 16:25 . 2009-11-23 16:24 -------- d-----w- c:\program files\UltraVNC
2009-11-21 16:03 . 2004-08-18 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-20 14:35 . 2009-11-04 16:12 -------- d-----w- c:\program files\AMD
2009-11-20 09:05 . 2009-11-20 09:05 -------- d-----w- c:\program files\iTunes
2009-11-20 09:05 . 2009-11-20 09:05 -------- d-----w- c:\program files\iPod
2009-11-20 09:05 . 2009-11-16 14:00 -------- d-----w- c:\program files\Common Files\Apple
2009-11-19 11:25 . 2009-11-03 15:50 -------- d-----w- c:\program files\Electronic Arts
2009-11-19 09:31 . 2009-11-19 09:31 -------- d-----w- c:\program files\Aiseesoft Studio
2009-11-16 14:02 . 2009-11-16 14:02 -------- d-----w- c:\program files\Bonjour
2009-11-16 14:02 . 2009-11-16 14:01 -------- d-----w- c:\program files\QuickTime
2009-11-16 14:01 . 2009-11-16 14:01 -------- d-----w- c:\program files\Apple Software Update
2009-11-16 12:05 . 2009-11-16 12:05 -------- d-----w- c:\program files\WinSCP
2009-11-16 08:06 . 2009-11-16 08:06 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-11-16 08:06 . 2009-11-16 08:06 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-11-16 08:03 . 2009-11-16 08:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 07:56 . 2009-11-16 07:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-11-14 00:49 . 2009-11-04 15:51 129784 ------w- c:\windows\system32\pxafs.dll
2009-11-14 00:49 . 2009-11-04 15:51 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-11-14 00:49 . 2009-11-04 15:51 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-12 14:13 . 2009-11-12 14:13 -------- d-----w- c:\program files\OpenOffice.org 3
2009-11-11 18:25 . 2009-11-11 18:25 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-11-09 14:47 . 2009-11-09 14:47 -------- d-----w- c:\program files\MSBuild
2009-11-09 14:47 . 2009-11-09 14:47 -------- d-----w- c:\program files\Reference Assemblies
2009-11-08 16:13 . 2009-11-08 16:13 -------- d-----w- c:\program files\Microsoft WSE
2009-11-07 11:23 . 2009-11-07 11:23 -------- d-----w- c:\program files\CCleaner
2009-11-06 19:53 . 2009-11-06 19:53 -------- d-----w- c:\program files\AGEIA Technologies
2009-11-06 19:53 . 2009-11-06 19:53 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-06 19:50 . 2009-11-06 19:50 -------- d-----w- c:\program files\Alcohol Soft
2009-11-05 16:01 . 2009-11-05 16:01 -------- d-----w- c:\program files\Realtek AC97
2009-11-04 19:24 . 2009-11-04 19:01 -------- d-----w- c:\program files\Gigabyte
2009-11-04 19:14 . 2009-11-04 16:13 -------- d-----w- c:\program files\AvRack
2009-11-04 18:04 . 2009-11-02 19:15 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-04 18:04 . 2009-11-02 19:15 2684 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-11-04 17:07 . 2009-11-04 17:07 -------- d-----w- c:\program files\MSXML 4.0
2009-11-04 17:04 . 2009-11-04 17:04 -------- d-----w- c:\program files\VS Revo Group
2009-11-04 17:01 . 2009-11-04 17:01 0 ----a-w- c:\windows\nsreg.dat
2009-11-04 16:26 . 2009-11-04 16:26 -------- d-----w- c:\program files\TO2SSM
2009-11-04 16:13 . 2009-11-04 16:13 -------- d-----w- c:\program files\Realtek Sound Manager
2009-11-04 16:05 . 2009-11-04 16:05 -------- d-----w- c:\program files\directx
2009-11-04 16:05 . 2009-11-04 15:48 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-04 16:02 . 2009-11-04 16:02 -------- d-----w- c:\program files\Common Files\DirectX
2009-11-04 15:56 . 2009-11-03 15:58 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-11-04 15:56 . 2009-11-03 15:58 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-11-04 15:50 . 2009-11-04 15:50 -------- d-----w- c:\program files\Common Files\muvee Technologies
2009-11-04 15:50 . 2009-11-04 15:50 -------- d-----w- c:\program files\muvee Technologies
2009-11-04 15:46 . 2009-11-04 15:36 112861 ----a-w- c:\windows\hpoins07.dat
2009-11-04 15:45 . 2009-11-04 15:45 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-11-04 15:44 . 2009-11-04 15:44 -------- d-----w- c:\program files\Common Files\HP
2009-11-04 15:42 . 2009-11-04 15:42 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-04 15:42 . 2009-11-04 15:37 -------- d-----w- c:\program files\HP
2009-11-04 15:41 . 2009-11-04 15:41 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-11-03 16:18 . 2009-11-03 16:16 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-03 16:08 . 2009-11-03 16:08 -------- d-----w- c:\program files\EA GAMES
2009-11-02 19:38 . 2009-11-02 19:15 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-11-02 19:16 . 2009-11-02 19:16 -------- d-----w- c:\program files\microsoft frontpage
2009-11-02 19:13 . 2009-11-02 19:13 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-29 07:43 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-18 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-18 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-18 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:34 . 2004-08-18 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 2004-08-18 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 2004-08-18 12:00 150016 ----a-w- c:\windows\system32\rastls.dll
2009-10-11 03:17 . 2009-11-23 16:20 411368 ----a-w- c:\windows\system32\deploytk.dll
1997-07-21 18:30 . 1997-07-21 18:30 1045776 --sha-w- c:\windows\system32\Msjet35.dll
1997-06-23 02:00 . 1997-06-23 02:00 123664 --sha-w- c:\windows\system32\Msjint35.dll
1997-06-23 11:06 . 1997-06-23 11:06 24848 --sha-w- c:\windows\system32\Msjter35.dll
1997-06-23 11:06 . 1997-06-23 11:06 252176 --sha-w- c:\windows\system32\Msrd2x35.dll
1997-06-23 11:06 . 1997-06-23 11:06 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.

------- Sigcheck -------

[-] 2009-11-26 . CBEEBEB899E31EF52B962CB31FC8CA5C . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2004-08-18 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"nwiz"="nwiz.exe" [2009-03-27 1657376]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Rychlé spuštění aplikace HP Image Zone.lnk]
backup=c:\windows\pss\Rychlé spuštění aplikace HP Image Zone.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
2004-06-14 10:54 200704 ----a-w- c:\program files\Gigabyte\ET5\GUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
2009-11-16 08:03 2054360 ----a-w- c:\program files\ESET\ESET Smart Security\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 22:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\Need For Speed III\\nfs3.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Gigabyte\\BIOS\\GWF32.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\UltraVNC\\winvnc.exe"=
"c:\\Program Files\\UltraVNC\\vncviewer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/12/07 18:17];c:\program files\CyberLink\PowerDVD9\000.fcl [7.5.2009 21:05 87536]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 OMSCAN;OMSCAN;\SysT --> \SysT [?]
S3 MarkFun_NT;MarkFun_NT;c:\program files\Gigabyte\ET5\MARKFUN.W32 [4.11.2009 20:24 6534]
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = socks=
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 12:49
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\MarkFun_NT]
"ImagePath"="\??\c:\program files\Gigabyte\ET5\markfun.w32"

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\OMSCAN]
"ImagePath"="\Sys"

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1993962763-162531612-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:ba,17,d0,5e,9c,26,5d,0d,b3,bf,ec,37,31,ba,93,05,20,95,26,37,24,
7f,6a,b3,04,b3,0e,b1,e1,c3,e1,e8,90,ec,c9,2b,a4,97,2b,14,11,32,f8,4a,31,63,\
"rkeysecu"=hex:20,a7,b2,1e,e5,61,a5,1d,9e,52,c4,30,4f,b8,5e,3f

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|˙˙˙˙Ŕ•€|ů•6~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
Celkový čas: 2009-12-27 12:51:04
ComboFix-quarantined-files.txt 2009-12-27 11:51

Před spuštěním: Volných bajtů: 149 191 983 104
Po spuštění: Volných bajtů: 150 117 548 032

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
- - End Of File - - A27C2EB54A6CB18B61EBB0336CF42B86