Prosim o kontrolu logu. Dakujem pekne za pomoc Vyřešeno

[lubica351]

OTL logfile created on: 27.12.2009 13:51:02 - Run 1
OTL by OldTimer - Version 3.1.20.1 Folder = C:\Documents and Settings\Administrator\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18372)
Locale: 0000041B | Country: Slovensko | Language: SKY | Date Format: d.M.yyyy

1 014,00 Mb Total Physical Memory | 512,00 Mb Available Physical Memory | 50,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 69,00% Paging File free
Paging file location(s): c:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,41 Gb Total Space | 0,90 Gb Free Space | 4,66% Space Free | Partition Type: NTFS
Drive D: | 55,87 Gb Total Space | 11,41 Gb Free Space | 20,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATO
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.12.27 13:46:47 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
PRC - [2009.12.17 07:02:02 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009.11.25 00:51:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009.10.09 13:11:12 | 25,623,336 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe
PRC - [2009.10.09 13:11:12 | 00,078,008 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe
PRC - [2009.03.01 11:59:42 | 00,172,792 | ---- | M] (ICQ, LLC.) -- C:\Program Files\ICQ6.5\ICQ.exe
PRC - [2008.04.14 07:52:24 | 01,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2009.12.27 13:46:47 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2008.07.29 18:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 07:51:46 | 00,027,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\irmon.dll -- (Irmon)
SRV - [2006.12.19 15:53:46 | 00,024,072 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2003.07.28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2009.11.25 00:50:59 | 00,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009.11.25 00:50:12 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2009.11.25 00:50:00 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009.11.25 00:49:07 | 00,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009.11.25 00:48:57 | 00,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009.11.25 00:47:54 | 00,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008.06.19 11:54:37 | 00,047,360 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin)
DRV - [2008.04.13 21:09:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008.04.13 21:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.08.10 06:52:44 | 04,603,904 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.08.07 10:40:38 | 00,098,944 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007.06.05 08:48:58 | 05,761,728 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007.04.03 12:57:42 | 00,083,336 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM)
DRV - [2006.11.08 07:23:52 | 00,102,912 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viamraid.sys -- (viamraid)
DRV - [2006.06.27 04:25:26 | 00,185,504 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\V0250Dev.sys -- (V0250Dev)
DRV - [2006.03.24 09:24:32 | 00,006,272 | R--- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\V0250Vfx.sys -- (V0250Vfx)
DRV - [2005.02.24 13:20:22 | 02,311,680 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2003.04.16 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2002.08.12 15:20:22 | 00,011,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usb8023k.sys -- (USB_RNDIS)
DRV - [2001.08.17 20:51:32 | 00,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
IE - HKU\S-1-5-21-1708537768-527237240-839522115-500\S-1-5-21-1708537768-527237240-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.sk/"
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102
FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q="
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.12.17 07:02:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.12.17 07:02:10 | 00,000,000 | ---D | M]

[2009.03.08 19:28:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\mozilla\Extensions
[2009.12.27 13:51:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\mozilla\Firefox\Profiles\u16h1olf.default\extensions
[2009.07.22 19:25:42 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Data aplikací\mozilla\Firefox\Profiles\u16h1olf.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.04.14 09:14:37 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Data aplikací\mozilla\Firefox\Profiles\u16h1olf.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2009.04.14 09:57:54 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\ask.xml
[2009.12.25 22:52:06 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-1.xml
[2009.09.11 00:11:56 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-10.xml
[2009.11.07 07:32:19 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-11.xml
[2009.12.17 07:02:31 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-12.xml
[2009.12.26 15:29:36 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-13.xml
[2009.03.11 09:18:49 | 00,000,656 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-2.xml
[2009.03.29 15:58:50 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-3.xml
[2009.04.23 14:33:59 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-4.xml
[2009.04.29 11:40:21 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-5.xml
[2009.06.12 15:48:18 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-6.xml
[2009.07.22 19:25:45 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-7.xml
[2009.08.04 10:49:31 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-8.xml
[2009.09.08 16:02:59 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-9.xml
[2009.03.01 13:02:44 | 00,000,944 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin.xml
[2009.12.27 13:41:18 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.03.09 07:39:37 | 00,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.07.15 20:26:47 | 00,001,583 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\atlas-sk.xml
[2009.07.15 20:26:47 | 00,001,380 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\azet-sk.xml
[2009.07.15 20:26:47 | 00,001,479 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\dunaj-sk.xml
[2009.07.15 20:26:47 | 00,001,473 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slovnik-sk.xml
[2009.07.15 20:26:47 | 00,001,104 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-sk.xml
[2009.07.15 20:26:47 | 00,000,830 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\zoznam-sk.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKU\S-1-5-21-1708537768-527237240-839522115-500\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1708537768-527237240-839522115-500\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl ... rashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinsta ... s-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinsta ... s-i586.cab (Java Plug-in 1.5.0_09)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.06.09 11:13:03 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008.06.25 13:39:29 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - C:\WINDOWS\system32\irmon.dll (Microsoft Corporation)
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54891125151891456)

========== Files/Folders - Created Within 7 Days ==========

[2009.12.27 13:46:14 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2009.12.26 22:52:46 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2009.12.26 22:52:46 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009.12.26 21:31:50 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009.12.26 21:26:31 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009.12.26 21:26:26 | 00,000,000 | ---D | C] -- C:\ComboFix
[2009.12.26 21:26:10 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW
[2009.12.26 17:40:55 | 00,000,000 | ---D | C] -- C:\Program Files\TrendMicro
[2009.12.26 17:06:36 | 00,000,000 | ---D | C] -- D:\DOKUMENTY\Only Instrumental Vol.2
[2009.12.26 15:35:19 | 00,023,120 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009.12.26 15:35:18 | 00,048,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009.12.26 15:35:17 | 00,027,408 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009.12.26 15:35:14 | 00,097,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[2009.12.26 15:35:13 | 00,114,768 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009.12.26 15:35:13 | 00,094,160 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009.12.26 15:35:13 | 00,093,424 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009.12.26 15:35:13 | 00,020,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009.12.26 15:34:50 | 01,280,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009.12.26 15:34:46 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2009.12.26 15:31:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft
[2009.12.26 15:27:25 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
[2009.12.26 15:27:25 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Data aplikací\Microsoft
[2009.12.26 15:27:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft
[2009.11.23 13:54:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Apple
[2008.06.19 11:54:37 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Administrator\Data aplikací\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2009.12.27 13:48:06 | 00,284,915 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\gmer.zip
[2009.12.27 13:46:47 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2009.12.27 13:42:22 | 00,000,482 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{7BA98E3A-B618-4AA0-9F81-0F3857520AF5}.job
[2009.12.27 09:38:44 | 00,397,998 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\9620016_308536178.jpg
[2009.12.27 08:30:49 | 00,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Pracovná plocha\Skype.lnk
[2009.12.27 04:25:56 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009.12.27 04:25:12 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009.12.27 04:24:30 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009.12.26 22:55:56 | 03,145,728 | ---- | M] () -- C:\Documents and Settings\Administrator\ntuser.dat
[2009.12.26 22:55:56 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini
[2009.12.26 21:36:47 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009.12.26 21:31:56 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2009.12.26 20:53:35 | 03,866,078 | R--- | M] () -- C:\Documents and Settings\Administrator\Plocha\ComboFix.exe
[2009.12.26 19:21:09 | 00,524,288 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\dds.scr
[2009.12.26 17:41:04 | 00,002,451 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\HiJackThis.lnk
[2009.12.26 17:40:03 | 01,401,344 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\HijackThis.msi
[2009.12.26 17:08:27 | 00,030,208 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.26 15:35:19 | 00,001,709 | ---- | M] () -- C:\Documents and Settings\All Users\Pracovná plocha\avast! Antivirus.lnk
[2009.12.26 15:35:13 | 00,002,553 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009.12.25 17:17:41 | 00,000,406 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[2009.12.25 16:29:59 | 00,002,875 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009.12.25 11:53:03 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.12.24 20:00:44 | 00,078,714 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Obrázek2.jpg
[2009.12.24 20:00:33 | 00,084,983 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Obrázek1.jpg
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009.12.27 13:47:49 | 00,284,915 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\gmer.zip
[2009.12.27 09:38:20 | 00,397,998 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\9620016_308536178.jpg
[2009.12.26 21:31:56 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2009.12.26 21:31:51 | 00,261,312 | ---- | C] () -- C:\cmldr
[2009.12.26 21:00:05 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2009.12.26 20:49:10 | 03,866,078 | R--- | C] () -- C:\Documents and Settings\Administrator\Plocha\ComboFix.exe
[2009.12.26 19:20:35 | 00,524,288 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\dds.scr
[2009.12.26 17:40:56 | 00,002,451 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\HiJackThis.lnk
[2009.12.26 17:38:35 | 01,401,344 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\HijackThis.msi
[2009.12.26 15:35:19 | 00,001,709 | ---- | C] () -- C:\Documents and Settings\All Users\Pracovná plocha\avast! Antivirus.lnk
[2009.12.26 15:34:50 | 00,380,928 | ---- | C] () -- C:\WINDOWS\System32\actskin4.ocx
[2009.12.24 20:00:44 | 00,078,714 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Obrázek2.jpg
[2009.12.24 20:00:33 | 00,084,983 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Obrázek1.jpg
[2009.11.16 14:21:57 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.11.16 14:21:21 | 00,051,712 | ---- | C] () -- C:\WINDOWS\System32\coodest.dll
[2009.04.26 11:50:51 | 00,000,216 | ---- | C] () -- C:\WINDOWS\SWWATER.INI
[2009.04.10 18:16:48 | 00,000,571 | ---- | C] () -- C:\WINDOWS\System32\FeMakro.ini
[2009.04.10 18:16:48 | 00,000,497 | ---- | C] () -- C:\WINDOWS\System32\FeAnim.ini
[2009.03.08 20:51:27 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.03.08 20:51:25 | 00,030,208 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.22 23:22:07 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2008.07.22 23:22:07 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2008.07.22 23:22:07 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2008.07.22 23:22:07 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2008.07.22 23:22:07 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2008.07.22 23:22:07 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2008.07.22 22:55:34 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\tcusbdrv.dll
[2008.06.27 08:30:11 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\fusioncache.dat
[2008.06.27 07:34:39 | 00,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.06.19 13:44:08 | 00,000,177 | ---- | C] () -- C:\WINDOWS\FOXPRO.INI
[2008.06.19 12:00:49 | 00,000,668 | ---- | C] () -- C:\Documents and Settings\Administrator\Data aplikací\vso_ts_preview.xml
[2008.06.19 11:54:42 | 00,000,033 | ---- | C] () -- C:\Documents and Settings\Administrator\Data aplikací\pcouffin.log
[2008.06.19 11:54:37 | 00,087,608 | ---- | C] () -- C:\Documents and Settings\Administrator\Data aplikací\inst.exe
[2008.06.19 11:54:37 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\Administrator\Data aplikací\pcouffin.cat
[2008.06.19 11:54:37 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\Administrator\Data aplikací\pcouffin.inf
[2008.06.09 14:26:27 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2008.06.09 13:25:18 | 00,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2008.06.09 12:26:46 | 00,204,800 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4837.dll
[2008.06.09 11:43:23 | 00,002,875 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2002.10.05 01:04:26 | 00,092,672 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002.10.05 01:04:18 | 00,021,504 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll

========== LOP Check ==========

[2009.04.14 09:16:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Azureus
[2009.07.27 17:11:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\ICQ
[2008.07.22 23:23:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\InterVideo
[2009.04.04 17:46:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\LimeWire
[2009.09.09 21:35:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Nokia
[2008.07.22 23:28:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Opera
[2009.09.05 16:04:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\PC Suite
[2009.04.10 18:16:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\pdfMachine
[2008.06.19 11:06:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Složka odesílání Share-to-Web
[2008.06.27 13:01:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\TuneUp Software
[2009.04.14 10:20:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
[2008.06.26 11:29:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Vso
[2008.06.11 11:35:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters
[2009.12.25 17:17:41 | 00,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\1-Click Maintenance.job
[2009.12.27 13:42:22 | 00,000,482 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{7BA98E3A-B618-4AA0-9F81-0F3857520AF5}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >

< %SYSTEMDRIVE%\eventlog.dll /s /md5 >
[2003.04.16 13:00:00 | 00,049,152 | ---- | M] (Microsoft Corporation) MD5=E8508E7F865490D8AE71D00C8DF4D227 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008.04.14 07:51:42 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 07:51:42 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 07:51:42 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\scecli.dll /s /md5 >
[2003.04.16 13:00:00 | 00,179,200 | ---- | M] (Microsoft Corporation) MD5=B2666CAB5E8C8A741D63F18D551A47FB -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 07:51:56 | 00,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 07:51:56 | 00,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 07:51:56 | 00,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll
[10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\netlogon.dll /s /md5 >
[2003.04.16 13:00:00 | 00,399,360 | ---- | M] (Microsoft Corporation) MD5=CF03E300B5CEEFFEFBE6F67532BD0EF1 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 07:51:52 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 07:51:52 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 07:51:52 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll
[10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\cngaudit.dll /s /md5 >

< %SYSTEMDRIVE%\sceclt.dll /s /md5 >

< %SYSTEMDRIVE%\ntelogon.dll /s /md5 >

< %SYSTEMDRIVE%\logevent.dll /s /md5 >

< %SYSTEMDRIVE%\iaStor.sys /s /md5 >

< %SYSTEMDRIVE%\nvstor.sys /s /md5 >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >
[2003.04.16 13:00:00 | 00,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008.04.13 23:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.13 23:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 23:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 >

< %SYSTEMDRIVE%\viasraid.sys /s /md5 >

< %SYSTEMDRIVE%\AGP440.sys /s /md5 >
[2003.04.16 13:00:00 | 00,025,472 | ---- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2008.04.13 23:06:40 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008.04.13 23:06:40 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 23:06:40 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >

< %SYSTEMDRIVE%\nvatabus.sys /s /md5 >

< %SYSTEMDRIVE%\viamraid.sys /s /md5 >
[2006.11.08 07:23:52 | 00,102,912 | R--- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\WINDOWS\system32\drivers\viamraid.sys

< %SYSTEMDRIVE%\nvata.sys /s /md5 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
< End of report >

[Reklama]

[lubica351]

OTL Extras logfile created on: 27.12.2009 13:51:02 - Run 1
OTL by OldTimer - Version 3.1.20.1 Folder = C:\Documents and Settings\Administrator\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18372)
Locale: 0000041B | Country: Slovensko | Language: SKY | Date Format: d.M.yyyy

1 014,00 Mb Total Physical Memory | 512,00 Mb Available Physical Memory | 50,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 69,00% Paging File free
Paging file location(s): c:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,41 Gb Total Space | 0,90 Gb Free Space | 4,66% Space Free | Partition Type: NTFS
Drive D: | 55,87 Gb Total Space | 11,41 Gb Free Space | 20,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATO
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- "%SYSTEMROOT%\hh.exe" %1
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
chm.file [open] -- "%SYSTEMROOT%\hh.exe" %1
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe"

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Služba Windows Media Player Network Sharing

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{235D8A8E-2F97-11D6-A551-0090278A1BB8}" = Visual FoxPro 8.0 Baseline - English
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{50020B66-4BA5-4E35-939E-98A0D648EE88}_is1" = Fast MP4 3GP AVI MPG WMV RM MOV FLV Converter 5.0
"{590D4F8F-98FE-47FA-AC2B-3F22FDCF7C09}" = ShareIns
"{5BE3BF62-D432-4D47-A712-CD4DF91CABFB}" = ZyXEL USB ADSL Modem/Router
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{690BE098-6D0D-493D-B079-BD7E8F81A141}" = Opera 10.10
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7506D309-53A2-4927-BD1B-70015F1C6E0C}" = Windows Slovak Interface Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F947BFE-C2DF-4779-9909-5BEE746BD0C4}" = Microsoft .NET Framework 2.0 Language Pack - CSY
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{AC76BA86-7AD7-1051-7B44-A80000000000}" = Adobe Reader 8 - Slovak
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Video FX Engine" = Advanced Video FX Engine
"Ask Toolbar_is1" = Ask Toolbar
"avast!" = avast! Antivirus
"AviSynth" = AviSynth 2.5
"CCleaner" = CCleaner (remove only)
"Creative Live! Cam Center" = Creative Live! Cam Center
"Creative Live! Cam Manager" = Creative Live! Cam Manager
"Creative Live! Cam Notebook Pro User's Guide English" = Creative Live! Cam Notebook Pro User's Guide (English)
"Creative Photo Calendar" = Creative Photo Calendar
"Creative Photo Manager" = Creative Photo Manager
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative VF0250" = Creative Live! Cam Notebook Pro Driver (1.02.06.0627)
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8 Release Candidate 1
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.7.5 (Standard)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - CSY" = Microsoft .NET Framework 2.0 Language Pack - CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.6)" = Mozilla Firefox (3.5.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NeroVision!UninstallKey" = Nero Digital
"SightSpeed" = SightSpeed (remove only)
"Syncrosoft's License Control" = Syncrosoft's License Control
"SysInfo" = Creative System Information
"Totalcmd" = Total Commander (Remove or Repair)
"Windows Doctor_is1" = Windows Doctor 2.0
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24.12.2009 4:01:45 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\WINDOWS\TEMP\MSIdd264.LOG.

Error - 24.12.2009 20:18:04 | Computer Name = MATO | Source = Application Error | ID = 1000
Description = Chybující aplikace mplayerc.exe, verze 1.2.1008.0, chybující modul
ffdshow.ax, verze 1.0.5.2811, adresa chyby 0x00074db1.

Error - 24.12.2009 21:16:27 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MSI146cb.LOG.

Error - 25.12.2009 4:00:54 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\WINDOWS\TEMP\MSI1f5e6.LOG.

Error - 25.12.2009 5:00:59 | Computer Name = MATO | Source = Application Error | ID = 1000
Description = Chybující aplikace nero.exe, verze 6.6.1.4, chybující modul ffdshow.ax,
verze 1.0.5.2811, adresa chyby 0x001fd7fc.

Error - 25.12.2009 5:01:07 | Computer Name = MATO | Source = Application Error | ID = 1000
Description = Chybující aplikace drwtsn32.exe, verze 5.1.2600.0, chybující modul
dbghelp.dll, verze 5.1.2600.5512, adresa chyby 0x0001295d.

Error - 25.12.2009 19:21:32 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\WINDOWS\TEMP\MSI3112b.LOG.

Error - 26.12.2009 4:29:08 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\WINDOWS\TEMP\MSIcbfb6.LOG.

Error - 26.12.2009 12:15:16 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MSIa26d0.LOG.

Error - 27.12.2009 4:01:02 | Computer Name = MATO | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Aktualizáciu {411EDCF7-755D-414E-A74B-3DCD6583F589}
sa nepodarilo nainštalovať. Kód chyby 1603. Ďalšie informácie sú uvedené v súbore
denníka C:\WINDOWS\TEMP\MSId6c28.LOG.

[ System Events ]
Error - 26.12.2009 8:18:23 | Computer Name = MATO | Source = PSched | ID = 14103
Description = Služba QoS [Adaptér {B3EC5FE3-38F1-4356-8AC8-11ADF9BF0FDC}]: Ovladači
síťové karty se nezdařil dotaz na OID_GEN_LINK_SPEED.

Error - 26.12.2009 9:38:43 | Computer Name = MATO | Source = PSched | ID = 14103
Description = Služba QoS [Adaptér {B3EC5FE3-38F1-4356-8AC8-11ADF9BF0FDC}]: Ovladači
síťové karty se nezdařil dotaz na OID_GEN_LINK_SPEED.

Error - 26.12.2009 12:15:22 | Computer Name = MATO | Source = Windows Update Agent | ID = 20
Description = Instalace se nezdařila: Instalace následující aktualizace se nezdařila
z důvodu chyby (0x80070643): Aktualizace Service Pack 1 pro Microsoft .NET Framework
1.1.

Error - 26.12.2009 16:00:22 | Computer Name = MATO | Source = Service Control Manager | ID = 7031
Description = Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena.
Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund:
Restartovat službu.

Error - 26.12.2009 16:26:41 | Computer Name = MATO | Source = Service Control Manager | ID = 7031
Description = Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena.
Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund:
Restartovat službu.

Error - 26.12.2009 16:32:37 | Computer Name = MATO | Source = Service Control Manager | ID = 7031
Description = Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena.
Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund:
Restartovat službu.

Error - 26.12.2009 16:34:41 | Computer Name = MATO | Source = Service Control Manager | ID = 7031
Description = Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena.
Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund:
Restartovat službu.

Error - 26.12.2009 16:35:25 | Computer Name = MATO | Source = Service Control Manager | ID = 7031
Description = Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena.
Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund:
Restartovat službu.

Error - 26.12.2009 23:24:35 | Computer Name = MATO | Source = Dhcp | ID = 1002
Description = Zapůjčení adresy IP 192.168.1.33 pro síťovou kartu s adresou 001349D9DDEB
byla serverem DHCP 192.168.1.1 odmítnuta. (Server DHCP odeslal zprávu DHCPNACK).

Error - 27.12.2009 4:28:32 | Computer Name = MATO | Source = Windows Update Agent | ID = 20
Description = Instalace se nezdařila: Instalace následující aktualizace se nezdařila
z důvodu chyby (0x80070643): Aktualizace Service Pack 1 pro Microsoft .NET Framework
1.1.


< End of report >

[lubica351]

tak a s tym druhym postupom neviem pohnut hmm neviem ktore su to tie logy c1 a c2

[pitimir]

To je jedno, potrebujem oba :)

[lubica351]

tak bohuzial, neviem s tym nijak pohnut, to je uz na mna moc..dakujem ti za ochotu, necham to tak hmm

[lubica351]

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-27 19:57:05
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdypog.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAA0466B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAA046574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAA046A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAA04614C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAA04664E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAA04608C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAA0460F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAA04676E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAA04672E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAA0468AE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

[lubica351]

pri tom druhom scane mi vyskocila modra obrazovka musela som restartovat pc neviem co dalej

[pitimir]

Vsetko je v poriadku :)
Este ta poprosim o toto:
Stiahni a spust AVPTool. Vypracuj log podla navodu a vloz ho.

A ak to bude v poriadku, docistime to :)

[lubica351]

Autoscan: completed 22 minutes ago (events: 3, objects: 191420, time: 01:48:10)
28.12.2009 7:55:54 Task started
28.12.2009 8:06:31 Processing error E Read error
28.12.2009 9:44:06 Task completed

[pitimir]

Skopiruj v OTL do policka pod nazvom "Custom Scans/Fixes":

Kód: Vybrat vše

:otl
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q="
[2009.04.14 09:57:54 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\ask.xml
[2009.12.25 22:52:06 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-1.xml
[2009.09.11 00:11:56 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-10.xml
[2009.11.07 07:32:19 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-11.xml
[2009.12.17 07:02:31 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-12.xml
[2009.12.26 15:29:36 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-13.xml
[2009.03.11 09:18:49 | 00,000,656 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-2.xml
[2009.03.29 15:58:50 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-3.xml
[2009.04.23 14:33:59 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-4.xml
[2009.04.29 11:40:21 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-5.xml
[2009.06.12 15:48:18 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-6.xml
[2009.07.22 19:25:45 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-7.xml
[2009.08.04 10:49:31 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-8.xml
[2009.09.08 16:02:59 | 00,000,961 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-9.xml
[2009.03.01 13:02:44 | 00,000,944 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin.xml
O3 - HKU\S-1-5-21-1708537768-527237240-839522115-500\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe File not found
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-527237240-839522115-500_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl ... rashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinsta ... s-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinsta ... s-i586.cab (Java Plug-in 1.5.0_09)
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

:commands
[emptytemp]
[reboot]

Klikni na "Run Fix". Program zacne pracovat, mozny je restart PC. Po nom by sa ti mal objavit log, ten by som rad videl.

[lubica351]

All processes killed
========== OTL ==========
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Unable to set value : HKU\S-1-5-21-1708537768-527237240-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Ask" removed from browser.search.order.1
Prefs.js: "ICQ Search" removed from browser.search.selectedEngine
Prefs.js: "http://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=" removed from keyword.URL
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\ask.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\FireFox\Profiles\u16h1olf.default\searchplugins\icqplugin.xml moved successfully.
Registry value HKEY_USERS\S-1-5-21-1708537768-527237240-839522115-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk moved successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-1708537768-527237240-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1708537768-527237240-839522115-500_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 1150571 bytes
->Temporary Internet Files folder emptied: 19208845 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 256115333 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2239307 bytes
%systemroot%\System32 .tmp files removed: 14490552 bytes
Windows Temp folder emptied: 1504854 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1894084 bytes

Total Files Cleaned = 283,00 mb


OTL by OldTimer - Version 3.1.20.1 log created on 12282009_233306

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_7c0.dat moved successfully.

Registry entries deleted on Reboot...

[pitimir]

1) Docistime to:

• Odinstaluj Combofix:
  Start -> Spustit -> (napis) combofix /uninstall

• Pouzi T-Cleaner (ak by ho antivirus hlasil ako smejda, nic sa netreba bat, ide len o paranoju AV programu).

• Precisti PC CCleanerom (vratane registrov).

• Pouzi TFC (spust program a klikni na "Start". Pozor, PC moze byt restartovane).

2) Vloz log z HJT.

V pripade nezrovnalosti sa >>tu<< nachadza navod.