Bundespolizei Virus - Windows Vista

 Malwarebytes Anti-Malware  (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2013.10.27.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Majkl :: MAJKL-PC [administrátor]

Ochrana: Povolena

27.10.2013 21:45:20
mbam-log-2013-10-27 (21-45-20).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 307348
Uplynulý čas: 2 hodin, 3 minut, 44 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\Users\Majkl\AppData\Local\Temp\IaaEYzhK.zip.part (Trojan.FakeAlert.RRE) -> Přesun do karantény a smazání se zdařilo.
C:\Users\Majkl\AppData\Local\Temp\CYCIWs+E.zip.part (Trojan.FakeAlert.RRE) -> Přesun do karantény a smazání se zdařilo.


(konec)
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:43 on 08/11/2013 (Majkl)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Majkl (administrator) on MAJKL-PC on 08-11-2013 19:55:11
Running from C:\Users\Majkl\Desktop
Microsoft® Windows Vista™ Ultimate  Service Pack 2 (X86) OS Language: Czech
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\VistaCodecPack\QT\QTTask.exe [413696 2008-09-06] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [289576 2008-10-01] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [] - [x]
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-19] (Microsoft Corporation)
MountPoints2: {312e505b-8d35-11dd-b8bd-0016d4d0961e} - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ipse32.exe
MountPoints2: {a4756468-ca02-11dd-b691-0016d4d0961e} - WDSetup.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {4899AAC5-FDA9-4236-87F1-B858F496D9B2} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 02 %SystemRoot%\system32\napinsp.dll [50176] (Společnost Microsoft)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Majkl\AppData\Roaming\Mozilla\Firefox\Profiles\l8b2vyyx.default-1382163926120
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.11.2852 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nppl3260;version=6.0.12.46 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.1662 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.46 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\mall-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: noscript - C:\Users\Majkl\AppData\Roaming\Mozilla\Firefox\Profiles\l8b2vyyx.default-1382163926120\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144712 2009-06-05] (Apple Inc.)
S2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [101528 2007-04-13] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 RichVideo; "C:\Program Files\CyberLink\Shared files\RichVideo.exe" [x]

==================== Drivers (Whitelisted) ====================

R3 AR5416; C:\Windows\System32\DRIVERS\athw.sys [1938272 2010-11-05] (Atheros Communications, Inc.)
R3 EMSCR; C:\Windows\System32\DRIVERS\EMS7SK.sys [60928 2006-02-16] (ENE Technology Inc.)
R3 ESDCR; C:\Windows\System32\DRIVERS\ESD7SK.sys [40064 2006-05-25] (ENE Technology Inc.)
R3 ESMCR; C:\Windows\System32\DRIVERS\ESM7SK.sys [74624 2006-02-16] (ENE Technology Inc.)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [190424 2009-04-11] (Společnost Microsoft)
S3 GTIPCI21; C:\Windows\System32\DRIVERS\gtipci21.sys [88192 2006-04-05] (Texas Instruments)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1082232 2013-03-03] (Společnost Microsoft)
R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2007-11-22] (Padus, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 EraserUtilDrv11220; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11220.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2038-11-22 16:12 - 2038-11-22 16:12 - 00004096 _____ C:\Users\Majkl\AppData\Local\TimerStop.sys
2013-11-08 19:54 - 2013-11-08 19:54 - 00000000 ____D C:\FRST
2013-11-08 19:47 - 2013-11-08 19:47 - 01089445 _____ (Farbar) C:\Users\Majkl\Desktop\FRST.exe
2013-11-08 19:43 - 2013-11-08 19:43 - 00000472 _____ C:\Users\Majkl\Desktop\defogger_disable.log
2013-11-08 19:33 - 2013-11-08 19:33 - 00000000 ____D C:\Users\Majkl\Desktop\Misc
2013-11-08 19:25 - 2013-11-08 19:32 - 00000000 ____D C:\Users\Majkl\Desktop\PDFs
2013-11-08 19:24 - 2013-11-08 19:25 - 00000000 ____D C:\Users\Majkl\Desktop\Pics
2013-11-08 19:20 - 2013-11-08 19:20 - 00000000 _____ C:\Users\Majkl\defogger_reenable
2013-11-08 19:18 - 2013-11-08 19:18 - 00050477 _____ C:\Users\Majkl\Desktop\Defogger.exe
2013-10-30 20:57 - 2013-10-30 20:58 - 02347384 _____ (ESET) C:\Users\Majkl\Downloads\esetsmartinstaller_enu.exe
2013-10-30 19:18 - 2013-10-30 19:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-30 19:16 - 2013-10-30 19:16 - 01033335 _____ (Thisisu) C:\Users\Majkl\Downloads\JRT.exe
2013-10-30 19:06 - 2013-10-30 19:09 - 00000000 ____D C:\AdwCleaner
2013-10-30 19:04 - 2013-10-30 19:04 - 01060070 _____ C:\Users\Majkl\Downloads\adwcleaner.exe
2013-10-29 23:20 - 2013-10-29 23:31 - 340465664 _____ C:\Users\Majkl\Downloads\kav_rescue_10-0513.iso
2013-10-29 23:10 - 2013-10-29 23:09 - 00387584 _____ C:\Users\Majkl\Downloads\rescue2usb(1).exe
2013-10-29 23:08 - 2013-10-29 23:08 - 00387584 _____ C:\Users\Majkl\Downloads\rescue2usb.exe
2013-10-27 21:42 - 2013-10-27 21:42 - 00000000 ____D C:\Users\Majkl\AppData\Roaming\Malwarebytes
2013-10-27 21:41 - 2013-10-27 21:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-27 21:41 - 2013-10-27 21:41 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-27 21:41 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-27 21:40 - 2013-10-27 21:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Majkl\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-19 07:25 - 2013-10-19 07:25 - 00000000 ____D C:\Users\Majkl\Desktop\Původní data aplikace Firefox
2013-10-09 22:31 - 2013-09-22 11:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 22:31 - 2013-09-22 11:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 22:31 - 2013-09-22 11:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 22:31 - 2013-09-22 11:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-09 22:31 - 2013-09-22 11:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 22:31 - 2013-09-22 11:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 22:31 - 2013-09-22 11:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-09 22:31 - 2013-09-22 11:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 22:31 - 2013-09-22 11:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-09 22:31 - 2013-09-22 11:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 22:31 - 2013-09-22 11:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-09 22:31 - 2013-09-22 11:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 22:31 - 2013-09-22 11:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 22:31 - 2013-09-22 11:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 22:31 - 2013-09-22 11:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-09 22:31 - 2013-09-22 10:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 20:46 - 2013-08-29 08:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 20:46 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-09 20:46 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-09 20:46 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-09 20:46 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-09 20:46 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-09 20:46 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-09 20:46 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-09 20:46 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-09 20:46 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-09 20:46 - 2013-08-01 04:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 20:46 - 2013-08-01 03:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-09 20:46 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 20:46 - 2013-07-12 10:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 20:46 - 2013-07-12 10:04 - 00073344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 20:46 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 20:46 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 20:46 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 20:46 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 20:46 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 20:46 - 2013-06-29 03:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 20:46 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 20:46 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 20:46 - 2013-06-27 00:01 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-10-09 20:46 - 2013-06-27 00:01 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-10-09 20:46 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 20:46 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 20:46 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 20:46 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

==================== One Month Modified Files and Folders =======

2038-11-22 16:12 - 2038-11-22 16:12 - 00004096 _____ C:\Users\Majkl\AppData\Local\TimerStop.sys
2038-11-22 16:12 - 2007-11-22 13:18 - 00006136 _____ C:\Users\Majkl\AppData\Local\TimerStop64.sys
2038-11-22 16:09 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\ras
2038-11-22 16:09 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\icsxml
2013-11-08 19:54 - 2013-11-08 19:54 - 00000000 ____D C:\FRST
2013-11-08 19:54 - 2006-11-02 13:51 - 01055288 _____ C:\Windows\WindowsUpdate.log
2013-11-08 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-08 19:50 - 2006-11-02 14:00 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-08 19:50 - 2006-11-02 13:46 - 00003360 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-08 19:50 - 2006-11-02 13:46 - 00003360 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-08 19:49 - 2006-11-02 14:00 - 00032554 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-08 19:47 - 2013-11-08 19:47 - 01089445 _____ (Farbar) C:\Users\Majkl\Desktop\FRST.exe
2013-11-08 19:43 - 2013-11-08 19:43 - 00000472 _____ C:\Users\Majkl\Desktop\defogger_disable.log
2013-11-08 19:40 - 2012-11-14 16:18 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-08 19:33 - 2013-11-08 19:33 - 00000000 ____D C:\Users\Majkl\Desktop\Misc
2013-11-08 19:32 - 2013-11-08 19:25 - 00000000 ____D C:\Users\Majkl\Desktop\PDFs
2013-11-08 19:25 - 2013-11-08 19:24 - 00000000 ____D C:\Users\Majkl\Desktop\Pics
2013-11-08 19:20 - 2013-11-08 19:20 - 00000000 _____ C:\Users\Majkl\defogger_reenable
2013-11-08 19:20 - 2007-11-22 13:08 - 00000000 ____D C:\Users\Majkl
2013-11-08 19:18 - 2013-11-08 19:18 - 00050477 _____ C:\Users\Majkl\Desktop\Defogger.exe
2013-11-08 18:53 - 2008-01-11 14:15 - 00000000 ____D C:\Program Files\CyberLink
2013-11-08 18:53 - 2006-11-02 13:59 - 00798402 _____ C:\Windows\PFRO.log
2013-11-08 18:43 - 2008-10-20 19:13 - 00000000 ____D C:\ProgramData\ScanSoft
2013-11-08 18:38 - 2007-11-22 13:56 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-08 18:23 - 2013-06-19 16:39 - 00000000 ____D C:\Users\Majkl\AppData\Local\CrashDumps
2013-11-08 18:22 - 2008-01-12 15:16 - 00196608 _____ C:\Users\Majkl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-08 18:06 - 2009-03-08 19:27 - 00000000 ____D C:\Windows\cstrike
2013-11-08 18:03 - 2008-10-20 18:59 - 00000000 ____D C:\Program Files\Canon
2013-11-08 16:58 - 2006-11-02 11:33 - 01406232 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-30 20:58 - 2013-10-30 20:57 - 02347384 _____ (ESET) C:\Users\Majkl\Downloads\esetsmartinstaller_enu.exe
2013-10-30 19:18 - 2013-10-30 19:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-30 19:16 - 2013-10-30 19:16 - 01033335 _____ (Thisisu) C:\Users\Majkl\Downloads\JRT.exe
2013-10-30 19:09 - 2013-10-30 19:06 - 00000000 ____D C:\AdwCleaner
2013-10-30 19:09 - 2009-10-08 20:48 - 00000000 ____D C:\ProgramData\ICQ
2013-10-30 19:04 - 2013-10-30 19:04 - 01060070 _____ C:\Users\Majkl\Downloads\adwcleaner.exe
2013-10-29 23:31 - 2013-10-29 23:20 - 340465664 _____ C:\Users\Majkl\Downloads\kav_rescue_10-0513.iso
2013-10-29 23:09 - 2013-10-29 23:10 - 00387584 _____ C:\Users\Majkl\Downloads\rescue2usb(1).exe
2013-10-29 23:08 - 2013-10-29 23:08 - 00387584 _____ C:\Users\Majkl\Downloads\rescue2usb.exe
2013-10-29 21:37 - 2013-03-15 20:31 - 00000000 ____D C:\Users\Majkl\Desktop\Lezeni
2013-10-28 00:13 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\L2Schemas
2013-10-27 21:42 - 2013-10-27 21:42 - 00000000 ____D C:\Users\Majkl\AppData\Roaming\Malwarebytes
2013-10-27 21:41 - 2013-10-27 21:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-27 21:41 - 2013-10-27 21:41 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-27 21:41 - 2013-10-27 21:40 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Majkl\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-26 01:30 - 2007-11-22 18:12 - 00000000 ____D C:\Users\Majkl\AppData\Roaming\Skype
2013-10-23 20:06 - 2013-06-10 21:20 - 00000000 ____D C:\ProgramData\Norton
2013-10-19 07:25 - 2013-10-19 07:25 - 00000000 ____D C:\Users\Majkl\Desktop\Původní data aplikace Firefox
2013-10-17 18:39 - 2007-11-22 18:11 - 00000000 ____D C:\ProgramData\Skype
2013-10-17 18:38 - 2007-11-22 18:11 - 00000000 ___RD C:\Program Files\Skype
2013-10-10 13:04 - 2006-11-02 13:46 - 00248936 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 22:40 - 2013-09-10 21:20 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 22:36 - 2006-11-02 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-09 17:41 - 2012-11-14 16:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-09 17:41 - 2011-12-27 20:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\ezsid.dat


Some content of TEMP:
====================
C:\Users\Majkl\AppData\Local\Temp\ose00000.exe
C:\Users\Majkl\AppData\Local\Temp\Quarantine.exe
C:\Users\Majkl\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Majkl\AppData\Local\Temp\_is734C.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-08 19:56

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Majkl at 2013-11-08 19:59:45
Running from C:\Users\Majkl\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

ACDSee 9 Photo Manager (Version: 9.0.55)
Acer OrbiCam  (Version: 1.0.0.12)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Flash Player 9 ActiveX (Version: 9)
Adobe Reader 9.5.5 - Czech (Version: 9.5.5)
Adobe Shockwave Player 12.0 (Version: 12.0.2.122)
Aktualizace zabezpečení aplikace Windows Media Player (KB2845142)
Apple Mobile Device Support (Version: 2.5.1.3)
AVS Image Converter 1.3.3.146
AVS Update Manager 1.0
AVS4YOU Software Navigator 1.4
Counter-Strike 1.6 (Version: 1.00.0000)
Easy GIF Animator 5.21 (Version: Easy GIF Animator 5.0)
Chemiefaser Lexikon
ICQ6.5 (Version: 6.5)
iTunes (Version: 8.0.1.11)
K-Lite Mega Codec Pack 3.7.5 (Version: 3.7.5)
Lexikon Garne und Zwirne
Malwarebytes Anti-Malware verze 1.75.0.1300 (Version: 1.75.0.1300)
Maschen-ABC
Microsoft .NET Framework 3.5 Language Pack SP1 - csy (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Office XP Professional s aplikací FrontPage (Version: 10.0.2627.11)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 24.0 (x86 cs) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
Mozilla Thunderbird (3.1.4) (Version: 3.1.4 (cs))
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 7 Ultra Edition (Version: 7.02.2631)
Norton Security Scan (Version: 4.0.1.16)
PDFCreator (Version: 1.2.3)
pdfforge Toolbar v8.1 (Version: 8.1)
PIXMA Extended Survey Program
QuickTime (Version: 7.55.90.70)
Skype Click to Call (Version: 6.6.11664)
Skype™ 6.9 (Version: 6.9.106)
Slovník Verdict Free (a internetový překladač)
swMSM (Version: 12.0.0.1)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 1.22.0000)
TIPCI (Version: 1.22.0000)
Total Commander (Remove or Repair)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Winamp (Version: 5.5 )
Windows Media Player Firefox Plugin (Version: 1.0.0.8)

==================== Restore Points  =========================

29-10-2013 19:15:59 Naplánovaný kontrolní bod
30-10-2013 18:56:30 Naplánovaný kontrolní bod
08-11-2013 16:53:15 Configured PowerDVD
08-11-2013 17:01:26 Removed Bonjour
08-11-2013 17:05:16 ????????? Counter-Strike 1.6
08-11-2013 17:06:14 ??????? Counter-Strike 1.6
08-11-2013 17:08:02 ??????? Counter-Strike 1.6
08-11-2013 17:37:10 Configured SILKYPIX Developer Studio 2.0 SE
08-11-2013 17:41:23 Removed ScanSoft OmniPage SE 4

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {075F7B0C-8858-426A-81EA-5161F4D13E82} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {07B800D5-E65B-48EA-A2BC-A7A27558DDFA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {16FAA518-6DD7-42A3-B13C-F115C77C2EA4} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {1B45C4F4-ABEE-49E8-8066-36E096BD78CE} - System32\Tasks\{1F2459D8-3415-4AA1-AB41-96B248604F2C} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.112/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered
Task: {2EF1A2C3-210D-4AFD-BEB7-E51E7FD69C0C} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3A950610-5351-4CF3-89BD-526A7E64AA8B} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {5A6D9831-D95C-4713-B4E9-F03D1644498F} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {67FF8C20-5066-4F72-BC65-754C1EB9F9C9} - System32\Tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask => C:\Windows\System32\raserver.exe [2008-01-19] (Společnost Microsoft)
Task: {9E5BF5AD-8C24-408D-B1F0-97DAB12724C3} - System32\Tasks\{18A7718A-BC97-48F8-ADED-8346F0CC29DF} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.112/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered
Task: {EB5BC265-9078-4225-B1F7-79AE4F63398E} - System32\Tasks\Norton Security Scan for Majkl => C:\Program Files\Norton Security Scan\Engine\4.0.1.16\Nss.exe [2013-05-07] (Symantec Corporation)
Task: {F844DFE2-2485-451E-9537-768B77DA7DC7} - System32\Tasks\{C4FA3EA0-AE4C-4170-9BDE-77A820CA5A36} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.104/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Norton Security Scan for Majkl.job => C:\PROGRA~1\NORTON~2\Engine\401~1.16\Nss.exe

==================== Loaded Modules (whitelisted) =============

2006-11-02 11:25 - 2006-11-02 10:46 - 00061440 _____ () C:\Windows\system32\igfxTMM.dll
2013-09-11 13:44 - 2013-10-01 15:24 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/08/2013 07:54:16 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 07:44:19 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 06:58:50 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 06:37:08 PM) (Source: VSS) (User: )
Description: Chyba služby Stínová kopie svazků: Při dotazu na rozhraní IVssWriterCallback došlo k neočekávané chybě. hr = 0x80070005.
To je často způsobeno nesprávným nastavením zabezpečení v modulu pro zápis nebo žadateli.


Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:22:44 PM) (Source: Application Error) (User: )
Description: Chybující aplikace mplayerc.exe, verze 6.4.9.1, časové razítko 0x479cf13b, chybující modul mplayerc.exe, verze 6.4.9.1, časové razítko 0x479cf13b, kód výjimky 0xc0000005, posun chyby 0x0003147f,
ID procesu 0x844, čas spuštění aplikace 0xmplayerc.exe0.

Error: (11/08/2013 06:22:14 PM) (Source: Application Error) (User: )
Description: Chybující aplikace mplayerc.exe, verze 6.4.9.1, časové razítko 0x479cf13b, chybující modul mplayerc.exe, verze 6.4.9.1, časové razítko 0x479cf13b, kód výjimky 0xc0000005, posun chyby 0x0003147f,
ID procesu 0x139c, čas spuštění aplikace 0xmplayerc.exe0.

Error: (11/08/2013 06:08:01 PM) (Source: VSS) (User: )
Description: Chyba služby Stínová kopie svazků: Při dotazu na rozhraní IVssWriterCallback došlo k neočekávané chybě. hr = 0x80070005.
To je často způsobeno nesprávným nastavením zabezpečení v modulu pro zápis nebo žadateli.


Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:06:13 PM) (Source: VSS) (User: )
Description: Chyba služby Stínová kopie svazků: Při dotazu na rozhraní IVssWriterCallback došlo k neočekávané chybě. hr = 0x80070005.
To je často způsobeno nesprávným nastavením zabezpečení v modulu pro zápis nebo žadateli.


Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:05:14 PM) (Source: VSS) (User: )
Description: Chyba služby Stínová kopie svazků: Při dotazu na rozhraní IVssWriterCallback došlo k neočekávané chybě. hr = 0x80070005.
To je často způsobeno nesprávným nastavením zabezpečení v modulu pro zápis nebo žadateli.


Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 05:53:11 PM) (Source: VSS) (User: )
Description: Chyba služby Stínová kopie svazků: Při dotazu na rozhraní IVssWriterCallback došlo k neočekávané chybě. hr = 0x80070005.
To je často způsobeno nesprávným nastavením zabezpečení v modulu pro zápis nebo žadateli.


Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}


System errors:
=============
Error: (11/08/2013 07:51:58 PM) (Source: Service Control Manager) (User: )
Description: Cyberlink RichVideo Service(CRVS)%%3

Error: (11/08/2013 07:42:30 PM) (Source: Service Control Manager) (User: )
Description: Služba Windows Media Player Network Sharing%%1053

Error: (11/08/2013 07:42:30 PM) (Source: Service Control Manager) (User: )
Description: 30000Služba Windows Media Player Network Sharing

Error: (11/08/2013 07:41:58 PM) (Source: Service Control Manager) (User: )
Description: Cyberlink RichVideo Service(CRVS)%%3

Error: (11/08/2013 06:57:16 PM) (Source: bowser) (User: )
Description: Hlavní prohledávač přijal oznámení serveru od počítače EASYBOX,
který se považuje za hlavní prohledávač domény pro přenos NetBT_Tcpip_{45CBB809-1FE7-43DD-A84B-59DE8EC6CA.
Hlavní prohledávač bude ukončen nebo bude vyvolána volba.

Error: (11/08/2013 06:55:38 PM) (Source: Service Control Manager) (User: )
Description: Cyberlink RichVideo Service(CRVS)%%3

Error: (11/08/2013 06:36:51 PM) (Source: DCOM) (User: )
Description: C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe -Embedding740{D5641912-E47A-429C-879E-CFE13EAC7A13}

Error: (11/08/2013 05:21:56 PM) (Source: Server) (User: )
Description: Server nemohl vytvořit vazbu na přenos \Device\NetbiosSmb, protože jiný počítač v síti má stejný název. Server nelze spustit.

Error: (11/08/2013 05:21:35 PM) (Source: DCOM) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}

Error: (11/08/2013 04:57:57 PM) (Source: Service Control Manager) (User: )
Description: Instalace modulů systému Windows%%1053


Microsoft Office Sessions:
=========================
Error: (11/08/2013 07:54:16 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 07:44:19 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 06:58:50 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

Error: (11/08/2013 06:37:08 PM) (Source: VSS)(User: )
Description: 0x80070005

Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:22:44 PM) (Source: Application Error)(User: )
Description: mplayerc.exe6.4.9.1479cf13bmplayerc.exe6.4.9.1479cf13bc00000050003147f84401cedca71aeb3a85

Error: (11/08/2013 06:22:14 PM) (Source: Application Error)(User: )
Description: mplayerc.exe6.4.9.1479cf13bmplayerc.exe6.4.9.1479cf13bc00000050003147f139c01cedca70d321355

Error: (11/08/2013 06:08:01 PM) (Source: VSS)(User: )
Description: 0x80070005

Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:06:13 PM) (Source: VSS)(User: )
Description: 0x80070005

Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 06:05:14 PM) (Source: VSS)(User: )
Description: 0x80070005

Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}

Error: (11/08/2013 05:53:11 PM) (Source: VSS)(User: )
Description: 0x80070005

Operace:
   Shromažďování dat modulu pro zápis

Kontext:
   ID třídy modulu pro zápis: {e8132975-6f93-4464-a53e-1050253ae220}
   Název modulu pro zápis: System Writer
   ID instance modulu pro zápis: {9e74feaf-27d9-431f-8073-767735e27414}


CodeIntegrity Errors:
===================================
  Date: 2013-10-28 18:39:32.135
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:31.527
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:30.887
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:30.279
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:29.655
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:29.031
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:28.360
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:27.752
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:27.143
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-10-28 18:39:26.535
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 81%
Total physical RAM: 1013.38 MB
Available physical RAM: 192.25 MB
Total Pagefile: 2291.08 MB
Available Pagefile: 1394.82 MB
Total Virtual: 2047.88 MB
Available Virtual: 1905.05 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:52.14 GB) (Free:14.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:51.84 GB) (Free:42.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 112 GB) (Disk ID: 4678407B)
Partition 1: (Not Active) - (Size=8 GB) - (Type=27)
Partition 2: (Active) - (Size=52 GB) - (Type=06)
Partition 3: (Not Active) - (Size=52 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-08 23:50:12
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9120822AS rev.3.ALD 111,79GB
Running: n5jcz9es.exe; Driver: C:\Users\Majkl\AppData\Local\Temp\uwdoypoc.sys


---- Registry - GMER 2.1 ----

Reg  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1419511138-2331033613-1603974056-1000\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeLo  343649677
Reg  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1419511138-2331033613-1603974056-1000\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeHi  30334145
Reg  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1419511138-2331033613-1603974056-1000\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeLo    343805677
Reg  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1419511138-2331033613-1603974056-1000\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeHi    30334145

---- EOF - GMER 2.1 ----