FB vir - PomoC

Zpráva

Zdeno_st · #1 Příspěvek od **Zdeno_st** » 26 črc 2011 21:09

Logfile of random's system information tool 1.09 (written by random/random)
Run by Zdenda at 2011-07-26 22:08:03
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 624 GB (65%) free of 954 GB
Total RAM: 4095 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:08:06, on 26.7.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ClamWin\bin\ClamTray.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files\trend micro\Zdenda.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:52747
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F3 - REG:win.ini: load=C:\Users\Zdenda\AppData\Local\Temp\csrss.exe
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [208842.exe] "C:\Windows\Temp\208842.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [systemup] "C:\Windows\systemup.exe" stand
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files (x86)\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [63505690-loader2.exe] "C:\Windows\Temp\63505690-loader2.exe"
O4 - HKLM\..\Run: [96288712-loader2.exe] "C:\Windows\Temp\96288712-loader2.exe"
O4 - HKLM\..\Run: [5347488.exe] "C:\Windows\Temp\5347488.exe"
O4 - HKLM\..\Run: [w_distrib.exe] "C:\Windows\update.3\svchost.exe" stand
O4 - HKCU\..\Run: [Google Update] "C:\Users\Zdenda\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe (file missing)
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe (file missing)
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe (file missing)

--
End of file - 12522 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
"C:\Program Files (x86)\Bonjour\mDNSResponder.exe"
"C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\SysWOW64\PnkBstrB.exe
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
"C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
WLIDSvcM.exe 1884
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-bbb8a0de-e6a8-4606-b48f-52f8e04325e6 -SystemEventPortName:HostProcess-c5b202d2-f3d4-4686-b00c-8e55253d563d -IoCancelEventPortName:HostProcess-f432b9fd-8890-4a74-9d77-8250acc389e4 -NonStateChangingEventPortName:HostProcess-ab4ee2e1-e3a8-4850-92dc-3128b1d96682 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:f2915a3c-4f6d-4640-ac0d-151a31b4303c
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe" -autorun
"C:\Program Files\WinFast\WFDTV\WFWIZ.exe"
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Program Files\WinFast\WFDTV\DTVSchdl.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\ClamWin\bin\ClamTray.exe" --logon
"C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe"
"C:\Program Files (x86)\iPod\bin\iPodService.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_5/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=4024.08E39380.35718652 /prefetch:3
"C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_5/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=4024.08ECAE20.1578465816 /prefetch:3
"C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_5/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=4024.08E0BB00.326139075 /prefetch:3
C:\Windows\system32\rundll32.exe "C:\Users\Zdenda\AppData\Local\Google\Chrome\APPLIC~1\120742~1.122\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Zdenda\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll" --lang=cs --channel=4024.08F45900.358750722 /prefetch:4 --flash-broker=4208
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4808 CREDAT:203009
"C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe" -Embedding
"C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe" -Embedding
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2526669868-2280195614-2853554794-10033_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2526669868-2280195614-2853554794-10033 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Zdenda\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-05-05 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2005-08-04 343112]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-12-10 9643552]
"fssui"=C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [2010-09-23 884584]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Zdenda\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-24 136176]
"WinFast Schedule"=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]
"ISUSPM Startup"=C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup []
"EA Core"=C:\Program Files (x86)\Electronic Arts\EADM\Core.exe -silent []
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2010-12-25 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CorelDRAW Graphics Suite 11b]
C:\Program Files (x86)\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe [2004-06-23 729088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files (x86)\ICQ7.1\ICQ.exe [2011-01-05 133432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files (x86)\QuickTime\QTTask.exe [2009-11-11 417792]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"ArcSoft Connection Service"=C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2010-02-15 141608]
"WinFastDTV"=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]
"ISUSScheduler"=C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe -start []
"DivX Download Manager"=C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe start []
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-01-07 253672]
"tray_ico"= []
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"208842.exe"=C:\Windows\Temp\208842.exe []
"sysdriver32.exe"=C:\Windows\sysdriver32.exe rezerv []
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe rezerv []
"systemup"=C:\Windows\systemup.exe stand []
"l1rezerv.exe"=C:\Windows\l1rezerv.exe []
"ClamWin"=C:\Program Files (x86)\ClamWin\bin\ClamTray.exe [2011-02-16 86016]
"63505690-loader2.exe"=C:\Windows\Temp\63505690-loader2.exe []
"96288712-loader2.exe"=C:\Windows\Temp\96288712-loader2.exe []
"5347488.exe"=C:\Windows\Temp\5347488.exe []
"w_distrib.exe"=C:\Windows\update.3\svchost.exe stand []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-07-26 20:53:36 ----D---- C:\rsit
2011-07-26 20:53:36 ----D---- C:\Program Files\trend micro
2011-07-25 11:43:09 ----A---- C:\Windows\system32\lsdelete.exe
2011-07-25 11:32:34 ----A---- C:\Windows\system32\drivers\SBREDrv.sys
2011-07-25 11:24:42 ----A---- C:\Windows\system32\drivers\Lbd.sys
2011-07-25 11:24:40 ----D---- C:\ProgramData\Lavasoft
2011-07-25 11:24:40 ----D---- C:\Program Files (x86)\Lavasoft
2011-07-24 18:41:39 ----D---- C:\TEXCACHE
2011-07-24 18:37:11 ----D---- C:\Program Files (x86)\Cenega
2011-07-24 14:59:59 ----A---- C:\Windows\w_distrib_iplist.txt
2011-07-24 14:59:12 ----HD---- C:\Windows\update.3
2011-07-21 20:52:09 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-07-21 20:52:09 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-07-21 20:52:09 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-07-21 20:52:09 ----A---- C:\Windows\system32\mshtmled.dll
2011-07-21 20:52:09 ----A---- C:\Windows\system32\ieui.dll
2011-07-21 20:52:09 ----A---- C:\Windows\system32\iertutil.dll
2011-07-21 20:52:08 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-07-21 20:52:08 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-07-21 20:52:08 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-07-21 20:52:08 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-07-21 20:52:08 ----A---- C:\Windows\system32\urlmon.dll
2011-07-21 20:52:08 ----A---- C:\Windows\system32\jscript9.dll
2011-07-21 20:52:08 ----A---- C:\Windows\system32\jscript.dll
2011-07-21 20:52:06 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-07-21 20:52:06 ----A---- C:\Windows\system32\mshtml.dll
2011-07-21 20:52:06 ----A---- C:\Windows\system32\ieframe.dll
2011-07-20 10:24:40 ----D---- C:\Users\Zdenda\AppData\Roaming\.clamwin
2011-07-20 10:24:34 ----D---- C:\ProgramData\.clamwin
2011-07-20 10:24:34 ----D---- C:\Program Files (x86)\ClamWin
2011-07-20 10:07:48 ----SHD---- C:\Config.Msi
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-07-20 08:57:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\url.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-07-20 08:57:45 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\wininet.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-07-20 08:57:44 ----A---- C:\Windows\system32\pngfilt.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\occache.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\msrating.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\msls31.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\mshta.exe
2011-07-20 08:57:44 ----A---- C:\Windows\system32\msfeedssync.exe
2011-07-20 08:57:44 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\jsproxy.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\imgutil.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\ieUnatt.exe
2011-07-20 08:57:44 ----A---- C:\Windows\system32\iepeers.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\ieakui.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\ieaksie.dll
2011-07-20 08:57:44 ----A---- C:\Windows\system32\admparse.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\wextract.exe
2011-07-20 08:57:43 ----A---- C:\Windows\system32\webcheck.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\vbscript.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\url.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-07-20 08:57:43 ----A---- C:\Windows\system32\mshtmler.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\msfeeds.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\licmgr10.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\inseng.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\iexpress.exe
2011-07-20 08:57:43 ----A---- C:\Windows\system32\iesysprep.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\iesetup.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\iernonce.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\iedkcs32.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\ieapfltr.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\ieapfltr.dat
2011-07-20 08:57:43 ----A---- C:\Windows\system32\ieakeng.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\ie4uinit.exe
2011-07-20 08:57:43 ----A---- C:\Windows\system32\icardie.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\dxtrans.dll
2011-07-20 08:57:43 ----A---- C:\Windows\system32\dxtmsft.dll
2011-07-20 08:55:51 ----A---- C:\Windows\system32\MRT.INI
2011-07-20 08:42:55 ----D---- C:\Windows\system32\SPReview
2011-07-20 08:41:22 ----D---- C:\Windows\system32\EventProviders
2011-07-20 08:24:19 ----D---- C:\Windows\ufa
2011-07-20 08:24:19 ----D---- C:\Windows\rpcminer
2011-07-20 08:24:19 ----D---- C:\Windows\phoenix
2011-07-19 21:25:16 ----A---- C:\Windows\gbot111.exe
2011-07-19 21:25:13 ----A---- C:\Windows\ddh_iplist.txt
2011-07-19 21:24:46 ----A---- C:\Windows\unrar.exe
2011-07-19 21:24:32 ----A---- C:\Windows\iecheck_iplist.txt
2011-07-19 21:24:06 ----HD---- C:\Windows\update.2
2011-07-19 21:23:42 ----A---- C:\Windows\btc_client_iplist.txt
2011-07-19 21:23:01 ----HD---- C:\Windows\update.5.0
2011-07-19 21:22:35 ----A---- C:\Windows\iplist.txt
2011-07-19 21:22:12 ----D---- C:\Windows\av_ico
2011-07-19 21:22:03 ----A---- C:\Windows\front_ip_list.txt
2011-07-19 21:20:26 ----HD---- C:\Windows\update.1
2011-07-19 21:20:24 ----HD---- C:\Windows\update.tray-2-0-lnk
2011-07-19 21:20:24 ----HD---- C:\Windows\update.tray-2-0
2011-07-19 21:09:02 ----A---- C:\Windows\winlog-ids.txt
2011-07-19 21:09:02 ----A---- C:\Windows\winlog-dirs.txt
2011-07-13 08:58:30 ----A---- C:\Windows\system32\win32k.sys
2011-07-13 08:58:28 ----A---- C:\Windows\system32\KernelBase.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-13 08:58:27 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-13 08:58:27 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-13 08:58:26 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-13 08:58:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-07-13 08:58:22 ----A---- C:\Windows\system32\wow64win.dll
2011-07-13 08:58:22 ----A---- C:\Windows\system32\wow64.dll
2011-07-13 08:58:22 ----A---- C:\Windows\system32\kernel32.dll
2011-07-13 08:58:22 ----A---- C:\Windows\system32\conhost.exe
2011-07-13 08:58:21 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-07-13 08:58:21 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-07-13 08:58:21 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-07-13 08:58:21 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-07-13 08:58:21 ----A---- C:\Windows\system32\wow64cpu.dll
2011-07-13 08:58:21 ----A---- C:\Windows\system32\winsrv.dll
2011-07-13 08:58:21 ----A---- C:\Windows\system32\ntvdm64.dll
2011-07-13 08:58:20 ----A---- C:\Windows\SYSWOW64\user.exe
2011-07-09 20:34:37 ----A---- C:\Windows\SYSWOW64\drvinst.exe
2011-07-09 20:34:37 ----A---- C:\Windows\SYSWOW64\cfgmgr32.dll
2011-07-09 20:34:37 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-07-09 20:34:37 ----A---- C:\Windows\system32\cfgmgr32.dll
2011-07-09 20:34:36 ----A---- C:\Windows\SYSWOW64\devrtl.dll
2011-07-09 20:34:36 ----A---- C:\Windows\SYSWOW64\devobj.dll
2011-07-09 20:34:28 ----A---- C:\Windows\system32\tquery.dll
2011-07-09 20:34:28 ----A---- C:\Windows\system32\mssrch.dll
2011-07-09 20:34:27 ----A---- C:\Windows\SYSWOW64\tquery.dll
2011-07-09 20:34:27 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2011-07-09 20:34:26 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2011-07-09 20:34:26 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2011-07-09 20:34:26 ----A---- C:\Windows\SYSWOW64\mssph.dll
2011-07-09 20:34:26 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-07-09 20:34:26 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-07-09 20:34:26 ----A---- C:\Windows\system32\mssvp.dll
2011-07-09 20:34:25 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2011-07-09 20:34:25 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2011-07-09 20:34:25 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2011-07-09 20:34:25 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-07-09 20:34:25 ----A---- C:\Windows\system32\mssphtb.dll
2011-07-09 20:34:25 ----A---- C:\Windows\system32\mssph.dll
2011-07-09 20:34:24 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2011-07-09 20:34:24 ----A---- C:\Windows\system32\msscntrs.dll

======List of files/folders modified in the last 1 month======

2011-07-26 22:08:01 ----D---- C:\Windows\Temp
2011-07-26 22:00:51 ----D---- C:\Windows\Prefetch
2011-07-26 21:12:37 ----D---- C:\Program Files (x86)\Steam
2011-07-26 21:04:59 ----D---- C:\Windows\System32
2011-07-26 21:04:59 ----D---- C:\Windows\inf
2011-07-26 21:04:59 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-26 21:00:59 ----D---- C:\Windows\system32\Tasks
2011-07-26 21:00:58 ----D---- C:\Windows\Tasks
2011-07-26 20:59:40 ----D---- C:\Windows\system32\config
2011-07-26 20:53:36 ----RD---- C:\Program Files
2011-07-26 20:51:05 ----SHD---- C:\System Volume Information
2011-07-25 15:43:32 ----D---- C:\Windows
2011-07-25 11:48:27 ----D---- C:\Windows\Logs
2011-07-25 11:32:34 ----D---- C:\Windows\system32\drivers
2011-07-25 11:24:53 ----SHD---- C:\Windows\Installer
2011-07-25 11:24:47 ----D---- C:\Windows\winsxs
2011-07-25 11:24:43 ----D---- C:\Windows\system32\catroot
2011-07-25 11:24:42 ----DC---- C:\Windows\system32\DRVSTORE
2011-07-25 11:24:40 ----RD---- C:\Program Files (x86)
2011-07-25 11:24:40 ----HD---- C:\ProgramData
2011-07-24 18:37:10 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-07-24 18:36:46 ----D---- C:\Program Files (x86)\Common Files
2011-07-24 18:29:59 ----D---- C:\Program Files\Richard Burns Rally
2011-07-24 16:55:04 ----D---- C:\Windows\SysWOW64
2011-07-22 13:40:21 ----D---- C:\Windows\Minidump
2011-07-22 13:40:21 ----D---- C:\Windows\debug
2011-07-22 10:48:50 ----D---- C:\Windows\Microsoft.NET
2011-07-22 10:48:29 ----RSD---- C:\Windows\assembly
2011-07-22 09:51:13 ----D---- C:\Program Files (x86)\Internet Explorer
2011-07-22 09:51:12 ----D---- C:\Program Files\Internet Explorer
2011-07-21 20:52:17 ----D---- C:\Windows\system32\catroot2
2011-07-21 15:40:46 ----D---- C:\Program Files (x86)\Valve
2011-07-20 15:23:52 ----D---- C:\Windows\rescache
2011-07-20 09:52:33 ----D---- C:\Windows\system32\NDF
2011-07-20 09:08:12 ----D---- C:\Windows\SYSWOW64\migration
2011-07-20 09:08:12 ----D---- C:\Windows\SYSWOW64\en-US
2011-07-20 09:08:12 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-07-20 09:08:11 ----D---- C:\Windows\system32\migration
2011-07-20 09:08:11 ----D---- C:\Windows\system32\en-US
2011-07-20 09:08:11 ----D---- C:\Windows\system32\cs-CZ
2011-07-20 09:08:11 ----D---- C:\Windows\PolicyDefinitions
2011-07-20 09:05:22 ----D---- C:\Windows\system32\DriverStore
2011-07-20 09:01:19 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-07-20 09:01:19 ----D---- C:\Program Files (x86)\Windows Portable Devices
2011-07-20 09:01:19 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2011-07-20 09:01:19 ----D---- C:\Program Files (x86)\Windows Media Player
2011-07-20 09:01:19 ----D---- C:\Program Files (x86)\Windows Mail
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Sidebar
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Portable Devices
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Photo Viewer
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Media Player
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Mail
2011-07-20 09:01:17 ----D---- C:\Program Files\Windows Journal
2011-07-20 09:01:17 ----D---- C:\Program Files\DVD Maker
2011-07-20 09:01:16 ----D---- C:\Windows\servicing
2011-07-20 09:01:16 ----D---- C:\Windows\ehome
2011-07-20 09:01:16 ----D---- C:\Program Files\Windows Defender
2011-07-20 09:01:08 ----D---- C:\Windows\SYSWOW64\Setup
2011-07-20 09:01:08 ----D---- C:\Windows\SYSWOW64\oobe
2011-07-20 09:01:08 ----D---- C:\Windows\SYSWOW64\da-DK
2011-07-20 09:01:08 ----D---- C:\Windows\SYSWOW64\cs
2011-07-20 09:01:08 ----D---- C:\Windows\SYSWOW64\AdvancedInstallers
2011-07-20 09:01:06 ----D---- C:\Windows\SYSWOW64\sppui
2011-07-20 09:01:06 ----D---- C:\Windows\SYSWOW64\manifeststore
2011-07-20 09:01:06 ----D---- C:\Windows\SYSWOW64\es-ES
2011-07-20 09:01:05 ----D---- C:\Windows\SYSWOW64\wbem
2011-07-20 09:01:04 ----D---- C:\Windows\SYSWOW64\migwiz
2011-07-20 09:01:04 ----D---- C:\Windows\SYSWOW64\Dism
2011-07-20 09:00:41 ----D---- C:\Windows\system32\oobe
2011-07-20 09:00:41 ----D---- C:\Windows\system32\da-DK
2011-07-20 09:00:40 ----D---- C:\Windows\system32\Setup
2011-07-20 09:00:40 ----D---- C:\Windows\system32\cs
2011-07-20 09:00:40 ----D---- C:\Windows\system32\AdvancedInstallers
2011-07-20 09:00:36 ----D---- C:\Windows\system32\sppui
2011-07-20 09:00:36 ----D---- C:\Windows\system32\manifeststore
2011-07-20 09:00:36 ----D---- C:\Windows\system32\es-ES
2011-07-20 09:00:34 ----D---- C:\Windows\system32\drivers\cs-CZ
2011-07-20 09:00:33 ----D---- C:\Windows\system32\wbem
2011-07-20 09:00:33 ----D---- C:\Windows\system32\migwiz
2011-07-20 09:00:33 ----D---- C:\Windows\system32\Dism
2011-07-20 09:00:19 ----RSD---- C:\Windows\Fonts
2011-07-20 09:00:18 ----D---- C:\Windows\AppPatch
2011-07-20 09:00:09 ----D---- C:\Windows\system32\Boot
2011-07-20 08:54:00 ----SD---- C:\Users\Zdenda\AppData\Roaming\Microsoft
2011-07-20 08:51:30 ----A---- C:\Windows\SYSWOW64\msclmd.dll
2011-07-20 08:51:29 ----A---- C:\Windows\system32\msclmd.dll
2011-07-19 22:29:43 ----D---- C:\Windows\system32\LogFiles
2011-07-19 21:44:38 ----HD---- C:\Windows\system32\GroupPolicy
2011-07-19 21:44:38 ----D---- C:\Windows\system32\wfp
2011-07-19 21:44:38 ----D---- C:\Windows\system32\drivers\etc
2011-07-19 21:44:37 ----D---- C:\Users\Zdenda\AppData\Roaming\ArcSoft
2011-07-19 21:44:36 ----D---- C:\ProgramData\NVIDIA
2011-07-19 21:44:36 ----D---- C:\ProgramData\InstallShield
2011-07-19 21:44:35 ----D---- C:\Windows\SYSWOW64\Macromed
2011-07-19 21:44:34 ----HD---- C:\Windows\system32\GroupPolicyUsers
2011-07-13 22:32:56 ----D---- C:\ProgramData\Microsoft Help
2011-07-01 10:31:30 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2011-04-29 69376]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-09-30 834544]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-11-16 136584]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2009-12-18 123200]
R2 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 48488]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-12-10 2222624]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20); C:\Windows\system32\DRIVERS\L1E62x64.sys [2009-06-20 54272]
R3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-07-25 17152]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-05-14 15416]
R3 WFLR6654;WinFast DTV2000 H Plus (XC4000); C:\Windows\system32\drivers\wfeaglxt.sys [2009-08-10 474496]
S3 as50orsl;as50orsl; C:\Windows\system32\drivers\as50orsl.sys []
S3 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-11-16 145336]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 ULCDRHlp;ULCDRHlp; C:\Windows\System32\Drivers\ULCDRHlp.sys []
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2009-08-28 49152]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-06-28 2151640]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-12 159336]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-02-06 66872]
R2 PnkBstrB;PnkBstrB; C:\Windows\syswow64\PnkBstrB.exe [2011-02-06 103736]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 iPod Service;iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [2010-02-15 660256]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 136176]
S2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe srv []
S2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe srv []
S2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe srv []
S2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe srv []
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe []
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 136176]
S3 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 153376]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-07-14 411432]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-11 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 26 črc 2011 21:11

Zdravim a pekny vecer preji

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich
motji píše: Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr

Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Ted nerestartujte PC - prisli byste o ucinek RKillu

Aplikujte exeHelper by Raktor

Linky ke stazeni
- COM soubor http://vyosek.ic.cz/BE/exeHelper.com
- SCR soubor http://vyosek.ic.cz/BE/exeHelper.scr
Utilitu staci spustit jako Spravce (klik pravym mysidlem), probehne oprava a vznikne log exehelperlog.txt

Aplikujte RogueKiller

stell píše: pouzijes RogueKiller>.spustis>>stlac 2> [enter] log vloz sem
http://www.viry.cz/forum/viewtopic.php? ... 05#p981205

Jeste znovu RogueKiller ale nyni s moznosti 3 a pote jeste jednou s moznosti 4

RKill, eXeHelper i RogueKiller by mely udelat logy, vlozte mi je sem

Zdeno_st · #3 Příspěvek od **Zdeno_st** » 26 črc 2011 21:19

exehelper se vypíná

#4 Příspěvek od **vyosek** » 26 črc 2011 21:25

Pokracujte tedy RogueKillerem

Zdeno_st · #5 Příspěvek od **Zdeno_st** » 26 črc 2011 21:33

Rkill

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 26.07.2011 at 22:20:02.
Operating System: Windows 7 Home Premium

Processes terminated by Rkill or while it was running:

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe

Rkill completed on 26.07.2011 at 22:20:11.

Roguekill moznost 3

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: HOSTSFix -- Date : 07/26/2011 22:34:49

Bad processes: 0

HOSTS File:
127.0.0.1 localhost

Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[7].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt

Rougekill moznost 4

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: ProxyFix -- Date : 07/26/2011 22:35:07

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[8].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt ; RKreport[8].txt

Zdeno_st · #6 Příspěvek od **Zdeno_st** » 26 črc 2011 21:33

Rkill

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 26.07.2011 at 22:20:02.
Operating System: Windows 7 Home Premium

Processes terminated by Rkill or while it was running:

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe

Rkill completed on 26.07.2011 at 22:20:11.

Roguekill moznost 3

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: HOSTSFix -- Date : 07/26/2011 22:34:49

Bad processes: 0

HOSTS File:
127.0.0.1 localhost

Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[7].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt

Rougekill moznost 4

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: ProxyFix -- Date : 07/26/2011 22:35:07

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[8].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt ; RKreport[8].txt

Zdeno_st · #7 Příspěvek od **Zdeno_st** » 26 črc 2011 21:33

Rkill

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 26.07.2011 at 22:20:02.
Operating System: Windows 7 Home Premium

Processes terminated by Rkill or while it was running:

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe

Rkill completed on 26.07.2011 at 22:20:11.

Roguekill moznost 3

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: HOSTSFix -- Date : 07/26/2011 22:34:49

Bad processes: 0

HOSTS File:
127.0.0.1 localhost

Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[7].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt

Rougekill moznost 4

RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Zdenda [Admin rights]
Mode: ProxyFix -- Date : 07/26/2011 22:35:07

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[8].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt ; RKreport[8].txt

#8 Příspěvek od **vyosek** » 26 črc 2011 21:37

Vyborne, jdeme dale

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Zdeno_st · #9 Příspěvek od **Zdeno_st** » 26 črc 2011 22:04

ComboFix 11-07-26.03 - Zdenda 26.07.2011 22:45:35.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.2518 [GMT 2:00]
Spuštěný z: c:\users\Zdenda\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Zdenda\AppData\Roaming\Local
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\gbot111.exe
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix.rar
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.3
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_srvbtcclient
-------\Service_srviecheck
-------\Service_srvsysdriver32
-------\Service_wxpdrivers
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-26 do 2011-07-26 )))))))))))))))))))))))))))))))
.
.
2011-07-26 20:44 . 2011-07-26 20:44 -------- d-----w- C:\32788R22FWJFW
2011-07-26 18:53 . 2011-07-26 20:08 -------- d-----w- c:\program files\trend micro
2011-07-26 18:53 . 2011-07-26 18:54 -------- d-----w- C:\rsit
2011-07-26 10:40 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{354E8B40-6A73-4E10-A689-4275F262F948}\mpengine.dll
2011-07-25 09:43 . 2011-07-25 09:32 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-07-25 09:32 . 2011-07-25 09:32 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-25 09:24 . 2011-04-29 10:12 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-25 09:24 . 2011-07-25 09:24 -------- d-----w- c:\programdata\Lavasoft
2011-07-25 09:24 . 2011-07-25 09:24 -------- d-----w- c:\program files (x86)\Lavasoft
2011-07-24 16:41 . 2011-07-24 16:41 -------- d-----w- C:\TEXCACHE
2011-07-24 16:41 . 2011-07-24 16:41 -------- d-----w- c:\users\Zdenda\TYPHOON
2011-07-24 16:37 . 2011-07-24 16:37 -------- d-----w- c:\program files (x86)\Cenega
2011-07-24 16:36 . 2011-07-24 16:36 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-07-20 08:24 . 2011-07-20 08:25 -------- d-----w- c:\users\Zdenda\AppData\Roaming\.clamwin
2011-07-20 08:24 . 2011-07-20 08:24 -------- d-----w- c:\programdata\.clamwin
2011-07-20 08:24 . 2011-07-20 08:24 -------- d-----w- c:\program files (x86)\ClamWin
2011-07-20 06:42 . 2011-07-20 06:42 -------- d-----w- c:\windows\system32\SPReview
2011-07-20 06:41 . 2011-07-20 06:41 -------- d-----w- c:\windows\system32\EventProviders
2011-07-20 06:24 . 2011-07-25 09:43 -------- d-----w- c:\windows\ufa
2011-07-20 06:24 . 2011-07-20 06:24 -------- d-----w- c:\windows\rpcminer
2011-07-20 06:24 . 2011-07-20 06:24 -------- d-----w- c:\windows\phoenix
2011-07-20 06:16 . 2011-07-26 20:51 -------- d-----w- c:\windows\system32\wbem\repository
2011-07-19 19:24 . 2011-07-20 06:24 246272 ----a-w- c:\windows\unrar.exe
2011-07-19 19:22 . 2011-07-19 19:45 -------- d-----w- c:\windows\av_ico
2011-07-19 19:20 . 2011-07-25 13:43 -------- d--h--w- c:\windows\update.tray-2-0
2011-07-19 19:20 . 2011-07-19 19:44 -------- d--h--w- c:\windows\update.tray-2-0-lnk
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-20 06:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-20 06:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-06-03 05:57 . 2011-07-13 06:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-24 17:14 . 2010-01-27 13:57 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-05 16:50 . 2011-01-15 20:19 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-05-03 05:29 . 2011-06-16 17:11 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-03 04:30 . 2011-06-16 17:11 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-04-29 03:06 . 2011-06-16 17:11 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-29 03:05 . 2011-06-16 17:11 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-29 03:05 . 2011-06-16 17:11 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-03-11 2912256]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2010-12-25 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-02-15 141608]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-10-02 90112]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"ClamWin"="c:\program files (x86)\ClamWin\bin\ClamTray.exe" [2011-02-15 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 136176]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 136176]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-06-28 2151640]
S3 WFLR6654;WinFast DTV2000 H Plus (XC4000);c:\windows\system32\drivers\wfeaglxt.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-16 13:49]
.
2011-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-16 13:49]
.
2011-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003Core.job
- c:\users\Zdenda\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-24 13:49]
.
2011-07-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003UA.job
- c:\users\Zdenda\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-24 13:49]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF4507.cfxxe" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-10 9643552]
"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files (x86)\ICQ7.1\ICQ.exe
TCP: DhcpNameServer = 84.16.109.1 84.16.96.2
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-ISUSPM Startup - c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-ISUSScheduler - c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe
Wow6432Node-HKLM-Run-DivX Download Manager - c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico1 - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
Wow6432Node-HKLM-Run-systemup - c:\windows\systemup.exe
Wow6432Node-HKLM-Run-l1rezerv.exe - c:\windows\l1rezerv.exe
Wow6432Node-HKLM-Run-w_distrib.exe - c:\windows\update.3\svchost.exe
HKLM-Run-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2526669868-2280195614-2853554794-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2526669868-2280195614-2853554794-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
.
**************************************************************************
.
Celkový čas: 2011-07-26 22:55:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-26 20:55
.
Před spuštěním: Volných bajtů: 654 321 373 184
Po spuštění: Volných bajtů: 653 823 270 912
.
- - End Of File - - B516B455EB9593729F1A749461369326

Neim proč ale nemůžu se na mém PC dostat na internet ani přes exploer ani přes chrome. musím posílat z notebooku.

#10 Příspěvek od **vyosek** » 26 črc 2011 22:15

Zkontrolujte nastaveni pripojeni v Centru sitovych pripojeni dle nastaveni od poskytovatele

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Driver::
gupdate
gupdatem

Folder::
c:\windows\ufa
c:\windows\rpcminer
c:\windows\phoenix
c:\windows\av_ico
c:\windows\update.tray-2-0
c:\windows\update.tray-2-0-lnk

File::
c:\windows\unrar.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003UA.job

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

RegLock::
[HKEY_USERS\S-1-5-21-2526669868-2280195614-2853554794-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
[HKEY_USERS\S-1-5-21-2526669868-2280195614-2853554794-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

DDS::
uStart Page = hxxp://start.icq.com/

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Zdeno_st · #11 Příspěvek od **Zdeno_st** » 26 črc 2011 22:26

když přesunuju CFScript na ComboFix objeví se tabulka a v ní: Pokus použít neplatnou operaci na klíč registru, který je označen pro odstranění.

#12 Příspěvek od **vyosek** » 26 črc 2011 22:28

Restratujte PC a znovu aplikujte skript

Zdeno_st · #13 Příspěvek od **Zdeno_st** » 26 črc 2011 22:33

Po druhé to jde, ale spustilo se mi opět skenování to je dobře ???

#14 Příspěvek od **vyosek** » 26 črc 2011 22:36

Ano, nechte jej pracovat, vykona i skript

Zdeno_st · #15 Příspěvek od **Zdeno_st** » 26 črc 2011 22:45

ComboFix 11-07-26.03 - Zdenda 26.07.2011 23:36:29.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.2742 [GMT 2:00]
Spuštěný z: c:\users\Zdenda\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Zdenda\Desktop\CFScript.txt
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003UA.job"
"c:\windows\unrar.exe"
.
.
Přerušeno ... Prosím spusťte ComboFix znovu.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\tasks\GoogleUpdateTaskMachineCore.job
c:\windows\tasks\GoogleUpdateTaskMachineUA.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003Core.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2526669868-2280195614-2853554794-1003UA.job
c:\windows\ufa
c:\windows\unrar.exe
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0-lnk\svchost.exe
c:\windows\update.tray-2-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-26 do 2011-07-26 )))))))))))))))))))))))))))))))
.
.
2011-07-26 21:41 . 2011-07-26 21:41 -------- d-----w- c:\users\Zdeno\AppData\Local\temp
2011-07-26 18:53 . 2011-07-26 20:08 -------- d-----w- c:\program files\trend micro
2011-07-26 18:53 . 2011-07-26 18:54 -------- d-----w- C:\rsit
2011-07-26 10:40 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{354E8B40-6A73-4E10-A689-4275F262F948}\mpengine.dll
2011-07-25 09:43 . 2011-07-25 09:32 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-07-25 09:32 . 2011-07-25 09:32 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-25 09:24 . 2011-04-29 10:12 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-25 09:24 . 2011-07-25 09:24 -------- d-----w- c:\programdata\Lavasoft
2011-07-25 09:24 . 2011-07-25 09:24 -------- d-----w- c:\program files (x86)\Lavasoft
2011-07-24 16:41 . 2011-07-24 16:41 -------- d-----w- C:\TEXCACHE
2011-07-24 16:41 . 2011-07-24 16:41 -------- d-----w- c:\users\Zdenda\TYPHOON
2011-07-24 16:37 . 2011-07-24 16:37 -------- d-----w- c:\program files (x86)\Cenega
2011-07-24 16:36 . 2011-07-24 16:36 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-07-20 08:24 . 2011-07-20 08:25 -------- d-----w- c:\users\Zdenda\AppData\Roaming\.clamwin
2011-07-20 08:24 . 2011-07-20 08:24 -------- d-----w- c:\programdata\.clamwin
2011-07-20 08:24 . 2011-07-20 08:24 -------- d-----w- c:\program files (x86)\ClamWin
2011-07-20 06:42 . 2011-07-20 06:42 -------- d-----w- c:\windows\system32\SPReview
2011-07-20 06:41 . 2011-07-20 06:41 -------- d-----w- c:\windows\system32\EventProviders
2011-07-20 06:16 . 2011-07-26 21:43 -------- d-----w- c:\windows\system32\wbem\repository
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-20 06:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-20 06:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-06-03 05:57 . 2011-07-13 06:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-24 17:14 . 2010-01-27 13:57 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-05 16:50 . 2011-01-15 20:19 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-05-03 05:29 . 2011-06-16 17:11 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-03 04:30 . 2011-06-16 17:11 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-04-29 03:06 . 2011-06-16 17:11 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-29 03:05 . 2011-06-16 17:11 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-29 03:05 . 2011-06-16 17:11 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-26_20.51.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-07-26 21:43 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-26 20:51 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-26 20:51 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-26 21:43 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-26 20:51 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-26 21:43 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2011-07-26 21:35 46326 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-23 18:45 . 2011-07-26 21:35 19204 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2526669868-2280195614-2853554794-1003_UserData.bin
- 2011-07-26 20:51 . 2011-07-26 20:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-26 21:42 . 2011-07-26 21:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-26 20:51 . 2011-07-26 20:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-26 21:42 . 2011-07-26 21:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-07-26 21:39 616106 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-07-26 19:04 616106 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-07-26 19:04 631368 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-07-26 21:39 631368 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-07-26 21:39 106486 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-07-26 19:04 106486 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-07-26 21:39 122208 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-07-26 19:04 122208 c:\windows\system32\perfc005.dat
- 2009-07-14 05:01 . 2011-07-26 20:50 391884 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-07-26 21:42 391884 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-11-13 21:43 . 2011-07-26 21:42 4485196 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2526669868-2280195614-2853554794-1003-8192.dat
- 2010-11-13 21:43 . 2011-07-26 20:50 4485196 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2526669868-2280195614-2853554794-1003-8192.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-03-11 2912256]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2010-12-25 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-02-15 141608]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-10-02 90112]
"ClamWin"="c:\program files (x86)\ClamWin\bin\ClamTray.exe" [2011-02-15 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-07-25 17152]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-06-28 2151640]
S3 WFLR6654;WinFast DTV2000 H Plus (XC4000);c:\windows\system32\drivers\wfeaglxt.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-29 11:19]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-10 9643552]
"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [BU]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files (x86)\ICQ7.1\ICQ.exe
TCP: DhcpNameServer = 84.16.109.1 84.16.96.2
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2011-07-26 23:47:01 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-26 21:47
ComboFix2.txt 2011-07-26 20:55
.
Před spuštěním: Volných bajtů: 653 933 113 344
Po spuštění: Volných bajtů: 653 904 433 152
.
- - End Of File - - A68ABBCAF9FE479AC51DD48449C7A09D

VIRY.CZ

FB vir - PomoC

FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC

Re: FB vir - PomoC