FB vir

[F.e.a.R.88]

Ahoj všem
chytil jsem FB vir tak bych prosil o radu. Tady je log z RSIT, tak doufám, že je to správně
jinak už jsem to projel Malwarebytes... Jinak předem díkes
Logfile of random's system information tool 1.09 (written by random/random)
Run by Šůlin at 2011-08-22 11:50:01
Microsoft Windows 7 Ultimate
System drive C: has 76 GB (25%) free of 303 GB
Total RAM: 4094 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:50:14, on 22.8.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe
C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe
C:\Users\Šůlin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Šůlin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.ask.com?o=102352&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - (no file)
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - (no file)
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: GdfrDUEn - {A3CF7606-E683-4375-A372-96B75DA0AEF7} - C:\Program Files (x86)\Get Styles\enlbrdr.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - (no file)
O3 - Toolbar: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - (no file)
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Šůlin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe" Minimum
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Philips GoGear VIBE Device Manager.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files (x86)\Get Styles\ct.htm
O9 - Extra 'Tools' menuitem: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files (x86)\Get Styles\ct.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Filter hijack: text/html - {914316CD-B677-425B-A12D-7BA381629542} - (no file)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Realtek8185 - Realtek - C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe
O23 - Service: Realtek87B - Realtek - C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10032 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe"
"C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe"
"C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtWlan.exe" /H
"taskhost.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtWlan.exe" /H
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe" -service
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\My Lockbox\mylbx.exe" /a
"C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE" /logon
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe" Minimum
"C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe" -silent
"C:\Users\Šůlin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe" /crashhandler
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
WLIDSvcM.exe 1872
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.031C02C0.315292771 --ignored=" --type=renderer " /prefetch:3
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel=2600.05053640.1969621828 /prefetch:12
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.050696E0.1747248932 /prefetch:3
C:\Windows\system32\rundll32.exe "C:\Users\LIN~1\AppData\Local\Google\Chrome\APPLIC~1\130782~1.112\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\13.0.782.112\gcswf32.dll" --lang=cs --channel=2600.05CAB700.817236679 --flash-broker=3620 /prefetch:4
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.04C95840.1823185309 /prefetch:3
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.031C06E0.452403523 /prefetch:3
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Nero\Update\NASvc.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.04EA4B00.517821443 /prefetch:3
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
"C:\Users\Šůlin\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Prefetch/ContentPrefetchPrerender2/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --disable-client-side-phishing-detection --channel=2600.04EA46E0.80696593 /prefetch:3
taskmgr.exe /3
C:\Windows\System32\svchost.exe -k WerSvcGroup
taskeng.exe {8E981B75-A256-41C6-AA20-0C656AAE3E01}
"C:\Users\Šůlin\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-361616173-1329515160-324987531-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-361616173-1329515160-324987531-1001UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "iobit@mybrowserbar.com:4.3, wtxpcom@mybrowserbar.com:4.3, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.14"
prefs.js - "keyword.URL" - "http://websearch.ask.com/redirect?clien ... YYYYYNL&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browser.xpt
browsercomps.dll
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files (x86)\Mozilla Firefox\plugins\
npdeployJava1.dll
npnul32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\extensions\
toolbar@ask.com
{6236BA26-C117-4007-928C-DE0716C7FA80}
{6236BA26-C117-4007-928C-DE0716C7FA96}
{6236BA26-C117-4007-928C-DE0716C7FA99}

C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
GdfrDUEn Class - C:\Program Files (x86)\Get Styles\enlbrdr.dll [2010-02-11 185856]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-30 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} -

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-07-28 11101800]
"mylbx"=C:\Program Files\My Lockbox\mylbx.exe [2011-02-03 1898208]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2010-03-25 2726728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"Google Update"=C:\Users\Šůlin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-16 136176]
"OscarEditor"=C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2009-11-24 2642432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-11-13 500208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [2010-08-09 248832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Šůlin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-16 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2009-11-24 2642432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files (x86)\Winamp\winampa.exe [2010-07-12 74752]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"ATICustomerCare"=C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [2010-03-04 311296]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2010-11-29 421888]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-07-07 336384]
"tray_ico"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-07-06 449584]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-07-04 3493720]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Philips GoGear VIBE Device Manager.lnk - C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-22 11:43:24 ----D---- C:\rsit
2011-08-22 11:43:24 ----D---- C:\Program Files\trend micro
2011-08-22 11:27:16 ----D---- C:\ProgramData\Alwil Software
2011-08-22 11:27:16 ----D---- C:\Program Files\AVAST Software
2011-08-21 19:47:14 ----D---- C:\Users\Šůlin\AppData\Roaming\Malwarebytes
2011-08-21 19:47:00 ----A---- C:\Windows\SYSWOW64\drivers\mbamswissarmy.sys
2011-08-21 19:46:59 ----D---- C:\ProgramData\Malwarebytes
2011-08-21 19:46:57 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-21 19:46:57 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-08-21 18:18:58 ----D---- C:\Program Files (x86)\ESET
2011-08-21 18:07:06 ----A---- C:\Windows\ntbtlog.txt
2011-08-21 17:47:33 ----HD---- C:\Windows\update.tray-15-0-lnk
2011-08-21 17:47:33 ----HD---- C:\Windows\update.tray-15-0
2011-08-21 17:41:02 ----D---- C:\Windows\ufa
2011-08-21 17:41:02 ----D---- C:\Windows\phoenix
2011-08-21 17:36:59 ----HD---- C:\Windows\update.7.1
2011-08-21 17:36:51 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-21 17:36:39 ----A---- C:\Windows\unrar.exe
2011-08-21 17:36:26 ----HD---- C:\Windows\update.2
2011-08-21 17:36:16 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-21 17:35:20 ----HD---- C:\Windows\update.5.0
2011-08-21 17:35:15 ----A---- C:\Windows\iplist.txt
2011-08-21 17:34:28 ----A---- C:\Windows\front_ip_list.txt
2011-08-21 17:33:17 ----D---- C:\Windows\av_ico
2011-08-21 17:31:22 ----HD---- C:\Windows\update.1
2011-08-21 17:31:18 ----HD---- C:\Windows\update.tray-7-0-lnk
2011-08-21 17:31:18 ----HD---- C:\Windows\update.tray-7-0
2011-08-21 17:19:08 ----A---- C:\Windows\winlog-ids.txt
2011-08-21 17:19:08 ----A---- C:\Windows\winlog-dirs.txt
2011-08-17 15:54:23 ----D---- C:\ProgramData\ATI
2011-08-17 15:54:21 ----D---- C:\Program Files (x86)\AMD APP
2011-08-17 15:54:01 ----D---- C:\ProgramData\AMD
2011-08-17 15:54:01 ----A---- C:\Windows\system32\drivers\amdiox64.sys
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\winver.exe
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\user32.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\systemcpl.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\sppcomapi.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\slmgr.vbs
2011-08-13 16:26:37 ----A---- C:\bootsect.lxe.bak
2011-08-10 10:57:34 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 10:57:34 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 10:57:33 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 10:57:16 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 10:56:59 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 10:56:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 10:56:58 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 10:56:58 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 10:56:55 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 10:56:00 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 10:55:47 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 10:55:45 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 10:55:44 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 10:55:43 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 10:55:43 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 10:55:42 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 10:55:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 10:55:41 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 10:55:41 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 10:55:40 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 10:55:40 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-10 10:55:40 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-10 10:55:40 ----A---- C:\Windows\system32\iedkcs32.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\mstime.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\url.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\mstime.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\msfeedssync.exe
2011-08-10 10:55:39 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\licmgr10.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\iepeers.dll
2011-08-10 10:54:44 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 10:54:43 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 10:54:43 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-02 19:00:47 ----D---- C:\Windows\Minidump
2011-07-30 18:41:25 ----D---- C:\Users\Šůlin\AppData\Roaming\Skype
2011-07-30 18:41:10 ----RD---- C:\Program Files (x86)\Skype
2011-07-30 18:40:32 ----D---- C:\ProgramData\Skype
2011-07-29 10:14:19 ----D---- C:\Users\Šůlin\AppData\Roaming\Origin
2011-07-29 10:03:12 ----D---- C:\ProgramData\Origin
2011-07-29 10:03:11 ----D---- C:\Program Files (x86)\Origin Games
2011-07-29 10:02:37 ----D---- C:\Program Files (x86)\Origin
2011-07-28 19:36:14 ----D---- C:\ProgramData\Electronic Arts
2011-07-27 20:37:49 ----A---- C:\Windows\system32\drivers\atksgt.sys
2011-07-27 20:37:46 ----A---- C:\Windows\system32\drivers\lirsgt.sys
2011-07-27 20:35:12 ----D---- C:\Program Files (x86)\Focus
2011-07-26 23:05:50 ----D---- C:\Program Files (x86)\Get Styles

======List of files/folders modified in the last 1 month======

2011-08-22 11:50:00 ----D---- C:\Windows\Temp
2011-08-22 11:43:24 ----RD---- C:\Program Files
2011-08-22 11:27:42 ----SHD---- C:\Windows\Installer
2011-08-22 11:27:42 ----D---- C:\Config.Msi
2011-08-22 11:27:16 ----HD---- C:\ProgramData
2011-08-22 11:27:13 ----SHD---- C:\System Volume Information
2011-08-22 10:58:04 ----D---- C:\Windows
2011-08-21 19:47:00 ----D---- C:\Windows\SYSWOW64\drivers
2011-08-21 19:46:57 ----RD---- C:\Program Files (x86)
2011-08-21 19:46:57 ----D---- C:\Windows\system32\drivers
2011-08-21 19:07:21 ----D---- C:\Windows\Prefetch
2011-08-21 18:30:40 ----D---- C:\Program Files (x86)\Application Updater
2011-08-21 17:36:50 ----D---- C:\Windows\system32\drivers\etc
2011-08-21 17:29:34 ----D---- C:\Windows\system32\config
2011-08-21 13:29:43 ----D---- C:\Users\Šůlin\AppData\Roaming\Media Player Classic
2011-08-21 12:16:24 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2011-08-20 21:07:16 ----D---- C:\Users\Šůlin\AppData\Roaming\Winamp
2011-08-19 17:53:06 ----D---- C:\Windows\system32\catroot2
2011-08-19 00:02:22 ----D---- C:\Windows\system32\NDF
2011-08-17 15:59:17 ----D---- C:\Windows\SysWOW64
2011-08-17 15:59:17 ----D---- C:\Windows\System32
2011-08-17 15:54:07 ----D---- C:\Program Files\ATI Technologies
2011-08-17 15:54:04 ----D---- C:\Windows\inf
2011-08-17 15:54:03 ----D---- C:\Windows\system32\DriverStore
2011-08-17 15:54:03 ----D---- C:\Windows\system32\catroot
2011-08-17 15:53:58 ----D---- C:\Program Files (x86)\ATI Technologies
2011-08-13 16:32:05 ----D---- C:\Users\Šůlin\AppData\Roaming\uTorrent
2011-08-12 22:44:27 ----D---- C:\Program Files (x86)\Opera
2011-08-12 15:53:36 ----D---- C:\Program Files (x86)\Common Files
2011-08-12 15:47:51 ----D---- C:\Windows\debug
2011-08-11 09:07:19 ----D---- C:\Windows\Microsoft.NET
2011-08-11 09:07:18 ----RSD---- C:\Windows\assembly
2011-08-10 19:38:37 ----D---- C:\Windows\winsxs
2011-08-10 19:36:37 ----D---- C:\Windows\AppPatch
2011-08-10 19:36:36 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 19:36:36 ----D---- C:\Program Files\Internet Explorer
2011-08-10 19:36:36 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 19:36:35 ----D---- C:\Windows\system32\migration
2011-08-10 17:40:29 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 17:37:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-08 10:42:25 ----D---- C:\Windows\system32\Tasks
2011-08-08 10:42:24 ----D---- C:\Windows\Tasks
2011-08-07 16:38:38 ----D---- C:\Program Files (x86)\Electronic Arts
2011-08-07 16:38:36 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-07-30 11:04:59 ----D---- C:\Program Files\TeamSpeak 3 Client

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 FSProFilter;FSPro File Filter; C:\Windows\System32\Drivers\FSPFltd.sys [2010-07-22 54848]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-20 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-08 9884672]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-07-08 307712]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-07-28 2445672]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-07-06 25912]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-05-24 253728]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver; C:\Windows\system32\DRIVERS\RTL85n64.sys [2009-10-16 1471488]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-07-27 303616]
S2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2011-07-27 35328]
S3 anu4hbdl;anu4hbdl; C:\Windows\system32\drivers\anu4hbdl.sys []
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-07-15 116240]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-08 9884672]
S3 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool64.sys [2006-11-10 30720]
S3 DrvAgent64;DrvAgent64; \??\C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-05-03 21712]
S3 ENTECH64;ENTECH64; \??\C:\Windows\system32\DRIVERS\ENTECH64.sys [2008-04-22 12744]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-07-08 204288]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
R2 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-06-19 75064]
R2 Realtek8185;Realtek8185; C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
R2 Realtek87B;Realtek87B; C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
R2 TeamViewer4;TeamViewer 4; C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-08-11 185640]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-07-04 42184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-08-03 411432]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-17 1255736]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

[Danstahr]

Logy prosím příště nevkládejte do citace ani do code, špatně se to čte.

-

Pozor! Tato utilita má velkou schopnost mazat a její použití je určeno výhradně členům týmu tohoto fóra. Svévolné použití může vést ke zboření a reinstalaci systému

Stáhněte ComboFix a uložte jej na Plochu.

Vypněte všechny rezidentní štíty antivirů a všechny programy běžící na pozadí.
Spusťte ComboFix s administrátorským oprávněním.
Potvrďte licenční podmínky a případně i instalaci konzoly pro zotavení
Během skenu nechte počítač naprosto v klidu.
Sken trvá zhruba 15 minut, ale doba se může lišit v závislosti na stavu systému
Po dokončení skenu se zobrazí log (pokud by se neotevřel, lze jej nalézt na systémovém disku jako ComboFix.txt), obsah logu vložte sem
ComboFixu si do dalšího pokynu nevšímejte

[F.e.a.R.88]

ComboFix 11-08-22.02 - Šůlin 22.08.2011 19:15:30.1.3 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4094.2955 [GMT 2:00]
Spuštěný z: c:\users\Šůlin\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\SysWow64\detoured.dll
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-22 do 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-22 17:22 . 2011-08-22 17:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-22 09:43 . 2011-08-22 09:50 -------- d-----w- c:\program files\trend micro
2011-08-22 09:43 . 2011-08-22 09:44 -------- d-----w- C:\rsit
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\programdata\Alwil Software
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\program files\AVAST Software
2011-08-21 17:47 . 2011-08-21 17:47 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Malwarebytes
2011-08-21 17:47 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:46 . 2011-08-21 17:46 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:46 . 2011-08-21 17:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:46 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 16:18 . 2011-08-21 16:18 -------- d-----w- c:\program files (x86)\ESET
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 15:47 . 2011-08-22 08:58 -------- d--h--w- c:\windows\update.tray-15-0-lnk
2011-08-21 15:47 . 2011-08-22 07:53 -------- d--h--w- c:\windows\update.tray-15-0
2011-08-21 15:41 . 2011-08-21 15:41 -------- d-----w- c:\windows\ufa
2011-08-21 15:36 . 2011-08-21 18:33 -------- d--h--w- c:\windows\update.7.1
2011-08-21 15:36 . 2011-08-21 15:41 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 15:33 . 2011-08-21 15:49 -------- d-----w- c:\windows\av_ico
2011-08-21 15:31 . 2011-08-22 08:58 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-21 15:31 . 2011-08-22 07:53 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\users\Šůlin\AppData\Local\AMD
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\ATI
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\AMD
2011-08-17 13:54 . 2010-02-18 07:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
2011-08-13 14:32 . 2011-08-13 14:32 2048 ----a-w- c:\windows\SysWow64\winver.exe
2011-08-13 14:32 . 2011-08-13 14:32 833024 ----a-w- c:\windows\SysWow64\user32.dll
2011-08-13 14:32 . 2011-08-13 14:32 410624 ----a-w- c:\windows\SysWow64\systemcpl.dll
2011-08-13 14:32 . 2011-08-13 14:32 1536 ----a-w- c:\windows\SysWow64\sppcomapi.dll
2011-08-13 14:32 . 2011-08-13 14:32 113543 ----a-w- c:\windows\SysWow64\slmgr.vbs
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:58 126976 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-06-15 09:58 212992 ----a-w- c:\windows\system32\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:58 163840 ----a-w- c:\windows\system32\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:04 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:04 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
2011-08-10 08:57 . 2011-06-15 09:04 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:04 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 94208 ----a-w- c:\program files (x86)\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-07-09 02:44 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 08:54 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 08:54 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-10 08:54 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-07-30 16:41 . 2011-07-30 18:41 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Skype
2011-07-30 16:41 . 2011-07-30 16:41 -------- d-----r- c:\program files (x86)\Skype
2011-07-30 16:40 . 2011-07-30 16:41 -------- d-----w- c:\programdata\Skype
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Origin
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Local\Origin
2011-07-29 08:03 . 2011-07-29 08:14 -------- d-----w- c:\programdata\Origin
2011-07-29 08:03 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin Games
2011-07-29 08:02 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin
2011-07-28 17:36 . 2011-07-29 08:03 -------- d-----w- c:\programdata\Electronic Arts
2011-07-27 18:37 . 2011-07-27 18:37 303616 ----a-w- c:\windows\system32\drivers\atksgt.sys
2011-07-27 18:37 . 2011-07-27 18:37 35328 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2011-07-27 18:35 . 2011-07-27 18:35 -------- d-----w- c:\program files (x86)\Focus
2011-07-27 18:34 . 2011-07-27 18:34 323716 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-07-27 18:34 . 2011-07-27 18:34 192644 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-27 18:34 . 2004-10-22 00:18 749568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-27 18:34 . 2004-10-22 00:17 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-27 18:34 . 2004-10-22 00:17 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-27 18:34 . 2004-10-22 00:16 180224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-27 18:34 . 2004-10-22 00:16 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-26 21:05 . 2011-07-26 21:05 -------- d-----w- c:\program files (x86)\Get Styles
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 10:16 . 2010-10-17 10:10 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-08-21 10:16 . 2010-10-17 10:08 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-16 04:32 . 2011-08-10 08:56 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-08 04:15 . 2011-07-08 04:15 9884672 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-07-08 03:54 . 2011-07-08 03:54 23385600 ----a-w- c:\windows\system32\atio6axx.dll
2011-07-08 03:33 . 2011-07-08 03:33 17940992 ----a-w- c:\windows\SysWow64\atioglxx.dll
2011-07-08 03:29 . 2011-07-08 03:29 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-07-08 03:29 . 2010-08-26 02:01 689152 ----a-w- c:\windows\SysWow64\aticfx32.dll
2011-07-08 03:28 . 2010-08-26 02:00 814592 ----a-w- c:\windows\system32\aticfx64.dll
2011-07-08 03:25 . 2011-07-08 03:25 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-07-08 03:25 . 2011-07-08 03:25 485376 ----a-w- c:\windows\system32\atieclxx.exe
2011-07-08 03:25 . 2011-07-08 03:25 204288 ----a-w- c:\windows\system32\atiesrxx.exe
2011-07-08 03:23 . 2011-07-08 03:23 120320 ----a-w- c:\windows\system32\atitmm64.dll
2011-07-08 03:23 . 2011-07-08 03:23 423424 ----a-w- c:\windows\system32\atipdl64.dll
2011-07-08 03:23 . 2011-07-08 03:23 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2011-07-08 03:23 . 2011-07-08 03:23 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2011-07-08 03:23 . 2011-07-08 03:23 16384 ----a-w- c:\windows\system32\atimuixx.dll
2011-07-08 03:23 . 2011-07-08 03:23 59392 ----a-w- c:\windows\system32\atiedu64.dll
2011-07-08 03:22 . 2011-07-08 03:22 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2011-07-08 03:19 . 2011-07-08 03:19 4275712 ----a-w- c:\windows\SysWow64\atidxx32.dll
2011-07-08 03:10 . 2009-07-13 21:59 5072896 ----a-w- c:\windows\system32\atidxx64.dll
2011-07-08 03:06 . 2011-07-08 03:06 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
2011-07-08 03:05 . 2011-07-08 03:05 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-07-08 03:05 . 2011-07-08 03:05 3848704 ----a-w- c:\windows\system32\atiumd6a.dll
2011-07-08 03:02 . 2011-07-08 03:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2011-07-08 03:02 . 2011-07-08 03:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2011-07-08 03:01 . 2011-07-08 03:01 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2011-07-08 03:01 . 2011-07-08 03:01 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2011-07-08 03:01 . 2011-07-08 03:01 8134656 ----a-w- c:\windows\system32\aticaldd64.dll
2011-07-08 03:00 . 2010-08-26 01:33 4367360 ----a-w- c:\windows\SysWow64\atiumdag.dll
2011-07-08 02:58 . 2011-07-08 02:58 6740480 ----a-w- c:\windows\SysWow64\aticaldd.dll
2011-07-08 02:55 . 2010-08-26 01:25 4039680 ----a-w- c:\windows\SysWow64\atiumdva.dll
2011-07-08 02:54 . 2010-08-26 01:27 58880 ----a-w- c:\windows\system32\coinst.dll
2011-07-08 02:54 . 2011-07-08 02:54 5540864 ----a-w- c:\windows\system32\atiumd64.dll
2011-07-08 02:47 . 2011-07-08 02:47 375808 ----a-w- c:\windows\system32\atiadlxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 266240 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2011-07-08 02:47 . 2011-07-08 02:47 15360 ----a-w- c:\windows\system32\atig6pxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\system32\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 39936 ----a-w- c:\windows\system32\atig6txx.dll
2011-07-08 02:47 . 2011-07-08 02:47 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 307712 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-07-08 02:46 . 2010-08-26 01:20 40960 ----a-w- c:\windows\system32\atiuxp64.dll
2011-07-08 02:46 . 2011-07-08 02:46 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2011-07-08 02:46 . 2011-07-08 02:46 38912 ----a-w- c:\windows\system32\atiu9p64.dll
2011-07-08 02:45 . 2010-08-26 01:19 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2011-07-08 02:45 . 2011-07-08 02:45 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\atimpc64.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2011-07-07 21:37 . 2011-07-07 21:37 60416 ----a-w- c:\windows\system32\OVDecode64.dll
2011-07-07 21:37 . 2011-07-07 21:37 51200 ----a-w- c:\windows\system32\OpenCL.dll
2011-07-07 21:36 . 2011-07-07 21:36 16907776 ----a-w- c:\windows\system32\amdocl64.dll
2011-07-04 11:43 . 2010-10-17 10:35 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-10-17 10:35 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-04 11:43 . 2011-01-18 10:44 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-01-01 03:45 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-10-17 10:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-10-17 10:36 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-10-17 10:36 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-10-17 10:36 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-10-17 10:36 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-27 14:23 . 2011-06-27 14:23 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-06-27 14:23 . 2011-06-27 14:23 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-06-27 14:22 . 2011-06-27 14:22 13904896 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-06-19 16:48 . 2010-10-17 10:08 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-19 13:36 . 2010-10-17 10:08 3360624 ----a-w- c:\windows\SysWow64\pbsvc.exe
2011-06-16 15:36 . 2011-06-09 08:48 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-16 01:34 . 2011-06-16 01:34 2971648 ----a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-06-16 01:34 . 2011-06-16 01:34 105984 ----a-w- c:\windows\system32\SlotMaximizerAg.dll
2011-06-11 02:56 . 2011-07-13 17:08 3134464 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100u.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100.dll
2011-06-10 23:15 . 2011-06-10 23:15 829264 ----a-w- c:\windows\system32\msvcr100.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100fra.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100deu.dll
2011-06-10 23:15 . 2011-06-10 23:15 63824 ----a-w- c:\windows\system32\mfc100esn.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2009-07-14 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7600.16385] .. c:\windows\system32\user32.dll
.
[-] 2011-08-13 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7600.16385] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2010-02-11 07:58 185856 ----a-w- c:\program files (x86)\Get Styles\enlbrdr.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"OscarEditor"="c:\program files (x86)\OSCAR Editor\OscarEditor.exe" [2009-11-24 2642432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-07 336384]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Philips GoGear VIBE Device Manager.lnk - c:\philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe [2011-4-7 1701224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-05-03 21712]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Realtek8185;Realtek8185;c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-08-11 185640]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 20:20]
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 20:20]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
"mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-02-03 1898208]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2726728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://nl.ask.com?o=102352&l=dis
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU-ASK&o=102349&locale=en_NL&apn_uid=D671F971-5E5D-467D-81AC-9B7FE48F22DB&apn_ptnrs=Q6&apn_sauid=E195915B-251D-410A-943C-BF36BAC66E58&apn_dtid=YYYYYYYYNL&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtWlan.exe
c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtWlan.exe
.
**************************************************************************
.
Celkový čas: 2011-08-22 19:29:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-22 17:29
.
Před spuštěním: Volných bajtů: 79 557 746 688
Po spuštění: Volných bajtů: 79 486 525 440
.
- - End Of File - - 9B46C524CDE7225D520A0A84FCBA6A90

[Danstahr]

Otevřete Poznámkový blok, vložte do něj následující text a uložte soubor na Plochu jako CFScript.txt. Pak soubor přetáhněte na ikonu ComboFixu (viz obrázek). Po restartu se otevře log, ten sem vložte.

Kód: Vybrat vše

killall::

file::
c:\windows\unrar.exe
c:\users\Šůlin\AppData\Local\BITFF25.tmp
c:\users\Šůlin\AppData\Local\BITEA60.tmp
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

folder::
c:\windows\update.tray-15-0-lnk
c:\windows\update.tray-15-0
c:\windows\ufa
c:\windows\update.7.1
c:\windows\av_ico
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0

registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-

[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-

[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATICustomerCare"=-
"SwitchBoard"=-
"QuickTime Task"=-
"SunJavaUpdateSched"=-
"StartCCC"=-
"Malwarebytes' Anti-Malware"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"=dword:00000001

DDS::
uStart Page = hxxp://nl.ask.com?o=102352&l=dis

Firefox::
FF - ProfilePath - c:\users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?clien ... YYYYYNL&q=

Driver::
gupdate
gupdatem

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

reboot::

[F.e.a.R.88]

ComboFix 11-08-22.02 - Šůlin 22.08.2011 20:25:05.2.3 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4094.2957 [GMT 2:00]
Spuštěný z: c:\users\Ő¨lin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Ő¨lin\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-22 do 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-22 18:32 . 2011-08-22 18:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-22 09:43 . 2011-08-22 09:50 -------- d-----w- c:\program files\trend micro
2011-08-22 09:43 . 2011-08-22 09:44 -------- d-----w- C:\rsit
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\programdata\Alwil Software
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\program files\AVAST Software
2011-08-21 17:47 . 2011-08-21 17:47 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Malwarebytes
2011-08-21 17:47 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:46 . 2011-08-21 17:46 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:46 . 2011-08-21 17:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:46 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 16:18 . 2011-08-21 16:18 -------- d-----w- c:\program files (x86)\ESET
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 15:47 . 2011-08-22 08:58 -------- d--h--w- c:\windows\update.tray-15-0-lnk
2011-08-21 15:47 . 2011-08-22 07:53 -------- d--h--w- c:\windows\update.tray-15-0
2011-08-21 15:41 . 2011-08-21 15:41 -------- d-----w- c:\windows\ufa
2011-08-21 15:36 . 2011-08-21 18:33 -------- d--h--w- c:\windows\update.7.1
2011-08-21 15:36 . 2011-08-21 15:41 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 15:33 . 2011-08-21 15:49 -------- d-----w- c:\windows\av_ico
2011-08-21 15:31 . 2011-08-22 08:58 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-21 15:31 . 2011-08-22 07:53 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\users\Šůlin\AppData\Local\AMD
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\ATI
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\AMD
2011-08-17 13:54 . 2010-02-18 07:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
2011-08-13 14:32 . 2011-08-13 14:32 2048 ----a-w- c:\windows\SysWow64\winver.exe
2011-08-13 14:32 . 2011-08-13 14:32 833024 ----a-w- c:\windows\SysWow64\user32.dll
2011-08-13 14:32 . 2011-08-13 14:32 410624 ----a-w- c:\windows\SysWow64\systemcpl.dll
2011-08-13 14:32 . 2011-08-13 14:32 1536 ----a-w- c:\windows\SysWow64\sppcomapi.dll
2011-08-13 14:32 . 2011-08-13 14:32 113543 ----a-w- c:\windows\SysWow64\slmgr.vbs
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:58 126976 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-06-15 09:58 212992 ----a-w- c:\windows\system32\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:58 163840 ----a-w- c:\windows\system32\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:04 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:04 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
2011-08-10 08:57 . 2011-06-15 09:04 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:04 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 94208 ----a-w- c:\program files (x86)\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-07-09 02:44 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 08:54 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 08:54 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-10 08:54 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-07-30 16:41 . 2011-07-30 18:41 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Skype
2011-07-30 16:41 . 2011-07-30 16:41 -------- d-----r- c:\program files (x86)\Skype
2011-07-30 16:40 . 2011-07-30 16:41 -------- d-----w- c:\programdata\Skype
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Origin
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Local\Origin
2011-07-29 08:03 . 2011-07-29 08:14 -------- d-----w- c:\programdata\Origin
2011-07-29 08:03 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin Games
2011-07-29 08:02 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin
2011-07-28 17:36 . 2011-07-29 08:03 -------- d-----w- c:\programdata\Electronic Arts
2011-07-27 18:37 . 2011-07-27 18:37 303616 ----a-w- c:\windows\system32\drivers\atksgt.sys
2011-07-27 18:37 . 2011-07-27 18:37 35328 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2011-07-27 18:35 . 2011-07-27 18:35 -------- d-----w- c:\program files (x86)\Focus
2011-07-27 18:34 . 2011-07-27 18:34 323716 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-07-27 18:34 . 2011-07-27 18:34 192644 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-27 18:34 . 2004-10-22 00:18 749568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-27 18:34 . 2004-10-22 00:17 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-27 18:34 . 2004-10-22 00:17 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-27 18:34 . 2004-10-22 00:16 180224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-27 18:34 . 2004-10-22 00:16 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-26 21:05 . 2011-07-26 21:05 -------- d-----w- c:\program files (x86)\Get Styles
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 10:16 . 2010-10-17 10:10 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-08-21 10:16 . 2010-10-17 10:08 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-16 04:32 . 2011-08-10 08:56 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-08 04:15 . 2011-07-08 04:15 9884672 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-07-08 03:54 . 2011-07-08 03:54 23385600 ----a-w- c:\windows\system32\atio6axx.dll
2011-07-08 03:33 . 2011-07-08 03:33 17940992 ----a-w- c:\windows\SysWow64\atioglxx.dll
2011-07-08 03:29 . 2011-07-08 03:29 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-07-08 03:29 . 2010-08-26 02:01 689152 ----a-w- c:\windows\SysWow64\aticfx32.dll
2011-07-08 03:28 . 2010-08-26 02:00 814592 ----a-w- c:\windows\system32\aticfx64.dll
2011-07-08 03:25 . 2011-07-08 03:25 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-07-08 03:25 . 2011-07-08 03:25 485376 ----a-w- c:\windows\system32\atieclxx.exe
2011-07-08 03:25 . 2011-07-08 03:25 204288 ----a-w- c:\windows\system32\atiesrxx.exe
2011-07-08 03:23 . 2011-07-08 03:23 120320 ----a-w- c:\windows\system32\atitmm64.dll
2011-07-08 03:23 . 2011-07-08 03:23 423424 ----a-w- c:\windows\system32\atipdl64.dll
2011-07-08 03:23 . 2011-07-08 03:23 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2011-07-08 03:23 . 2011-07-08 03:23 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2011-07-08 03:23 . 2011-07-08 03:23 16384 ----a-w- c:\windows\system32\atimuixx.dll
2011-07-08 03:23 . 2011-07-08 03:23 59392 ----a-w- c:\windows\system32\atiedu64.dll
2011-07-08 03:22 . 2011-07-08 03:22 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2011-07-08 03:19 . 2011-07-08 03:19 4275712 ----a-w- c:\windows\SysWow64\atidxx32.dll
2011-07-08 03:10 . 2009-07-13 21:59 5072896 ----a-w- c:\windows\system32\atidxx64.dll
2011-07-08 03:06 . 2011-07-08 03:06 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
2011-07-08 03:05 . 2011-07-08 03:05 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-07-08 03:05 . 2011-07-08 03:05 3848704 ----a-w- c:\windows\system32\atiumd6a.dll
2011-07-08 03:02 . 2011-07-08 03:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2011-07-08 03:02 . 2011-07-08 03:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2011-07-08 03:01 . 2011-07-08 03:01 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2011-07-08 03:01 . 2011-07-08 03:01 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2011-07-08 03:01 . 2011-07-08 03:01 8134656 ----a-w- c:\windows\system32\aticaldd64.dll
2011-07-08 03:00 . 2010-08-26 01:33 4367360 ----a-w- c:\windows\SysWow64\atiumdag.dll
2011-07-08 02:58 . 2011-07-08 02:58 6740480 ----a-w- c:\windows\SysWow64\aticaldd.dll
2011-07-08 02:55 . 2010-08-26 01:25 4039680 ----a-w- c:\windows\SysWow64\atiumdva.dll
2011-07-08 02:54 . 2010-08-26 01:27 58880 ----a-w- c:\windows\system32\coinst.dll
2011-07-08 02:54 . 2011-07-08 02:54 5540864 ----a-w- c:\windows\system32\atiumd64.dll
2011-07-08 02:47 . 2011-07-08 02:47 375808 ----a-w- c:\windows\system32\atiadlxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 266240 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2011-07-08 02:47 . 2011-07-08 02:47 15360 ----a-w- c:\windows\system32\atig6pxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\system32\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 39936 ----a-w- c:\windows\system32\atig6txx.dll
2011-07-08 02:47 . 2011-07-08 02:47 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 307712 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-07-08 02:46 . 2010-08-26 01:20 40960 ----a-w- c:\windows\system32\atiuxp64.dll
2011-07-08 02:46 . 2011-07-08 02:46 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2011-07-08 02:46 . 2011-07-08 02:46 38912 ----a-w- c:\windows\system32\atiu9p64.dll
2011-07-08 02:45 . 2010-08-26 01:19 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2011-07-08 02:45 . 2011-07-08 02:45 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\atimpc64.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2011-07-07 21:37 . 2011-07-07 21:37 60416 ----a-w- c:\windows\system32\OVDecode64.dll
2011-07-07 21:37 . 2011-07-07 21:37 51200 ----a-w- c:\windows\system32\OpenCL.dll
2011-07-07 21:36 . 2011-07-07 21:36 16907776 ----a-w- c:\windows\system32\amdocl64.dll
2011-07-04 11:43 . 2010-10-17 10:35 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-10-17 10:35 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-04 11:43 . 2011-01-18 10:44 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-01-01 03:45 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-10-17 10:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-10-17 10:36 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-10-17 10:36 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-10-17 10:36 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-10-17 10:36 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-27 14:23 . 2011-06-27 14:23 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-06-27 14:23 . 2011-06-27 14:23 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-06-27 14:22 . 2011-06-27 14:22 13904896 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-06-19 16:48 . 2010-10-17 10:08 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-19 13:36 . 2010-10-17 10:08 3360624 ----a-w- c:\windows\SysWow64\pbsvc.exe
2011-06-16 15:36 . 2011-06-09 08:48 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-16 01:34 . 2011-06-16 01:34 2971648 ----a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-06-16 01:34 . 2011-06-16 01:34 105984 ----a-w- c:\windows\system32\SlotMaximizerAg.dll
2011-06-11 02:56 . 2011-07-13 17:08 3134464 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100u.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100.dll
2011-06-10 23:15 . 2011-06-10 23:15 829264 ----a-w- c:\windows\system32\msvcr100.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100fra.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100deu.dll
2011-06-10 23:15 . 2011-06-10 23:15 63824 ----a-w- c:\windows\system32\mfc100esn.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2009-07-14 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7600.16385] .. c:\windows\system32\user32.dll
.
[-] 2011-08-13 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7600.16385] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-08-22_17.24.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-16 08:25 . 2011-08-22 17:25 56058 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-08-22 17:14 41222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-22 18:24 41222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-16 08:25 . 2011-08-22 18:24 18234 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-361616173-1329515160-324987531-1001_UserData.bin
+ 2010-10-16 08:17 . 2011-08-22 18:34 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:17 . 2011-08-22 17:24 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:17 . 2011-08-22 17:24 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-16 08:17 . 2011-08-22 18:34 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-22 18:34 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-22 17:24 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-16 08:25 . 2011-08-22 18:34 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-16 08:25 . 2011-08-22 18:34 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-22 18:34 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-22 18:34 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-22 18:34 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-08-22 17:24 . 2011-08-22 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-22 18:34 . 2011-08-22 18:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-22 17:24 . 2011-08-22 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-22 18:34 . 2011-08-22 18:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:12 . 2011-08-22 17:24 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-08-22 18:34 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2011-08-22 17:22 364232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-22 18:32 364232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-10-16 14:09 . 2011-08-22 18:32 1346288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2010-10-16 14:09 . 2011-08-22 17:22 1346288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2010-02-11 07:58 185856 ----a-w- c:\program files (x86)\Get Styles\enlbrdr.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"OscarEditor"="c:\program files (x86)\OSCAR Editor\OscarEditor.exe" [2009-11-24 2642432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-07 336384]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Philips GoGear VIBE Device Manager.lnk - c:\philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe [2011-4-7 1701224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-05-03 21712]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 136176]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Realtek8185;Realtek8185;c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-08-11 185640]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 20:20]
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-20 20:20]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
"mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-02-03 1898208]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2726728]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://nl.ask.com?o=102352&l=dis
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU-ASK&o=102349&locale=en_NL&apn_uid=D671F971-5E5D-467D-81AC-9B7FE48F22DB&apn_ptnrs=Q6&apn_sauid=E195915B-251D-410A-943C-BF36BAC66E58&apn_dtid=YYYYYYYYNL&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtWlan.exe
c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtWlan.exe
.
**************************************************************************
.
Celkový čas: 2011-08-22 20:38:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-22 18:38
ComboFix2.txt 2011-08-22 17:29
.
Před spuštěním: Volných bajtů: 79 576 989 696
Po spuštění: Volných bajtů: 79 474 286 592
.
- - End Of File - - C02606E383128433014311A266CAB857

[Danstahr]

Přesuňte prosím ComboFix i CFScript.txt přímo na disk C a opakujte spuštění ComboFixu se skriptem.

[F.e.a.R.88]

Hodil jsem to na C a ten texták jsem přetáhnul do compofixu.. doufám že jsem pochopil dobře
a ješte když se to spustí tak se to zeptá na aktualizaci, tak dám ne.


ComboFix 11-08-22.02 - Šůlin 23.08.2011 17:31:27.3.3 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4094.2858 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Šůlin\AppData\Local\BITEA60.tmp"
"c:\users\Šůlin\AppData\Local\BITFF25.tmp"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\av_ico\ico_defender_start.ico
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.7.1
c:\windows\update.tray-15-0-lnk
c:\windows\update.tray-15-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-23 do 2011-08-23 )))))))))))))))))))))))))))))))
.
.
2011-08-23 15:37 . 2011-08-23 15:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-22 09:43 . 2011-08-22 09:50 -------- d-----w- c:\program files\trend micro
2011-08-22 09:43 . 2011-08-22 09:44 -------- d-----w- C:\rsit
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\programdata\Alwil Software
2011-08-22 09:27 . 2011-08-22 09:27 -------- d-----w- c:\program files\AVAST Software
2011-08-21 17:47 . 2011-08-21 17:47 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Malwarebytes
2011-08-21 17:47 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-21 17:46 . 2011-08-21 17:46 -------- d-----w- c:\programdata\Malwarebytes
2011-08-21 17:46 . 2011-08-21 17:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-21 17:46 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 16:18 . 2011-08-21 16:18 -------- d-----w- c:\program files (x86)\ESET
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\users\Šůlin\AppData\Local\AMD
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\ATI
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-17 13:54 . 2011-08-17 13:54 -------- d-----w- c:\programdata\AMD
2011-08-17 13:54 . 2010-02-18 07:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
2011-08-13 14:32 . 2011-08-13 14:32 2048 ----a-w- c:\windows\SysWow64\winver.exe
2011-08-13 14:32 . 2011-08-13 14:32 833024 ----a-w- c:\windows\SysWow64\user32.dll
2011-08-13 14:32 . 2011-08-13 14:32 410624 ----a-w- c:\windows\SysWow64\systemcpl.dll
2011-08-13 14:32 . 2011-08-13 14:32 1536 ----a-w- c:\windows\SysWow64\sppcomapi.dll
2011-08-13 14:32 . 2011-08-13 14:32 113543 ----a-w- c:\windows\SysWow64\slmgr.vbs
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:58 106496 ----a-w- c:\windows\system32\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:58 126976 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-06-15 09:58 212992 ----a-w- c:\windows\system32\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:58 163840 ----a-w- c:\windows\system32\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
2011-08-10 08:57 . 2011-06-15 09:04 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
2011-08-10 08:57 . 2011-06-15 09:04 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
2011-08-10 08:57 . 2011-06-15 09:04 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
2011-08-10 08:57 . 2011-06-15 09:04 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
2011-08-10 08:57 . 2011-06-15 09:04 94208 ----a-w- c:\program files (x86)\Common Files\System\Ole DB\msdaosp.dll
2011-08-10 08:57 . 2011-07-09 02:44 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 08:54 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 08:54 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-10 08:54 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-07-30 16:41 . 2011-07-30 18:41 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Skype
2011-07-30 16:41 . 2011-07-30 16:41 -------- d-----r- c:\program files (x86)\Skype
2011-07-30 16:40 . 2011-07-30 16:41 -------- d-----w- c:\programdata\Skype
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Roaming\Origin
2011-07-29 08:14 . 2011-07-29 08:14 -------- d-----w- c:\users\Šůlin\AppData\Local\Origin
2011-07-29 08:03 . 2011-07-29 08:14 -------- d-----w- c:\programdata\Origin
2011-07-29 08:03 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin Games
2011-07-29 08:02 . 2011-07-29 08:03 -------- d-----w- c:\program files (x86)\Origin
2011-07-28 17:36 . 2011-07-29 08:03 -------- d-----w- c:\programdata\Electronic Arts
2011-07-27 18:37 . 2011-07-27 18:37 303616 ----a-w- c:\windows\system32\drivers\atksgt.sys
2011-07-27 18:37 . 2011-07-27 18:37 35328 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2011-07-27 18:35 . 2011-07-27 18:35 -------- d-----w- c:\program files (x86)\Focus
2011-07-27 18:34 . 2011-07-27 18:34 323716 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-07-27 18:34 . 2011-07-27 18:34 192644 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-27 18:34 . 2004-10-22 00:18 749568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-27 18:34 . 2004-10-22 00:17 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-27 18:34 . 2004-10-22 00:17 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-27 18:34 . 2004-10-22 00:16 180224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-27 18:34 . 2004-10-22 00:16 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-26 21:05 . 2011-07-26 21:05 -------- d-----w- c:\program files (x86)\Get Styles
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:09 . 2011-08-21 16:09 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITFF25.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 16:05 . 2011-08-21 16:05 0 ---ha-w- c:\users\Šůlin\AppData\Local\BITEA60.tmp
2011-08-21 10:16 . 2010-10-17 10:10 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-08-21 10:16 . 2010-10-17 10:08 189480 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-16 04:32 . 2011-08-10 08:56 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-08 04:15 . 2011-07-08 04:15 9884672 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-07-08 03:54 . 2011-07-08 03:54 23385600 ----a-w- c:\windows\system32\atio6axx.dll
2011-07-08 03:33 . 2011-07-08 03:33 17940992 ----a-w- c:\windows\SysWow64\atioglxx.dll
2011-07-08 03:29 . 2011-07-08 03:29 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-07-08 03:29 . 2010-08-26 02:01 689152 ----a-w- c:\windows\SysWow64\aticfx32.dll
2011-07-08 03:28 . 2010-08-26 02:00 814592 ----a-w- c:\windows\system32\aticfx64.dll
2011-07-08 03:25 . 2011-07-08 03:25 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-07-08 03:25 . 2011-07-08 03:25 485376 ----a-w- c:\windows\system32\atieclxx.exe
2011-07-08 03:25 . 2011-07-08 03:25 204288 ----a-w- c:\windows\system32\atiesrxx.exe
2011-07-08 03:23 . 2011-07-08 03:23 120320 ----a-w- c:\windows\system32\atitmm64.dll
2011-07-08 03:23 . 2011-07-08 03:23 423424 ----a-w- c:\windows\system32\atipdl64.dll
2011-07-08 03:23 . 2011-07-08 03:23 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2011-07-08 03:23 . 2011-07-08 03:23 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2011-07-08 03:23 . 2011-07-08 03:23 16384 ----a-w- c:\windows\system32\atimuixx.dll
2011-07-08 03:23 . 2011-07-08 03:23 59392 ----a-w- c:\windows\system32\atiedu64.dll
2011-07-08 03:22 . 2011-07-08 03:22 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2011-07-08 03:19 . 2011-07-08 03:19 4275712 ----a-w- c:\windows\SysWow64\atidxx32.dll
2011-07-08 03:10 . 2009-07-13 21:59 5072896 ----a-w- c:\windows\system32\atidxx64.dll
2011-07-08 03:06 . 2011-07-08 03:06 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
2011-07-08 03:05 . 2011-07-08 03:05 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-07-08 03:05 . 2011-07-08 03:05 3848704 ----a-w- c:\windows\system32\atiumd6a.dll
2011-07-08 03:02 . 2011-07-08 03:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2011-07-08 03:02 . 2011-07-08 03:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2011-07-08 03:01 . 2011-07-08 03:01 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2011-07-08 03:01 . 2011-07-08 03:01 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2011-07-08 03:01 . 2011-07-08 03:01 8134656 ----a-w- c:\windows\system32\aticaldd64.dll
2011-07-08 03:00 . 2010-08-26 01:33 4367360 ----a-w- c:\windows\SysWow64\atiumdag.dll
2011-07-08 02:58 . 2011-07-08 02:58 6740480 ----a-w- c:\windows\SysWow64\aticaldd.dll
2011-07-08 02:55 . 2010-08-26 01:25 4039680 ----a-w- c:\windows\SysWow64\atiumdva.dll
2011-07-08 02:54 . 2010-08-26 01:27 58880 ----a-w- c:\windows\system32\coinst.dll
2011-07-08 02:54 . 2011-07-08 02:54 5540864 ----a-w- c:\windows\system32\atiumd64.dll
2011-07-08 02:47 . 2011-07-08 02:47 375808 ----a-w- c:\windows\system32\atiadlxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 266240 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2011-07-08 02:47 . 2011-07-08 02:47 15360 ----a-w- c:\windows\system32\atig6pxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 13312 ----a-w- c:\windows\system32\atiglpxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 39936 ----a-w- c:\windows\system32\atig6txx.dll
2011-07-08 02:47 . 2011-07-08 02:47 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2011-07-08 02:47 . 2011-07-08 02:47 307712 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-07-08 02:46 . 2010-08-26 01:20 40960 ----a-w- c:\windows\system32\atiuxp64.dll
2011-07-08 02:46 . 2011-07-08 02:46 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2011-07-08 02:46 . 2011-07-08 02:46 38912 ----a-w- c:\windows\system32\atiu9p64.dll
2011-07-08 02:45 . 2010-08-26 01:19 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2011-07-08 02:45 . 2011-07-08 02:45 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\atimpc64.dll
2011-07-08 02:41 . 2011-07-08 02:41 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
2011-07-08 02:40 . 2011-07-08 02:40 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2011-07-07 21:37 . 2011-07-07 21:37 60416 ----a-w- c:\windows\system32\OVDecode64.dll
2011-07-07 21:37 . 2011-07-07 21:37 51200 ----a-w- c:\windows\system32\OpenCL.dll
2011-07-07 21:36 . 2011-07-07 21:36 16907776 ----a-w- c:\windows\system32\amdocl64.dll
2011-07-04 11:43 . 2010-10-17 10:35 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-10-17 10:35 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-04 11:43 . 2011-01-18 10:44 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-01-01 03:45 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-10-17 10:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-10-17 10:36 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-10-17 10:36 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-10-17 10:36 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-10-17 10:36 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-27 14:23 . 2011-06-27 14:23 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-06-27 14:23 . 2011-06-27 14:23 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-06-27 14:22 . 2011-06-27 14:22 13904896 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-06-19 16:48 . 2010-10-17 10:08 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-19 13:36 . 2010-10-17 10:08 3360624 ----a-w- c:\windows\SysWow64\pbsvc.exe
2011-06-16 15:36 . 2011-06-09 08:48 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-16 01:34 . 2011-06-16 01:34 2971648 ----a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-06-16 01:34 . 2011-06-16 01:34 105984 ----a-w- c:\windows\system32\SlotMaximizerAg.dll
2011-06-11 02:56 . 2011-07-13 17:08 3134464 ----a-w- c:\windows\system32\win32k.sys
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 81744 ----a-w- c:\windows\SysWow64\mfcm100.dll
2011-06-10 23:58 . 2011-06-10 23:58 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100fra.dll
2011-06-10 23:58 . 2011-06-10 23:58 64336 ----a-w- c:\windows\SysWow64\mfc100deu.dll
2011-06-10 23:58 . 2011-06-10 23:58 63824 ----a-w- c:\windows\SysWow64\mfc100esn.dll
2011-06-10 23:58 . 2011-06-10 23:58 62288 ----a-w- c:\windows\SysWow64\mfc100ita.dll
2011-06-10 23:58 . 2011-06-10 23:58 60752 ----a-w- c:\windows\SysWow64\mfc100rus.dll
2011-06-10 23:58 . 2011-06-10 23:58 55120 ----a-w- c:\windows\SysWow64\mfc100enu.dll
2011-06-10 23:58 . 2011-06-10 23:58 51024 ----a-w- c:\windows\SysWow64\vcomp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 4422992 ----a-w- c:\windows\SysWow64\mfc100u.dll
2011-06-10 23:58 . 2011-06-10 23:58 4397384 ----a-w- c:\windows\SysWow64\mfc100.dll
2011-06-10 23:58 . 2011-06-10 23:58 43856 ----a-w- c:\windows\SysWow64\mfc100jpn.dll
2011-06-10 23:58 . 2011-06-10 23:58 43344 ----a-w- c:\windows\SysWow64\mfc100kor.dll
2011-06-10 23:58 . 2011-06-10 23:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100cht.dll
2011-06-10 23:58 . 2011-06-10 23:58 36176 ----a-w- c:\windows\SysWow64\mfc100chs.dll
2011-06-10 23:58 . 2011-06-10 23:58 138056 ----a-w- c:\windows\SysWow64\atl100.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100u.dll
2011-06-10 23:15 . 2011-06-10 23:15 93008 ----a-w- c:\windows\system32\mfcm100.dll
2011-06-10 23:15 . 2011-06-10 23:15 829264 ----a-w- c:\windows\system32\msvcr100.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100fra.dll
2011-06-10 23:15 . 2011-06-10 23:15 64336 ----a-w- c:\windows\system32\mfc100deu.dll
2011-06-10 23:15 . 2011-06-10 23:15 63824 ----a-w- c:\windows\system32\mfc100esn.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2009-07-14 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7600.16385] .. c:\windows\system32\user32.dll
.
[-] 2011-08-13 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7600.16385] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-08-22_17.24.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-16 08:25 . 2011-08-22 18:35 56354 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-08-22 17:14 41222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-23 15:21 41222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-16 08:25 . 2011-08-23 15:21 18234 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-361616173-1329515160-324987531-1001_UserData.bin
+ 2010-10-16 08:17 . 2011-08-23 15:39 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:17 . 2011-08-22 17:24 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:17 . 2011-08-22 17:24 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-16 08:17 . 2011-08-23 15:39 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-23 15:39 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-22 17:24 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-16 08:25 . 2011-08-23 15:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-23 15:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-23 15:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-16 08:25 . 2011-08-23 15:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-16 08:25 . 2011-08-23 15:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-16 08:25 . 2011-08-22 17:24 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-08-22 17:24 . 2011-08-22 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-23 15:39 . 2011-08-23 15:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-22 17:24 . 2011-08-22 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-23 15:39 . 2011-08-23 15:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-10-16 10:18 . 2011-08-23 12:23 344622 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:12 . 2011-08-22 17:24 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-08-23 15:39 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2011-08-22 17:22 364232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-23 15:37 364232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2010-10-16 14:09 . 2011-08-22 17:22 1346288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2010-10-16 14:09 . 2011-08-23 15:37 1346288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"OscarEditor"="c:\program files (x86)\OSCAR Editor\OscarEditor.exe" [2009-11-24 2642432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Philips GoGear VIBE Device Manager.lnk - c:\philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe [2011-4-7 1701224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-05-03 21712]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Realtek8185;Realtek8185;c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-08-11 185640]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF11384.cfxxe" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
"mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-02-03 1898208]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2726728]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtWlan.exe
c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtWlan.exe
.
**************************************************************************
.
Celkový čas: 2011-08-23 17:44:06 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-23 15:44
ComboFix2.txt 2011-08-22 18:38
ComboFix3.txt 2011-08-22 17:29
.
Před spuštěním: Volných bajtů: 78 704 840 704
Po spuštění: Volných bajtů: 78 401 515 520
.
- - End Of File - - 91FA375F9BE6E3EA586141B80FDFBA37

[Danstahr]

Jojo, teď je to OK. Některým programům nedělá dobře diakritika v názvech souborů / složek (a to všeobecně, až budete příště instalovat systém, doporučuji si dát název profilu bez diakritiky).

Jak to vypadá s PC?

[F.e.a.R.88]

díky za radu a pomoc vše jde ok jen mi nejde přehrávat videa ve windows media player... ale to je šumák, videa přehrávám jinde

[Danstahr]

Doinstalujte antivir (doporučuji Avast, Aviru nebo MSE) a dejte nový log z RSIT.

[F.e.a.R.88]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Šůlin at 2011-08-24 15:12:30
Microsoft Windows 7 Ultimate
System drive C: has 76 GB (25%) free of 303 GB
Total RAM: 4094 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:13:08, on 24.8.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe
C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Šůlin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files\trend micro\Šůlin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [OscarEditor] "C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe" Minimum
O4 - Global Startup: Philips GoGear VIBE Device Manager.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Realtek8185 - Realtek - C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe
O23 - Service: Realtek87B - Realtek - C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6713 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
taskeng.exe {BD6E6E40-E75B-40C5-AB34-9911749D0A10}
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe"
"C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\My Lockbox\mylbx.exe" /a
"C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtWlan.exe" /H
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE" /logon
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtWlan.exe" /H
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe" Minimum
"C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe" -silent
"C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe" -service
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\system32\SearchIndexer.exe /Embedding
WLIDSvcM.exe 2288
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Nero\Update\NASvc.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /welcome
"C:\Program Files\Windows Sidebar\sidebar.exe"
"C:\Users\Šůlin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe" /crashhandler
taskhost.exe $(Arg0)
"C:\Users\Šůlin\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-361616173-1329515160-324987531-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-361616173-1329515160-324987531-1001UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "iobit@mybrowserbar.com:4.3, wtxpcom@mybrowserbar.com:4.3, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.14"
prefs.js - "keyword.URL" - "http://websearch.ask.com/redirect?clien ... YYYYYNL&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browser.xpt
browsercomps.dll
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files (x86)\Mozilla Firefox\plugins\
npdeployJava1.dll
npnul32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\extensions\
toolbar@ask.com
{6236BA26-C117-4007-928C-DE0716C7FA80}
{6236BA26-C117-4007-928C-DE0716C7FA96}
{6236BA26-C117-4007-928C-DE0716C7FA99}

C:\Users\Šůlin\AppData\Roaming\Mozilla\Firefox\Profiles\ajh1hxut.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-07-04 978496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-30 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-07-04 978496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-07-28 11101800]
"mylbx"=C:\Program Files\My Lockbox\mylbx.exe [2011-02-03 1898208]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2010-03-25 2726728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"OscarEditor"=C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2009-11-24 2642432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-11-13 500208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [2010-08-09 248832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Šůlin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-16 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2009-11-24 2642432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files (x86)\Winamp\winampa.exe [2010-07-12 74752]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-07-04 3493720]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Philips GoGear VIBE Device Manager.lnk - C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 290304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-08-24 14:23:46 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-08-24 14:23:45 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-08-24 14:23:32 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-08-24 14:23:30 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-08-24 14:23:28 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-08-24 14:23:26 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-08-24 14:23:04 ----A---- C:\Windows\avastSS.scr
2011-08-24 14:23:03 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2011-08-24 14:22:58 ----D---- C:\ProgramData\AVAST Software
2011-08-24 10:58:53 ----SHD---- C:\$RECYCLE.BIN
2011-08-23 17:44:06 ----A---- C:\ComboFix.txt
2011-08-23 17:29:30 ----R---- C:\ComboFix.exe
2011-08-22 19:13:45 ----A---- C:\Windows\zip.exe
2011-08-22 19:13:45 ----A---- C:\Windows\SWSC.exe
2011-08-22 19:13:45 ----A---- C:\Windows\SWREG.exe
2011-08-22 19:13:45 ----A---- C:\Windows\sed.exe
2011-08-22 19:13:45 ----A---- C:\Windows\PEV.exe
2011-08-22 19:13:45 ----A---- C:\Windows\NIRCMD.exe
2011-08-22 19:13:45 ----A---- C:\Windows\MBR.exe
2011-08-22 19:13:45 ----A---- C:\Windows\grep.exe
2011-08-22 19:13:21 ----D---- C:\Windows\ERDNT
2011-08-22 13:12:48 ----D---- C:\Qoobox
2011-08-22 11:43:24 ----D---- C:\rsit
2011-08-22 11:43:24 ----D---- C:\Program Files\trend micro
2011-08-22 11:27:16 ----D---- C:\ProgramData\Alwil Software
2011-08-22 11:27:16 ----D---- C:\Program Files\AVAST Software
2011-08-21 19:47:14 ----D---- C:\Users\Šůlin\AppData\Roaming\Malwarebytes
2011-08-21 19:47:00 ----A---- C:\Windows\SYSWOW64\drivers\mbamswissarmy.sys
2011-08-21 19:46:59 ----D---- C:\ProgramData\Malwarebytes
2011-08-21 19:46:57 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-21 19:46:57 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-08-21 18:18:58 ----D---- C:\Program Files (x86)\ESET
2011-08-17 15:54:23 ----D---- C:\ProgramData\ATI
2011-08-17 15:54:21 ----D---- C:\Program Files (x86)\AMD APP
2011-08-17 15:54:01 ----D---- C:\ProgramData\AMD
2011-08-17 15:54:01 ----A---- C:\Windows\system32\drivers\amdiox64.sys
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\winver.exe
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\user32.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\systemcpl.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\sppcomapi.dll
2011-08-13 16:32:13 ----A---- C:\Windows\SYSWOW64\slmgr.vbs
2011-08-13 16:26:37 ----A---- C:\bootsect.lxe.bak
2011-08-10 10:57:34 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 10:57:34 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 10:57:33 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 10:57:33 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 10:57:16 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 10:56:59 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 10:56:59 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 10:56:58 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 10:56:58 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 10:56:58 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 10:56:58 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 10:56:56 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 10:56:56 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 10:56:55 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 10:56:55 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 10:56:00 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 10:55:47 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 10:55:45 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 10:55:44 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 10:55:43 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 10:55:43 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 10:55:42 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 10:55:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 10:55:41 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 10:55:41 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 10:55:40 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 10:55:40 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-10 10:55:40 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-10 10:55:40 ----A---- C:\Windows\system32\iedkcs32.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\mstime.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-08-10 10:55:39 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\url.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\mstime.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\msfeedssync.exe
2011-08-10 10:55:39 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\licmgr10.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 10:55:39 ----A---- C:\Windows\system32\iepeers.dll
2011-08-10 10:54:44 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 10:54:43 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 10:54:43 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-02 19:00:47 ----D---- C:\Windows\Minidump
2011-07-30 18:41:25 ----D---- C:\Users\Šůlin\AppData\Roaming\Skype
2011-07-30 18:41:10 ----RD---- C:\Program Files (x86)\Skype
2011-07-30 18:40:32 ----D---- C:\ProgramData\Skype
2011-07-29 10:14:19 ----D---- C:\Users\Šůlin\AppData\Roaming\Origin
2011-07-29 10:03:12 ----D---- C:\ProgramData\Origin
2011-07-29 10:03:11 ----D---- C:\Program Files (x86)\Origin Games
2011-07-29 10:02:37 ----D---- C:\Program Files (x86)\Origin
2011-07-28 19:36:14 ----D---- C:\ProgramData\Electronic Arts
2011-07-27 20:37:49 ----A---- C:\Windows\system32\drivers\atksgt.sys
2011-07-27 20:37:46 ----A---- C:\Windows\system32\drivers\lirsgt.sys
2011-07-27 20:35:12 ----D---- C:\Program Files (x86)\Focus
2011-07-26 23:05:50 ----D---- C:\Program Files (x86)\Get Styles

======List of files/folders modified in the last 1 month======

2011-08-24 15:13:08 ----D---- C:\Windows\Temp
2011-08-24 14:23:46 ----D---- C:\Windows\system32\drivers
2011-08-24 14:23:22 ----SHD---- C:\Windows\Installer
2011-08-24 14:23:21 ----D---- C:\Config.Msi
2011-08-24 14:23:04 ----D---- C:\Windows
2011-08-24 14:23:03 ----D---- C:\Windows\SysWOW64
2011-08-24 14:22:58 ----D---- C:\ProgramData
2011-08-24 14:22:52 ----SHD---- C:\System Volume Information
2011-08-23 19:51:37 ----D---- C:\Windows\Prefetch
2011-08-23 19:51:27 ----D---- C:\Users\Šůlin\AppData\Roaming\Media Player Classic
2011-08-23 17:39:32 ----A---- C:\Windows\system.ini
2011-08-23 17:39:25 ----D---- C:\Windows\system32\drivers\etc
2011-08-23 17:37:39 ----D---- C:\Windows\system32\config
2011-08-23 17:36:59 ----D---- C:\Windows\Tasks
2011-08-23 17:34:51 ----D---- C:\Windows\SYSWOW64\drivers
2011-08-23 17:34:51 ----D---- C:\Windows\System32
2011-08-23 17:34:51 ----D---- C:\Windows\AppPatch
2011-08-23 17:34:49 ----D---- C:\Program Files\Common Files
2011-08-23 17:34:49 ----D---- C:\Program Files (x86)\Common Files
2011-08-22 20:17:04 ----D---- C:\Users\Šůlin\AppData\Roaming\Winamp
2011-08-22 11:43:24 ----RD---- C:\Program Files
2011-08-21 19:46:57 ----RD---- C:\Program Files (x86)
2011-08-21 18:30:40 ----D---- C:\Program Files (x86)\Application Updater
2011-08-21 12:16:24 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2011-08-19 17:53:06 ----D---- C:\Windows\system32\catroot2
2011-08-19 00:02:22 ----D---- C:\Windows\system32\NDF
2011-08-17 15:54:07 ----D---- C:\Program Files\ATI Technologies
2011-08-17 15:54:04 ----D---- C:\Windows\inf
2011-08-17 15:54:03 ----D---- C:\Windows\system32\DriverStore
2011-08-17 15:54:03 ----D---- C:\Windows\system32\catroot
2011-08-17 15:53:58 ----D---- C:\Program Files (x86)\ATI Technologies
2011-08-13 16:32:05 ----D---- C:\Users\Šůlin\AppData\Roaming\uTorrent
2011-08-12 22:44:27 ----D---- C:\Program Files (x86)\Opera
2011-08-12 15:47:51 ----D---- C:\Windows\debug
2011-08-11 09:07:19 ----D---- C:\Windows\Microsoft.NET
2011-08-11 09:07:18 ----RSD---- C:\Windows\assembly
2011-08-10 19:38:37 ----D---- C:\Windows\winsxs
2011-08-10 19:36:36 ----D---- C:\Windows\SYSWOW64\migration
2011-08-10 19:36:36 ----D---- C:\Program Files\Internet Explorer
2011-08-10 19:36:36 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 19:36:35 ----D---- C:\Windows\system32\migration
2011-08-10 17:40:29 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 17:37:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-08 10:42:25 ----D---- C:\Windows\system32\Tasks
2011-08-07 16:38:38 ----D---- C:\Program Files (x86)\Electronic Arts
2011-08-07 16:38:36 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-07-30 11:04:59 ----D---- C:\Program Files\TeamSpeak 3 Client

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 FSProFilter;FSPro File Filter; C:\Windows\System32\Drivers\FSPFltd.sys [2010-07-22 54848]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-20 834544]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-07-04 31064]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-07-04 288088]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-07-04 45400]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-07-04 22360]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-07-04 64856]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-08 9884672]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-07-08 307712]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-07-28 2445672]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-07-06 25912]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-05-24 253728]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver; C:\Windows\system32\DRIVERS\RTL85n64.sys [2009-10-16 1471488]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-07-04 600920]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-07-27 303616]
S2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2011-07-27 35328]
S3 alx2irq5;alx2irq5; C:\Windows\system32\drivers\alx2irq5.sys []
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-07-15 116240]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-08 9884672]
S3 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool64.sys [2006-11-10 30720]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 DrvAgent64;DrvAgent64; \??\C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-05-03 21712]
S3 ENTECH64;ENTECH64; \??\C:\Windows\system32\DRIVERS\ENTECH64.sys [2008-04-22 12744]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-07-08 204288]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-07-04 42184]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
R2 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-06-19 75064]
R2 Realtek8185;Realtek8185; C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
R2 Realtek87B;Realtek87B; C:\Program Files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
R2 TeamViewer4;TeamViewer 4; C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-08-11 185640]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-08-03 411432]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-17 1255736]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

[Danstahr]

Tak ještě úklid a máme hotovo.

Odinstalujte MBAM.

Stiskněte současně klávesy Win (mezi CTRL a ALT, logo Windows) + R, do okna napište combofix /uninstall a stiskněte ENTER.

Stáhněte T-Cleaner. Potvrzování se provádí stisknutím A.

Stáhněte OTC, Spusťte jej a stiskněte CleanUp! Bude následovat restart.

Stáhněte TFC, spusťte jej a dejte Start.

Stáhněte CCleaner, nainstalujte a spusťte.

• Na záložce Čistič stiskněte tlačítko Spustit Cleaner
• Po provedení přepněte na záložku Registry, stiskněte Hledej problémy a poté Opravit vybrané problémy. Opakujte, dokud nebude po hledání problémů seznam prázdný.