prosím o kontrolu - trojan Win32/Patched.NBG

[Rossi46]

Zdravím, ESET Smart Security mi hlasí trojana Win32/Patched.NBG - nelze lecit.
Je nakažen soubor C:\Windows\SysWoW64\user32.dll

log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Pepos7 at 2012-02-09 20:55:37
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 101 GB (21%) free of 477 GB
Total RAM: 4095 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:56:01, on 9.2.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\trend micro\Pepos7.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Hry\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-4117625595-3377170590-1022986480-1005\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-4117625595-3377170590-1022986480-1005\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Unknown owner - C:\Windows\system32\AEADISRV.EXE (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Folding@home-CPU-[1] - Unknown owner - C:\Folding@HomeCPU\1\Fah.exe
O23 - Service: Folding@home-CPU-[2] - Unknown owner - C:\Folding@HomeCPU\2\Fah.exe
O23 - Service: Folding@home-CPU-[3] - Unknown owner - C:\Folding@HomeCPU\3\Fah.exe
O23 - Service: Folding@home-CPU-[4] - Unknown owner - C:\Folding@HomeCPU\4\Fah.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFReaderDriverCreatorReadSpool2 (NitroReaderDriverReadSpool2) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8781 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\AEADISRV.EXE
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
C:\Windows\Explorer.EXE
C:\Folding@HomeCPU\4\Fah.exe -svcstart -d "C:\Folding@HomeCPU\4"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe"
C:\Windows\SysWoW64\svchost.exe
"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe"
"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe"
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
taskeng.exe {A636AB70-2BBB-4FB1-B0F0-46FB754D16B8}
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\msiexec.exe /V
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://bronxmine.com/search/?dell+lapto ... +very+slow
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:7008 CREDAT:79873
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://taxadvising.com/search/?best+sha ... +hair+loss
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4196 CREDAT:79873
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://cakebag.com/search/?toyota+scion+used
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:5372 CREDAT:14339
"C:\Users\Pepos7\Desktop\!viry\RSITx64.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://rosaritobeach.info/search/?mustang+x+pipe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2112 CREDAT:79873
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://24hoursphonetrade.com/search/?audio+books+rental
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:436 CREDAT:79873

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-02-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-06-04 186904]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-01-12 2918656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"Steam"=C:\Hry\Steam\steam.exe [2011-08-02 1242448]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [2009-09-17 1310720]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
""= []
"ApnUpdater"=C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2012-01-03 1391272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-02-09 20:55:47 ----A---- C:\ProgramData\frbkbaa.tmp
2012-02-09 20:55:39 ----D---- C:\Program Files\trend micro
2012-02-09 20:55:37 ----D---- C:\rsit
2012-02-09 20:48:12 ----D---- C:\Windows\system32\IO
2012-02-09 20:47:11 ----A---- C:\ProgramData\crbkbaa.tmp
2012-02-09 20:46:31 ----A---- C:\ProgramData\grbkbaa.tmp
2012-02-09 20:46:21 ----A---- C:\ProgramData\erbkbaa.tmp
2012-02-09 20:46:16 ----A---- C:\ProgramData\drbkbaa.tmp
2012-02-09 08:03:54 ----A---- C:\ProgramData\ymklbaa.tmp
2012-02-09 08:03:14 ----A---- C:\ProgramData\cnklbaa.tmp
2012-02-09 08:03:09 ----A---- C:\ProgramData\bnklbaa.tmp
2012-02-09 08:03:04 ----A---- C:\ProgramData\anklbaa.tmp
2012-02-09 08:02:59 ----A---- C:\ProgramData\zmklbaa.tmp
2012-02-08 17:58:10 ----A---- C:\ProgramData\cbplbaa.tmp
2012-02-08 17:57:30 ----A---- C:\ProgramData\gbplbaa.tmp
2012-02-08 17:57:25 ----A---- C:\ProgramData\fbplbaa.tmp
2012-02-08 17:57:20 ----A---- C:\ProgramData\ebplbaa.tmp
2012-02-08 17:57:15 ----A---- C:\ProgramData\dbplbaa.tmp
2012-02-08 13:02:53 ----A---- C:\ProgramData\ixzkbaa.tmp
2012-02-08 10:14:28 ----A---- C:\ProgramData\kxzkbaa.tmp
2012-02-08 10:13:49 ----A---- C:\ProgramData\gxzkbaa.tmp
2012-02-08 10:00:05 ----A---- C:\ProgramData\jxzkbaa.tmp
2012-02-08 09:59:55 ----A---- C:\ProgramData\hxzkbaa.tmp
2012-02-08 07:56:10 ----A---- C:\ProgramData\gptlbaa.tmp
2012-02-08 07:55:30 ----A---- C:\ProgramData\kptlbaa.tmp
2012-02-08 07:55:25 ----A---- C:\ProgramData\jptlbaa.tmp
2012-02-08 07:55:20 ----A---- C:\ProgramData\iptlbaa.tmp
2012-02-08 07:55:16 ----A---- C:\ProgramData\hptlbaa.tmp
2012-02-07 15:49:05 ----A---- C:\ProgramData\moqlbaa.tmp
2012-02-07 15:48:25 ----A---- C:\ProgramData\qoqlbaa.tmp
2012-02-07 15:48:20 ----A---- C:\ProgramData\poqlbaa.tmp
2012-02-07 15:48:15 ----A---- C:\ProgramData\ooqlbaa.tmp
2012-02-07 15:48:10 ----A---- C:\ProgramData\noqlbaa.tmp
2012-02-07 11:45:21 ----D---- C:\ProgramData\InstallShield
2012-02-07 11:42:33 ----D---- C:\Users\Pepos7\AppData\Roaming\Petroglyph
2012-02-04 19:05:27 ----A---- C:\ProgramData\clcnbaa.tmp
2012-02-04 19:04:47 ----A---- C:\ProgramData\glcnbaa.tmp
2012-02-04 19:04:42 ----A---- C:\ProgramData\flcnbaa.tmp
2012-02-04 19:04:37 ----A---- C:\ProgramData\elcnbaa.tmp
2012-02-04 19:04:32 ----A---- C:\ProgramData\dlcnbaa.tmp
2012-02-04 07:23:18 ----A---- C:\ProgramData\mgkmbaa.tmp
2012-02-04 07:22:38 ----A---- C:\ProgramData\qgkmbaa.tmp
2012-02-04 07:22:33 ----A---- C:\ProgramData\pgkmbaa.tmp
2012-02-04 07:22:28 ----A---- C:\ProgramData\ogkmbaa.tmp
2012-02-04 07:22:23 ----A---- C:\ProgramData\ngkmbaa.tmp
2012-02-03 17:18:22 ----A---- C:\ProgramData\okyqbaa.tmp
2012-02-03 17:18:17 ----A---- C:\ProgramData\nkyqbaa.tmp
2012-02-03 17:18:00 ----A---- C:\ProgramData\mkyqbaa.tmp
2012-02-03 17:17:24 ----A---- C:\ProgramData\qkyqbaa.tmp
2012-02-03 17:17:24 ----A---- C:\ProgramData\pkyqbaa.tmp
2012-02-03 10:41:19 ----A---- C:\ProgramData\qkblbaa.tmp
2012-02-03 10:40:39 ----A---- C:\ProgramData\ukblbaa.tmp
2012-02-03 10:40:34 ----A---- C:\ProgramData\tkblbaa.tmp
2012-02-03 10:40:29 ----A---- C:\ProgramData\skblbaa.tmp
2012-02-03 10:40:24 ----A---- C:\ProgramData\rkblbaa.tmp
2012-02-03 03:48:25 ----A---- C:\ProgramData\qshkbaa.tmp
2012-02-03 03:47:45 ----A---- C:\ProgramData\ushkbaa.tmp
2012-02-03 03:47:40 ----A---- C:\ProgramData\tshkbaa.tmp
2012-02-03 03:47:35 ----A---- C:\ProgramData\sshkbaa.tmp
2012-02-03 03:47:30 ----A---- C:\ProgramData\rshkbaa.tmp
2012-02-02 16:50:14 ----A---- C:\ProgramData\ltkkbaa.tmp
2012-02-02 16:50:09 ----A---- C:\ProgramData\ktkkbaa.tmp
2012-02-02 16:49:29 ----A---- C:\ProgramData\otkkbaa.tmp
2012-02-02 16:49:24 ----A---- C:\ProgramData\ntkkbaa.tmp
2012-02-02 16:49:19 ----A---- C:\ProgramData\mtkkbaa.tmp
2012-02-02 15:00:07 ----A---- C:\ProgramData\orcmbaa.tmp
2012-02-02 14:59:27 ----A---- C:\ProgramData\srcmbaa.tmp
2012-02-02 14:59:22 ----A---- C:\ProgramData\rrcmbaa.tmp
2012-02-02 14:59:17 ----A---- C:\ProgramData\qrcmbaa.tmp
2012-02-02 14:59:12 ----A---- C:\ProgramData\prcmbaa.tmp
2012-02-02 04:49:07 ----A---- C:\ProgramData\awvibaa.tmp
2012-02-02 04:48:27 ----A---- C:\ProgramData\ewvibaa.tmp
2012-02-02 04:48:22 ----A---- C:\ProgramData\dwvibaa.tmp
2012-02-02 04:48:17 ----A---- C:\ProgramData\cwvibaa.tmp
2012-02-02 04:48:12 ----A---- C:\ProgramData\bwvibaa.tmp
2012-02-01 21:33:37 ----A---- C:\ProgramData\yisqbaa.tmp
2012-02-01 21:32:57 ----A---- C:\ProgramData\cjsqbaa.tmp
2012-02-01 21:32:52 ----A---- C:\ProgramData\bjsqbaa.tmp
2012-02-01 21:32:47 ----A---- C:\ProgramData\ajsqbaa.tmp
2012-02-01 21:32:42 ----A---- C:\ProgramData\zisqbaa.tmp
2012-02-01 18:20:02 ----A---- C:\ProgramData\mcsrbaa.tmp
2012-02-01 18:19:22 ----A---- C:\ProgramData\qcsrbaa.tmp
2012-02-01 18:19:17 ----A---- C:\ProgramData\pcsrbaa.tmp
2012-02-01 18:19:12 ----A---- C:\ProgramData\ocsrbaa.tmp
2012-02-01 18:19:07 ----A---- C:\ProgramData\ncsrbaa.tmp
2012-02-01 14:34:42 ----A---- C:\ProgramData\oxbjbaa.tmp
2012-02-01 14:34:02 ----A---- C:\ProgramData\sxbjbaa.tmp
2012-02-01 14:33:57 ----A---- C:\ProgramData\rxbjbaa.tmp
2012-02-01 14:33:52 ----A---- C:\ProgramData\qxbjbaa.tmp
2012-02-01 14:33:47 ----A---- C:\ProgramData\pxbjbaa.tmp
2012-02-01 07:47:25 ----A---- C:\ProgramData\toppbaa.tmp
2012-02-01 07:47:20 ----A---- C:\ProgramData\soppbaa.tmp
2012-02-01 07:47:15 ----A---- C:\ProgramData\roppbaa.tmp
2012-01-31 15:50:56 ----A---- C:\ProgramData\ywbdbaa.tmp
2012-01-31 15:50:16 ----A---- C:\ProgramData\cxbdbaa.tmp
2012-01-31 15:50:11 ----A---- C:\ProgramData\bxbdbaa.tmp
2012-01-31 15:50:06 ----A---- C:\ProgramData\axbdbaa.tmp
2012-01-31 15:50:01 ----A---- C:\ProgramData\zwbdbaa.tmp
2012-01-31 14:39:46 ----A---- C:\ProgramData\spunbaa.tmp
2012-01-31 14:39:36 ----A---- C:\Windows\SYSWOW64\schannel.dll
2012-01-31 14:39:36 ----A---- C:\Windows\system32\schannel.dll
2012-01-31 14:39:36 ----A---- C:\Windows\system32\lsass.exe
2012-01-31 14:39:36 ----A---- C:\Windows\system32\lsasrv.dll
2012-01-31 14:39:36 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-01-31 14:39:36 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-01-31 14:39:36 ----A---- C:\Windows\system32\drivers\cng.sys
2012-01-31 14:39:35 ----A---- C:\Windows\SYSWOW64\webio.dll
2012-01-31 14:39:35 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2012-01-31 14:39:35 ----A---- C:\Windows\SYSWOW64\secur32.dll
2012-01-31 14:39:35 ----A---- C:\Windows\system32\webio.dll
2012-01-31 14:39:35 ----A---- C:\Windows\system32\sspisrv.dll
2012-01-31 14:39:35 ----A---- C:\Windows\system32\sspicli.dll
2012-01-31 14:39:35 ----A---- C:\Windows\system32\secur32.dll
2012-01-31 14:39:06 ----A---- C:\ProgramData\wpunbaa.tmp
2012-01-31 14:39:01 ----A---- C:\ProgramData\vpunbaa.tmp
2012-01-31 14:38:56 ----A---- C:\ProgramData\upunbaa.tmp
2012-01-31 14:38:52 ----A---- C:\ProgramData\tpunbaa.tmp
2012-01-31 11:02:27 ----A---- C:\ProgramData\wdznbaa.tmp
2012-01-31 11:01:47 ----A---- C:\ProgramData\aeznbaa.tmp
2012-01-31 11:01:42 ----A---- C:\ProgramData\zdznbaa.tmp
2012-01-31 11:01:37 ----A---- C:\ProgramData\ydznbaa.tmp
2012-01-31 11:01:32 ----A---- C:\ProgramData\xdznbaa.tmp
2012-01-31 04:47:42 ----A---- C:\ProgramData\aukqbaa.tmp
2012-01-31 04:47:02 ----A---- C:\ProgramData\eukqbaa.tmp
2012-01-31 04:46:57 ----A---- C:\ProgramData\dukqbaa.tmp
2012-01-31 04:46:52 ----A---- C:\ProgramData\cukqbaa.tmp
2012-01-31 04:46:47 ----A---- C:\ProgramData\bukqbaa.tmp
2012-01-30 21:23:01 ----A---- C:\ProgramData\yornbaa.tmp
2012-01-30 21:22:21 ----A---- C:\ProgramData\cprnbaa.tmp
2012-01-30 21:22:16 ----A---- C:\ProgramData\bprnbaa.tmp
2012-01-30 21:22:11 ----A---- C:\ProgramData\aprnbaa.tmp
2012-01-30 21:22:06 ----A---- C:\ProgramData\zornbaa.tmp
2012-01-30 16:06:36 ----A---- C:\ProgramData\knlnbaa.tmp
2012-01-30 16:05:56 ----A---- C:\ProgramData\onlnbaa.tmp
2012-01-30 16:05:51 ----A---- C:\ProgramData\nnlnbaa.tmp
2012-01-30 16:05:46 ----A---- C:\ProgramData\mnlnbaa.tmp
2012-01-30 16:05:41 ----A---- C:\ProgramData\lnlnbaa.tmp
2012-01-30 14:45:05 ----A---- C:\ProgramData\ayclbaa.tmp
2012-01-30 14:44:25 ----A---- C:\ProgramData\eyclbaa.tmp
2012-01-30 14:44:20 ----A---- C:\ProgramData\dyclbaa.tmp
2012-01-30 14:44:15 ----A---- C:\ProgramData\cyclbaa.tmp
2012-01-30 14:44:10 ----A---- C:\ProgramData\byclbaa.tmp
2012-01-30 09:20:30 ----A---- C:\ProgramData\obqnbaa.tmp
2012-01-30 09:19:50 ----A---- C:\ProgramData\sbqnbaa.tmp
2012-01-30 09:19:45 ----A---- C:\ProgramData\rbqnbaa.tmp
2012-01-30 09:19:40 ----A---- C:\ProgramData\qbqnbaa.tmp
2012-01-30 09:19:35 ----A---- C:\ProgramData\pbqnbaa.tmp
2012-01-30 04:42:07 ----A---- C:\ProgramData\mqxnbaa.tmp
2012-01-30 04:41:27 ----A---- C:\ProgramData\qqxnbaa.tmp
2012-01-30 04:41:22 ----A---- C:\ProgramData\pqxnbaa.tmp
2012-01-30 04:41:17 ----A---- C:\ProgramData\oqxnbaa.tmp
2012-01-30 04:41:12 ----A---- C:\ProgramData\nqxnbaa.tmp
2012-01-29 18:30:54 ----A---- C:\ProgramData\ugmkbaa.tmp
2012-01-29 18:30:14 ----A---- C:\ProgramData\ygmkbaa.tmp
2012-01-29 18:30:04 ----A---- C:\ProgramData\wgmkbaa.tmp
2012-01-29 18:29:59 ----A---- C:\ProgramData\vgmkbaa.tmp
2012-01-29 16:36:59 ----A---- C:\ProgramData\yeembaa.tmp
2012-01-29 16:36:19 ----A---- C:\ProgramData\cfembaa.tmp
2012-01-29 16:36:14 ----A---- C:\ProgramData\bfembaa.tmp
2012-01-29 16:36:09 ----A---- C:\ProgramData\afembaa.tmp
2012-01-29 16:36:05 ----A---- C:\ProgramData\zeembaa.tmp
2012-01-11 14:08:27 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2012-01-11 14:08:27 ----A---- C:\Windows\system32\ntdll.dll
2012-01-11 14:02:34 ----A---- C:\Windows\SYSWOW64\quartz.dll
2012-01-11 14:02:34 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2012-01-11 14:02:34 ----A---- C:\Windows\system32\quartz.dll
2012-01-11 14:02:34 ----A---- C:\Windows\system32\qdvd.dll
2012-01-11 13:41:20 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-01-11 13:41:20 ----A---- C:\Windows\system32\jscript.dll
2012-01-11 13:38:54 ----A---- C:\Windows\SYSWOW64\packager.dll
2012-01-11 13:38:54 ----A---- C:\Windows\system32\packager.dll

======List of files/folders modified in the last 1 month======

2012-02-09 20:55:51 ----D---- C:\Windows\Prefetch
2012-02-09 20:55:50 ----D---- C:\Windows\Temp
2012-02-09 20:55:47 ----HD---- C:\ProgramData
2012-02-09 20:55:39 ----RD---- C:\Program Files
2012-02-09 20:54:47 ----SHD---- C:\Windows\Installer
2012-02-09 20:53:37 ----D---- C:\Windows\system32\appmgmt
2012-02-09 20:48:12 ----D---- C:\Windows\System32
2012-02-09 20:02:07 ----D---- C:\ProgramData\NVIDIA
2012-02-09 08:05:16 ----D---- C:\Users\Pepos7\AppData\Roaming\ICQ
2012-02-09 07:59:52 ----D---- C:\Windows\system32\config
2012-02-09 00:10:25 ----SHD---- C:\System Volume Information
2012-02-09 00:07:17 ----SD---- C:\Users\Pepos7\AppData\Roaming\Microsoft
2012-02-09 00:07:17 ----SD---- C:\ProgramData\Microsoft
2012-02-08 23:48:47 ----D---- C:\Windows\system32\catroot
2012-02-08 23:48:45 ----D---- C:\Windows\winsxs
2012-02-07 22:58:20 ----D---- C:\Windows\system32\NDF
2012-02-07 11:47:36 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-02-07 11:32:07 ----D---- C:\Program Files (x86)\Common Files
2012-02-07 11:31:18 ----D---- C:\Hry
2012-02-07 00:21:06 ----D---- C:\Users\Pepos7\AppData\Roaming\uTorrent
2012-02-05 20:06:34 ----D---- C:\Images
2012-02-04 20:58:24 ----D---- C:\Torrent
2012-02-04 07:18:48 ----D---- C:\Windows\system32\catroot2
2012-01-31 15:45:25 ----D---- C:\Windows\SysWOW64
2012-01-31 15:45:24 ----D---- C:\Windows\system32\drivers
2012-01-29 14:52:12 ----D---- C:\Windows\SYSWOW64\wbem
2012-01-27 11:07:18 ----D---- C:\Program Files (x86)\Opera
2012-01-27 00:52:58 ----N---- C:\Windows\system32\MpSigStub.exe
2012-01-26 12:05:51 ----D---- C:\Windows\inf
2012-01-26 12:05:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-24 12:39:53 ----D---- C:\Filmy
2012-01-21 18:41:17 ----D---- C:\eKnihy
2012-01-12 11:51:14 ----D---- C:\Pepa
2012-01-12 00:38:04 ----D---- C:\ProgramData\Microsoft Help
2012-01-12 00:36:45 ----A---- C:\Windows\system32\MRT.exe
2012-01-12 00:05:16 ----D---- C:\Windows\system32\Tasks
2012-01-12 00:05:16 ----D---- C:\Program Files (x86)\Ask.com
2012-01-11 22:16:46 ----D---- C:\Windows\ehome

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iaStor.sys [2009-06-04 408600]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-02-25 254528]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-12-21 170640]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-12-21 50624]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2011-05-14 42696]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\ADIHdAud.sys [2009-09-17 478208]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-12-21 34144]
R3 MCfilt;MCfilt; C:\Windows\system32\drivers\MCfilt64.sys [2009-09-17 25600]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-05-14 15416]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-05-14 310984]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 nmwcdcx64;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbox64.sys [2010-02-26 25088]
S3 nmwcdnsucx64;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsucx64.sys [2010-02-26 12288]
S3 nmwcdnsux64;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsux64.sys [2010-02-26 173056]
S3 nmwcdx64;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-02-26 19456]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2010-02-26 9216]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-21 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltx64j.sys [2010-02-26 9216]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AEADIFilters;Andrea ADI Filters Service; C:\Windows\system32\AEADISRV.EXE [2009-09-17 111616]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
R2 Folding@home-CPU-[4];Folding@home-CPU-[4]; C:\Folding@HomeCPU\4\Fah.exe [2011-12-29 422400]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-06-04 354840]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-10-15 1640768]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-03-16 75136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Folding@home-CPU-[1];Folding@home-CPU-[1]; C:\Folding@HomeCPU\1\Fah.exe [2011-12-29 422400]
S2 Folding@home-CPU-[2];Folding@home-CPU-[2]; C:\Folding@HomeCPU\2\Fah.exe [2011-12-29 422400]
S2 Folding@home-CPU-[3];Folding@home-CPU-[3]; C:\Folding@HomeCPU\3\Fah.exe [2011-12-29 422400]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2011-01-12 42360]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-10-20 630272]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-02-24 1255736]

-----------------EOF-----------------

[Rossi46]

ComboFix 12-02-02.02 - Pepos7 09.02.2012 21:29:27.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2755 [GMT 1:00]
Spuštěný z: c:\users\Pepos7\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ESET\MiNODLogin
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.jar
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files (x86)\ESET\MiNODLogin\servidores.xml
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-09 do 2012-02-09 )))))))))))))))))))))))))))))))
.
.
2012-02-09 20:31 . 2012-02-09 20:31 -------- d-----w- c:\programdata\AutoKMS
2012-02-09 20:30 . 2012-02-09 20:30 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-09 20:30 . 2012-02-09 20:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-09 20:23 . 2012-02-09 20:23 858 ----a-w- c:\programdata\wxdhbaa.tmp
2012-02-09 20:23 . 2012-02-09 20:23 794 ----a-w- c:\programdata\aydhbaa.tmp
2012-02-09 20:22 . 2012-02-09 20:22 817 ----a-w- c:\programdata\zxdhbaa.tmp
2012-02-09 20:22 . 2012-02-09 20:22 822 ----a-w- c:\programdata\yxdhbaa.tmp
2012-02-09 20:22 . 2012-02-09 20:22 860 ----a-w- c:\programdata\xxdhbaa.tmp
2012-02-09 20:00 . 2012-02-09 20:13 843 ----a-w- c:\programdata\grbkbaa.tmp
2012-02-09 20:00 . 2012-02-09 20:12 837 ----a-w- c:\programdata\frbkbaa.tmp
2012-02-09 20:00 . 2012-02-09 20:11 825 ----a-w- c:\programdata\crbkbaa.tmp
2012-02-09 20:00 . 2012-02-09 20:10 865 ----a-w- c:\programdata\erbkbaa.tmp
2012-02-09 19:58 . 2012-02-09 19:58 -------- d-----w- c:\programdata\B7E85889000435DB000009C6B4EB2331
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- c:\program files\trend micro
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- C:\rsit
2012-02-09 19:48 . 2012-02-09 19:48 -------- d-----w- c:\windows\system32\IO
2012-02-09 19:46 . 2012-02-09 20:08 857 ----a-w- c:\programdata\drbkbaa.tmp
2012-02-09 07:03 . 2012-02-09 07:03 827 ----a-w- c:\programdata\ymklbaa.tmp
2012-02-09 07:03 . 2012-02-09 07:03 864 ----a-w- c:\programdata\cnklbaa.tmp
2012-02-09 07:03 . 2012-02-09 07:03 840 ----a-w- c:\programdata\bnklbaa.tmp
2012-02-09 07:03 . 2012-02-09 07:03 838 ----a-w- c:\programdata\anklbaa.tmp
2012-02-09 07:02 . 2012-02-09 07:02 845 ----a-w- c:\programdata\zmklbaa.tmp
2012-02-08 16:58 . 2012-02-08 16:58 837 ----a-w- c:\programdata\cbplbaa.tmp
2012-02-08 16:57 . 2012-02-08 16:57 849 ----a-w- c:\programdata\gbplbaa.tmp
2012-02-08 16:57 . 2012-02-08 16:57 834 ----a-w- c:\programdata\fbplbaa.tmp
2012-02-08 16:57 . 2012-02-08 16:57 842 ----a-w- c:\programdata\ebplbaa.tmp
2012-02-08 16:57 . 2012-02-08 16:57 857 ----a-w- c:\programdata\dbplbaa.tmp
2012-02-08 12:02 . 2012-02-08 12:02 804 ----a-w- c:\programdata\ixzkbaa.tmp
2012-02-08 09:14 . 2012-02-08 12:00 861 ----a-w- c:\programdata\kxzkbaa.tmp
2012-02-08 09:13 . 2012-02-08 12:01 849 ----a-w- c:\programdata\gxzkbaa.tmp
2012-02-08 09:00 . 2012-02-08 12:00 868 ----a-w- c:\programdata\jxzkbaa.tmp
2012-02-08 08:59 . 2012-02-08 12:02 881 ----a-w- c:\programdata\hxzkbaa.tmp
2012-02-08 07:09 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF8D168B-A1FF-41C5-8B21-FE9043CAE0A3}\mpengine.dll
2012-02-08 06:56 . 2012-02-08 07:13 809 ----a-w- c:\programdata\gptlbaa.tmp
2012-02-08 06:55 . 2012-02-08 07:17 812 ----a-w- c:\programdata\kptlbaa.tmp
2012-02-08 06:55 . 2012-02-08 07:17 833 ----a-w- c:\programdata\jptlbaa.tmp
2012-02-08 06:55 . 2012-02-08 07:14 815 ----a-w- c:\programdata\iptlbaa.tmp
2012-02-08 06:55 . 2012-02-08 07:15 840 ----a-w- c:\programdata\hptlbaa.tmp
2012-02-07 14:49 . 2012-02-08 23:23 824 ----a-w- c:\programdata\moqlbaa.tmp
2012-02-07 14:48 . 2012-02-08 23:21 849 ----a-w- c:\programdata\qoqlbaa.tmp
2012-02-07 14:48 . 2012-02-08 23:21 788 ----a-w- c:\programdata\poqlbaa.tmp
2012-02-07 14:48 . 2012-02-08 23:20 829 ----a-w- c:\programdata\ooqlbaa.tmp
2012-02-07 14:48 . 2012-02-08 23:20 842 ----a-w- c:\programdata\noqlbaa.tmp
2012-02-07 10:45 . 2012-02-07 10:45 -------- d-----w- c:\programdata\InstallShield
2012-02-07 10:42 . 2012-02-07 10:42 -------- d-----w- c:\users\Pepos7\AppData\Roaming\Petroglyph
2012-02-07 10:32 . 2012-02-07 10:32 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2012-02-04 18:05 . 2012-02-04 18:09 824 ----a-w- c:\programdata\clcnbaa.tmp
2012-02-04 18:04 . 2012-02-04 18:08 799 ----a-w- c:\programdata\glcnbaa.tmp
2012-02-04 18:04 . 2012-02-04 18:09 815 ----a-w- c:\programdata\flcnbaa.tmp
2012-02-04 18:04 . 2012-02-04 18:04 843 ----a-w- c:\programdata\elcnbaa.tmp
2012-02-04 18:04 . 2012-02-04 18:08 872 ----a-w- c:\programdata\dlcnbaa.tmp
2012-02-04 06:23 . 2012-02-04 06:38 873 ----a-w- c:\programdata\mgkmbaa.tmp
2012-02-04 06:22 . 2012-02-04 06:38 852 ----a-w- c:\programdata\qgkmbaa.tmp
2012-02-04 06:22 . 2012-02-04 06:40 852 ----a-w- c:\programdata\pgkmbaa.tmp
2012-02-04 06:22 . 2012-02-04 06:38 842 ----a-w- c:\programdata\ogkmbaa.tmp
2012-02-04 06:22 . 2012-02-04 06:40 853 ----a-w- c:\programdata\ngkmbaa.tmp
2012-02-03 16:18 . 2012-02-03 22:07 800 ----a-w- c:\programdata\okyqbaa.tmp
2012-02-03 16:18 . 2012-02-03 22:09 809 ----a-w- c:\programdata\nkyqbaa.tmp
2012-02-03 16:18 . 2012-02-03 22:07 822 ----a-w- c:\programdata\mkyqbaa.tmp
2012-02-03 16:17 . 2012-02-03 22:12 793 ----a-w- c:\programdata\pkyqbaa.tmp
2012-02-03 16:17 . 2012-02-03 22:09 805 ----a-w- c:\programdata\qkyqbaa.tmp
2012-02-03 09:41 . 2012-02-03 09:41 868 ----a-w- c:\programdata\qkblbaa.tmp
2012-02-03 09:40 . 2012-02-03 09:40 831 ----a-w- c:\programdata\ukblbaa.tmp
2012-02-03 09:40 . 2012-02-03 09:40 841 ----a-w- c:\programdata\tkblbaa.tmp
2012-02-03 09:40 . 2012-02-03 09:40 856 ----a-w- c:\programdata\skblbaa.tmp
2012-02-03 09:40 . 2012-02-03 09:40 859 ----a-w- c:\programdata\rkblbaa.tmp
2012-02-03 02:48 . 2012-02-03 03:03 811 ----a-w- c:\programdata\qshkbaa.tmp
2012-02-03 02:47 . 2012-02-03 03:02 845 ----a-w- c:\programdata\ushkbaa.tmp
2012-02-03 02:47 . 2012-02-03 03:01 842 ----a-w- c:\programdata\tshkbaa.tmp
2012-02-03 02:47 . 2012-02-03 02:59 802 ----a-w- c:\programdata\sshkbaa.tmp
2012-02-03 02:47 . 2012-02-03 03:04 816 ----a-w- c:\programdata\rshkbaa.tmp
2012-02-02 15:50 . 2012-02-02 20:46 921 ----a-w- c:\programdata\ltkkbaa.tmp
2012-02-02 15:50 . 2012-02-02 20:49 845 ----a-w- c:\programdata\ktkkbaa.tmp
2012-02-02 15:49 . 2012-02-02 20:47 872 ----a-w- c:\programdata\otkkbaa.tmp
2012-02-02 15:49 . 2012-02-02 20:46 856 ----a-w- c:\programdata\ntkkbaa.tmp
2012-02-02 15:49 . 2012-02-02 20:44 862 ----a-w- c:\programdata\mtkkbaa.tmp
2012-02-02 14:00 . 2012-02-07 23:04 830 ----a-w- c:\programdata\orcmbaa.tmp
2012-02-02 13:59 . 2012-02-07 23:06 889 ----a-w- c:\programdata\srcmbaa.tmp
2012-02-02 13:59 . 2012-02-07 23:04 879 ----a-w- c:\programdata\rrcmbaa.tmp
2012-02-02 13:59 . 2012-02-07 23:04 816 ----a-w- c:\programdata\qrcmbaa.tmp
2012-02-02 13:59 . 2012-02-07 23:06 866 ----a-w- c:\programdata\prcmbaa.tmp
2012-02-02 03:49 . 2012-02-02 04:10 828 ----a-w- c:\programdata\awvibaa.tmp
2012-02-02 03:48 . 2012-02-02 04:10 821 ----a-w- c:\programdata\ewvibaa.tmp
2012-02-02 03:48 . 2012-02-02 04:12 822 ----a-w- c:\programdata\dwvibaa.tmp
2012-02-02 03:48 . 2012-02-02 04:11 838 ----a-w- c:\programdata\cwvibaa.tmp
2012-02-02 03:48 . 2012-02-02 04:08 831 ----a-w- c:\programdata\bwvibaa.tmp
2012-02-01 20:33 . 2012-02-01 21:45 867 ----a-w- c:\programdata\yisqbaa.tmp
2012-02-01 20:32 . 2012-02-01 21:42 871 ----a-w- c:\programdata\cjsqbaa.tmp
2012-02-01 20:32 . 2012-02-01 21:42 832 ----a-w- c:\programdata\bjsqbaa.tmp
2012-02-01 20:32 . 2012-02-01 21:44 841 ----a-w- c:\programdata\ajsqbaa.tmp
2012-02-01 20:32 . 2012-02-01 21:42 815 ----a-w- c:\programdata\zisqbaa.tmp
2012-02-01 17:20 . 2012-02-01 20:26 830 ----a-w- c:\programdata\mcsrbaa.tmp
2012-02-01 17:19 . 2012-02-01 20:26 882 ----a-w- c:\programdata\qcsrbaa.tmp
2012-02-01 17:19 . 2012-02-01 20:25 841 ----a-w- c:\programdata\pcsrbaa.tmp
2012-02-01 17:19 . 2012-02-01 20:23 862 ----a-w- c:\programdata\ocsrbaa.tmp
2012-02-01 17:19 . 2012-02-01 20:27 814 ----a-w- c:\programdata\ncsrbaa.tmp
2012-02-01 13:34 . 2012-02-01 13:50 796 ----a-w- c:\programdata\oxbjbaa.tmp
2012-02-01 13:34 . 2012-02-01 13:50 858 ----a-w- c:\programdata\sxbjbaa.tmp
2012-02-01 13:33 . 2012-02-01 13:47 803 ----a-w- c:\programdata\rxbjbaa.tmp
2012-02-01 13:33 . 2012-02-01 13:46 848 ----a-w- c:\programdata\qxbjbaa.tmp
2012-02-01 13:33 . 2012-02-01 13:50 815 ----a-w- c:\programdata\pxbjbaa.tmp
2012-02-01 06:47 . 2012-02-01 06:47 822 ----a-w- c:\programdata\toppbaa.tmp
2012-02-01 06:47 . 2012-02-01 06:47 848 ----a-w- c:\programdata\soppbaa.tmp
2012-02-01 06:47 . 2012-02-01 06:47 835 ----a-w- c:\programdata\roppbaa.tmp
2012-01-31 14:50 . 2012-01-31 21:52 806 ----a-w- c:\programdata\ywbdbaa.tmp
2012-01-31 14:50 . 2012-01-31 21:57 820 ----a-w- c:\programdata\cxbdbaa.tmp
2012-01-31 14:50 . 2012-01-31 21:52 883 ----a-w- c:\programdata\bxbdbaa.tmp
2012-01-31 14:50 . 2012-01-31 21:56 878 ----a-w- c:\programdata\axbdbaa.tmp
2012-01-31 14:50 . 2012-01-31 21:52 841 ----a-w- c:\programdata\zwbdbaa.tmp
2012-01-31 13:38 . 2012-01-31 14:08 838 ----a-w- c:\programdata\upunbaa.tmp
2012-01-31 13:38 . 2012-01-31 14:13 835 ----a-w- c:\programdata\tpunbaa.tmp
2012-01-31 10:02 . 2012-01-31 10:17 833 ----a-w- c:\programdata\wdznbaa.tmp
2012-01-31 10:01 . 2012-01-31 10:14 822 ----a-w- c:\programdata\aeznbaa.tmp
2012-01-31 10:01 . 2012-01-31 10:16 820 ----a-w- c:\programdata\zdznbaa.tmp
2012-01-31 10:01 . 2012-01-31 10:20 888 ----a-w- c:\programdata\ydznbaa.tmp
2012-01-31 10:01 . 2012-01-31 10:18 806 ----a-w- c:\programdata\xdznbaa.tmp
2012-01-31 03:47 . 2012-01-31 04:09 823 ----a-w- c:\programdata\aukqbaa.tmp
2012-01-31 03:47 . 2012-01-31 04:11 871 ----a-w- c:\programdata\eukqbaa.tmp
2012-01-31 03:46 . 2012-01-31 04:08 851 ----a-w- c:\programdata\dukqbaa.tmp
2012-01-31 03:46 . 2012-01-31 04:09 883 ----a-w- c:\programdata\cukqbaa.tmp
2012-01-31 03:46 . 2012-01-31 04:10 850 ----a-w- c:\programdata\bukqbaa.tmp
2012-01-30 20:23 . 2012-01-30 22:14 829 ----a-w- c:\programdata\yornbaa.tmp
2012-01-30 20:22 . 2012-01-30 22:14 830 ----a-w- c:\programdata\cprnbaa.tmp
2012-01-30 20:22 . 2012-01-30 22:12 817 ----a-w- c:\programdata\bprnbaa.tmp
2012-01-30 20:22 . 2012-01-30 22:13 852 ----a-w- c:\programdata\aprnbaa.tmp
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2011-12-20 17:05 . 2011-12-20 17:05 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-12-13 21:20 . 2011-12-13 21:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 07:14 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-17 06:35 . 2012-01-31 13:39 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:34 . 2012-01-31 13:39 224768 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-11-21 . !HASH: COULD NOT OPEN FILE !!!!! . 858112 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 15:31 1514152 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Steam"="c:\hry\Steam\steam.exe" [2011-08-02 1242448]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-MiNODLogin - c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:89,f9,ed,8d,13,6b,ca,ed,ce,2b,37,3c,dc,17,c6,16,e0,4d,f7,34,58,b3,37,
ea,35,db,12,2f,c7,a0,84,4a,c2,8c,e7,09,47,43,11,33,a0,db,1b,57,1c,b8,7b,c1,\
"??"=hex:40,b9,f6,74,c6,21,0f,76,20,31,c1,f5,1c,10,ea,71
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\License information*]
"datasecu"=hex:51,1b,86,ff,8e,82,c0,ac,9c,61,51,46,bc,d9,a0,92,fa,1e,6d,6d,ac,
5e,3e,de,6c,fa,d5,73,d0,81,22,b9,3e,ed,40,cd,18,90,05,41,cd,77,5f,95,45,18,\
"rkeysecu"=hex:84,ff,9b,0c,9d,2f,d8,30,e2,8b,7d,55,7a,f3,fc,f4
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\folding@homecpu\1\Fah.exe
c:\folding@homecpu\2\Fah.exe
c:\folding@homecpu\3\Fah.exe
c:\folding@homecpu\4\Fah.exe
c:\folding@homecpu\2\FahCore_a4.exe
c:\folding@homecpu\1\FahCore_a4.exe
c:\folding@homecpu\3\FahCore_a4.exe
c:\folding@homecpu\4\FahCore_a4.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Celkový čas: 2012-02-09 21:36:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-09 20:36
.
Před spuštěním: Volných bajtů: 105 799 487 488
Po spuštění: Volných bajtů: 106 687 275 008
.
- - End Of File - - 2865AD4103308E953543FA070FCA9CCE

[Rossi46]

Tak znova a lepe


ComboFix 12-02-10.01 - Pepos7 10.02.2012 15:31:57.2.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2739 [GMT 1:00]
Spuštěný z: c:\users\Pepos7\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\aeznbaa.tmp
c:\programdata\afembaa.tmp
c:\programdata\ajsqbaa.tmp
c:\programdata\anklbaa.tmp
c:\programdata\aprnbaa.tmp
c:\programdata\aukqbaa.tmp
c:\programdata\awvibaa.tmp
c:\programdata\axbdbaa.tmp
c:\programdata\ayclbaa.tmp
c:\programdata\aydhbaa.tmp
c:\programdata\bfembaa.tmp
c:\programdata\bjsqbaa.tmp
c:\programdata\bnklbaa.tmp
c:\programdata\bprnbaa.tmp
c:\programdata\bukqbaa.tmp
c:\programdata\bwvibaa.tmp
c:\programdata\bxbdbaa.tmp
c:\programdata\byclbaa.tmp
c:\programdata\cbplbaa.tmp
c:\programdata\cfembaa.tmp
c:\programdata\cjsqbaa.tmp
c:\programdata\clcnbaa.tmp
c:\programdata\cnklbaa.tmp
c:\programdata\cprnbaa.tmp
c:\programdata\crbkbaa.tmp
c:\programdata\cukqbaa.tmp
c:\programdata\cwvibaa.tmp
c:\programdata\cxbdbaa.tmp
c:\programdata\cyclbaa.tmp
c:\programdata\czhjbaa.tmp
c:\programdata\dbplbaa.tmp
c:\programdata\dlcnbaa.tmp
c:\programdata\drbkbaa.tmp
c:\programdata\dukqbaa.tmp
c:\programdata\dwvibaa.tmp
c:\programdata\dyclbaa.tmp
c:\programdata\dzhjbaa.tmp
c:\programdata\ebplbaa.tmp
c:\programdata\elcnbaa.tmp
c:\programdata\erbkbaa.tmp
c:\programdata\eukqbaa.tmp
c:\programdata\ewvibaa.tmp
c:\programdata\eyclbaa.tmp
c:\programdata\ezhjbaa.tmp
c:\programdata\fbplbaa.tmp
c:\programdata\flcnbaa.tmp
c:\programdata\frbkbaa.tmp
c:\programdata\fzhjbaa.tmp
c:\programdata\gbplbaa.tmp
c:\programdata\glcnbaa.tmp
c:\programdata\gptlbaa.tmp
c:\programdata\grbkbaa.tmp
c:\programdata\gxzkbaa.tmp
c:\programdata\gzhjbaa.tmp
c:\programdata\hptlbaa.tmp
c:\programdata\hxzkbaa.tmp
c:\programdata\iptlbaa.tmp
c:\programdata\ixzkbaa.tmp
c:\programdata\jptlbaa.tmp
c:\programdata\jxzkbaa.tmp
c:\programdata\knlnbaa.tmp
c:\programdata\kptlbaa.tmp
c:\programdata\ktkkbaa.tmp
c:\programdata\kxzkbaa.tmp
c:\programdata\lnlnbaa.tmp
c:\programdata\ltkkbaa.tmp
c:\programdata\mcsrbaa.tmp
c:\programdata\mgkmbaa.tmp
c:\programdata\mkyqbaa.tmp
c:\programdata\mnlnbaa.tmp
c:\programdata\moqlbaa.tmp
c:\programdata\mqxnbaa.tmp
c:\programdata\mtkkbaa.tmp
c:\programdata\ncsrbaa.tmp
c:\programdata\ngkmbaa.tmp
c:\programdata\nkyqbaa.tmp
c:\programdata\nnlnbaa.tmp
c:\programdata\noqlbaa.tmp
c:\programdata\nqxnbaa.tmp
c:\programdata\ntkkbaa.tmp
c:\programdata\obqnbaa.tmp
c:\programdata\ocsrbaa.tmp
c:\programdata\ogkmbaa.tmp
c:\programdata\okyqbaa.tmp
c:\programdata\onlnbaa.tmp
c:\programdata\ooqlbaa.tmp
c:\programdata\oqxnbaa.tmp
c:\programdata\orcmbaa.tmp
c:\programdata\otkkbaa.tmp
c:\programdata\oxbjbaa.tmp
c:\programdata\pbqnbaa.tmp
c:\programdata\pcsrbaa.tmp
c:\programdata\pgkmbaa.tmp
c:\programdata\pkyqbaa.tmp
c:\programdata\poqlbaa.tmp
c:\programdata\pqxnbaa.tmp
c:\programdata\prcmbaa.tmp
c:\programdata\pxbjbaa.tmp
c:\programdata\qbqnbaa.tmp
c:\programdata\qcsrbaa.tmp
c:\programdata\qgkmbaa.tmp
c:\programdata\qkblbaa.tmp
c:\programdata\qkyqbaa.tmp
c:\programdata\qoqlbaa.tmp
c:\programdata\qqxnbaa.tmp
c:\programdata\qrcmbaa.tmp
c:\programdata\qshkbaa.tmp
c:\programdata\qxbjbaa.tmp
c:\programdata\rbqnbaa.tmp
c:\programdata\rkblbaa.tmp
c:\programdata\roppbaa.tmp
c:\programdata\rrcmbaa.tmp
c:\programdata\rshkbaa.tmp
c:\programdata\rxbjbaa.tmp
c:\programdata\sbqnbaa.tmp
c:\programdata\skblbaa.tmp
c:\programdata\soppbaa.tmp
c:\programdata\spunbaa.tmp
c:\programdata\srcmbaa.tmp
c:\programdata\sshkbaa.tmp
c:\programdata\sxbjbaa.tmp
c:\programdata\tkblbaa.tmp
c:\programdata\toppbaa.tmp
c:\programdata\tpunbaa.tmp
c:\programdata\tshkbaa.tmp
c:\programdata\ugmkbaa.tmp
c:\programdata\ukblbaa.tmp
c:\programdata\uosjbaa.tmp
c:\programdata\upunbaa.tmp
c:\programdata\ushkbaa.tmp
c:\programdata\vgmkbaa.tmp
c:\programdata\vosjbaa.tmp
c:\programdata\vpunbaa.tmp
c:\programdata\wdznbaa.tmp
c:\programdata\wgmkbaa.tmp
c:\programdata\wosjbaa.tmp
c:\programdata\wpunbaa.tmp
c:\programdata\wxdhbaa.tmp
c:\programdata\xdznbaa.tmp
c:\programdata\xosjbaa.tmp
c:\programdata\xxdhbaa.tmp
c:\programdata\ydznbaa.tmp
c:\programdata\yeembaa.tmp
c:\programdata\ygmkbaa.tmp
c:\programdata\yisqbaa.tmp
c:\programdata\ymklbaa.tmp
c:\programdata\yornbaa.tmp
c:\programdata\yosjbaa.tmp
c:\programdata\ywbdbaa.tmp
c:\programdata\yxdhbaa.tmp
c:\programdata\zdznbaa.tmp
c:\programdata\zeembaa.tmp
c:\programdata\zisqbaa.tmp
c:\programdata\zmklbaa.tmp
c:\programdata\zornbaa.tmp
c:\programdata\zwbdbaa.tmp
c:\programdata\zxdhbaa.tmp
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-10 do 2012-02-10 )))))))))))))))))))))))))))))))
.
.
2012-02-10 14:38 . 2012-02-10 14:38 -------- d-----w- c:\programdata\AutoKMS
2012-02-10 14:37 . 2012-02-10 14:37 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-10 14:37 . 2012-02-10 14:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-09 19:58 . 2012-02-09 19:58 -------- d-----w- c:\programdata\B7E85889000435DB000009C6B4EB2331
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- c:\program files\trend micro
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- C:\rsit
2012-02-09 19:48 . 2012-02-09 19:48 -------- d-----w- c:\windows\system32\IO
2012-02-08 07:09 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF8D168B-A1FF-41C5-8B21-FE9043CAE0A3}\mpengine.dll
2012-02-07 10:45 . 2012-02-07 10:45 -------- d-----w- c:\programdata\InstallShield
2012-02-07 10:42 . 2012-02-07 10:42 -------- d-----w- c:\users\Pepos7\AppData\Roaming\Petroglyph
2012-02-07 10:32 . 2012-02-07 10:32 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2012-01-11 22:43 . 2012-01-11 22:45 -------- d-----w- c:\users\Pepos7\AppData\Local\PokerStars.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2011-12-20 17:05 . 2011-12-20 17:05 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-12-13 21:20 . 2011-12-13 21:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 07:14 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-19 14:58 . 2012-01-11 12:38 77312 ----a-w- c:\windows\system32\packager.dll
2011-11-19 14:01 . 2012-01-11 12:38 67072 ----a-w- c:\windows\SysWow64\packager.dll
2011-11-17 06:41 . 2012-01-11 13:08 1731920 ----a-w- c:\windows\system32\ntdll.dll
2011-11-17 06:35 . 2012-01-31 13:39 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:38 . 2012-01-11 13:08 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2011-11-17 05:34 . 2012-01-31 13:39 224768 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-11-21 . !HASH: COULD NOT OPEN FILE !!!!! . 858112 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-02-09_20.31.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-29 15:36 . 2012-02-10 14:25 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2012-01-29 15:36 . 2012-02-09 20:23 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2012-01-29 15:36 . 2012-02-09 20:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-01-29 15:36 . 2012-02-10 14:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 04:54 . 2012-02-09 20:23 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-02-10 14:27 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012021020120211\index.dat
- 2012-01-29 15:36 . 2012-02-09 20:23 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
+ 2012-01-29 15:36 . 2012-02-10 14:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
+ 2010-11-21 03:09 . 2012-02-10 14:28 40116 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-10 14:28 32302 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-02-25 19:09 . 2012-02-09 20:19 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-25 19:09 . 2012-02-10 14:27 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-25 19:09 . 2012-02-09 20:19 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-10 14:27 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-09 20:19 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-10 14:27 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-09 20:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-10 14:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-10 14:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-09 20:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-02-09 20:06 . 2012-02-09 20:12 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-09 20:06 . 2012-02-09 21:00 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-09 21:00 . 2012-02-09 21:00 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{10A4EC57-5361-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:52 . 2012-02-09 20:52 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F0419588-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:59 . 2012-02-09 20:59 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EBE5AE20-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:51 . 2012-02-09 20:58 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DB5CE181-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:58 . 2012-02-09 20:58 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D711A3BA-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:23 . 2012-02-10 14:23 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BE948664-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-09 20:36 . 2012-02-09 20:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BE5ED556-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A74ABDEE-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A6EDFE79-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A3B400FA-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A0B585E2-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:35 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A08F59A7-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9E540F64-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:25 5632 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9DC3EEBA-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-09 20:42 . 2012-02-09 20:49 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9C3742A5-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:49 . 2012-02-09 20:55 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{97F58A5F-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:49 . 2012-02-09 20:49 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{97586F8D-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:56 . 2012-02-09 20:56 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9303AC45-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:41 . 2012-02-09 20:41 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78282A3E-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:41 . 2012-02-09 20:46 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{687F9CF1-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:55 . 2012-02-09 21:00 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{591850BA-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:39 . 2012-02-09 20:43 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{255165F6-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 21:00 . 2012-02-09 21:00 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{13279FE5-5361-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:53 . 2012-02-09 20:53 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0CE9E695-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 21:00 . 2012-02-09 21:00 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{088B9DCC-5361-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:52 . 2012-02-09 20:52 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F0419589-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:59 . 2012-02-09 20:59 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EBE5AE21-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:51 . 2012-02-09 20:58 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DB5CE182-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:58 . 2012-02-09 20:58 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D711A3BB-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:23 . 2012-02-10 14:23 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BE948665-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-09 20:36 . 2012-02-09 20:41 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BE5ED557-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:41 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A74ABDEF-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A6EDFE7A-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A3B400FB-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-10 14:22 . 2012-02-10 14:22 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A0B585E3-53F2-11E1-8150-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:35 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A08F59A8-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:35 . 2012-02-09 20:41 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9E540F65-535D-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:42 . 2012-02-09 20:49 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9C3742A6-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:49 . 2012-02-09 20:55 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{97F58A60-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:49 . 2012-02-09 20:49 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{97586F8E-535F-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:56 . 2012-02-09 20:56 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9303AC46-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:41 . 2012-02-09 20:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78282A3F-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:41 . 2012-02-09 20:46 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{687F9CF2-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:55 . 2012-02-09 21:00 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{591850BB-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:39 . 2012-02-09 20:43 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{255165F7-535E-11E1-8D36-0022159883DB}.dat
+ 2012-02-10 14:25 . 2012-02-10 14:25 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{22F8DE0E-53F3-11E1-8150-0022159883DB}.dat
+ 2012-02-09 21:00 . 2012-02-09 21:00 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{13279FE6-5361-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 20:53 . 2012-02-09 20:53 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0CE9E696-5360-11E1-8D36-0022159883DB}.dat
+ 2012-02-09 21:00 . 2012-02-09 21:00 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{088B9DCD-5361-11E1-8D36-0022159883DB}.dat
+ 2011-02-24 22:17 . 2012-02-10 14:28 8436 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4117625595-3377170590-1022986480-1000_UserData.bin
+ 2012-02-10 14:38 . 2012-02-10 14:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-09 20:31 . 2012-02-09 20:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-01-29 15:36 . 2012-02-10 14:25 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
- 2012-01-29 15:36 . 2012-02-09 20:23 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2012-02-08 23:00 . 2012-02-09 21:00 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012020920120210\index.dat
- 2009-07-14 05:01 . 2012-02-09 20:30 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-02-10 14:37 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:54 . 2012-02-10 14:27 1015808 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-10 14:27 2490368 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-24 23:27 . 2012-02-10 14:37 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
- 2011-02-24 23:27 . 2012-02-09 20:30 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 15:31 1514152 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Steam"="c:\hry\Steam\steam.exe" [2011-08-02 1242448]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:89,f9,ed,8d,13,6b,ca,ed,ce,2b,37,3c,dc,17,c6,16,e0,4d,f7,34,58,b3,37,
ea,35,db,12,2f,c7,a0,84,4a,c2,8c,e7,09,47,43,11,33,a0,db,1b,57,1c,b8,7b,c1,\
"??"=hex:40,b9,f6,74,c6,21,0f,76,20,31,c1,f5,1c,10,ea,71
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\License information*]
"datasecu"=hex:51,1b,86,ff,8e,82,c0,ac,9c,61,51,46,bc,d9,a0,92,fa,1e,6d,6d,ac,
5e,3e,de,6c,fa,d5,73,d0,81,22,b9,3e,ed,40,cd,18,90,05,41,cd,77,5f,95,45,18,\
"rkeysecu"=hex:84,ff,9b,0c,9d,2f,d8,30,e2,8b,7d,55,7a,f3,fc,f4
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\folding@homecpu\1\Fah.exe
c:\folding@homecpu\2\Fah.exe
c:\folding@homecpu\3\Fah.exe
c:\folding@homecpu\1\FahCore_a4.exe
c:\folding@homecpu\4\Fah.exe
c:\folding@homecpu\3\FahCore_a4.exe
c:\folding@homecpu\2\FahCore_a4.exe
c:\folding@homecpu\4\FahCore_a4.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Celkový čas: 2012-02-10 15:42:30 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-10 14:42
ComboFix2.txt 2012-02-09 20:36
.
Před spuštěním: Volných bajtů: 106 539 655 168
Po spuštění: Volných bajtů: 106 323 951 616
.
- - End Of File - - 0EF8CE099E86E80168DE8BBD5FB9DC4C

[Rossi46]

c:\folding@homecpu\1\Fah.exe (cisty)
https://www.virustotal.com/file/0a9ae91 ... /analysis/

c:\windows\SysWOW64\user32.dll (vir) kdyz sem se prihlasis jako administrator tak mi ESS nahlasil ze ho mohu smazat.
Kdyz ho chci vlozit do VT tak mi to hlasi ze nemam opravneni to vlozit bla bla i kdyz jsem prihlasenej jako administrator


c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll (cisty)
https://www.virustotal.com/file/01eb95f ... 328888248/

[Rossi46]

aplikaci folding a homecpu neznam

stal mi to hlasi vira..

ComboFix 12-02-10.01 - Administrator 10.02.2012 17:32:21.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2528 [GMT 1:00]
Spuštěný z: c:\users\Administrator\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Administrator\Desktop\CFScript.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\sdakbaa.tmp
c:\programdata\tdakbaa.tmp
c:\programdata\udakbaa.tmp
c:\programdata\vdakbaa.tmp
c:\programdata\wdakbaa.tmp
c:\windows\SysWow64\winEF48.tmp
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll --> c:\windows\SysWOW64\user32.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-10 do 2012-02-10 )))))))))))))))))))))))))))))))
.
.
2012-02-10 16:36 . 2012-02-10 16:36 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-10 16:36 . 2012-02-10 16:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-10 15:25 . 2012-02-10 15:25 -------- d-----w- c:\users\Administrator
2012-02-10 14:52 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C408FC1E-1606-4F5C-B31B-89E084DF7A10}\mpengine.dll
2012-02-09 19:58 . 2012-02-09 19:58 -------- d-----w- c:\programdata\B7E85889000435DB000009C6B4EB2331
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- c:\program files\trend micro
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- C:\rsit
2012-02-09 19:48 . 2012-02-09 19:48 -------- d-----w- c:\windows\system32\IO
2012-02-07 10:45 . 2012-02-07 10:45 -------- d-----w- c:\programdata\InstallShield
2012-02-07 10:42 . 2012-02-07 10:42 -------- d-----w- c:\users\Pepos7\AppData\Roaming\Petroglyph
2012-02-07 10:32 . 2012-02-07 10:32 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2012-01-11 22:43 . 2012-01-11 22:45 -------- d-----w- c:\users\Pepos7\AppData\Local\PokerStars.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2011-12-20 17:05 . 2011-12-20 17:05 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-12-13 21:20 . 2011-12-13 21:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 07:14 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-19 14:58 . 2012-01-11 12:38 77312 ----a-w- c:\windows\system32\packager.dll
2011-11-19 14:01 . 2012-01-11 12:38 67072 ----a-w- c:\windows\SysWow64\packager.dll
2011-11-17 06:41 . 2012-01-11 13:08 1731920 ----a-w- c:\windows\system32\ntdll.dll
2011-11-17 06:35 . 2012-01-31 13:39 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:38 . 2012-01-11 13:08 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2011-11-17 05:34 . 2012-01-31 13:39 224768 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-11-21 . !HASH: COULD NOT OPEN FILE !!!!! . 858112 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
((((((((((((((((((((((((((((( SnapShot_2012-02-10_14.38.49 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-01-29 15:36 . 2012-02-10 14:25 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
+ 2012-01-29 15:36 . 2012-02-10 16:24 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2012-01-29 15:36 . 2012-02-10 14:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-01-29 15:36 . 2012-02-10 14:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 04:54 . 2012-02-10 14:27 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-02-10 16:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-02-10 14:22 . 2012-02-10 16:24 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012021020120211\index.dat
+ 2012-01-29 15:36 . 2012-02-10 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
- 2012-01-29 15:36 . 2012-02-10 14:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
+ 2010-11-21 03:09 . 2012-02-10 15:11 40362 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-10 15:11 32334 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-24 21:59 . 2012-02-10 15:28 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-24 21:59 . 2012-02-08 23:12 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-24 21:59 . 2012-02-08 23:12 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-24 21:59 . 2012-02-10 15:28 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-10 15:28 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-08 23:12 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-10 16:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-25 19:09 . 2012-02-10 14:27 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:46 . 2012-02-10 15:25 91312 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-02-25 19:09 . 2012-02-10 16:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 14:27 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 14:27 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-10 16:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-10 14:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-10 16:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-24 22:41 . 2012-02-10 14:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-24 22:41 . 2012-02-10 16:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-02-09 20:06 . 2012-02-10 16:30 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
- 2012-02-09 20:06 . 2012-02-09 21:00 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-10 16:30 . 2012-02-10 16:30 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{7AA110C4-5404-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:12 . 2012-02-10 16:15 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB16E9FD-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:19 . 2012-02-10 16:24 5632 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F66C752B-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:43 . 2012-02-10 15:49 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EF6731C6-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:14 . 2012-02-10 15:18 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EDC2BFF9-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:57 . 2012-02-10 15:57 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ECF3C26D-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:04 . 2012-02-10 16:08 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E9433E18-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:28 . 2012-02-10 15:33 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E5F3FB86-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:28 . 2012-02-10 15:31 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E3DC65E8-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:17 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D5EDD91A-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:18 . 2012-02-10 16:22 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D5CE19E9-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:11 . 2012-02-10 16:15 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D4E45517-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:18 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D304CA65-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:18 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D0018C8C-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:35 . 2012-02-10 15:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CFF936D2-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:41 . 2012-02-10 15:46 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B448C4B8-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:24 . 2012-02-10 16:30 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AF16B5ED-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:43 . 2012-02-10 14:43 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9B0EAC37-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:50 . 2012-02-10 14:50 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95C4BB33-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:57 . 2012-02-10 14:57 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{90A34193-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:01 . 2012-02-10 16:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B2776E2-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:54 . 2012-02-10 15:54 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{893317F2-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:12 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{875CC36B-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:14 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{86D0523A-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:40 . 2012-02-10 15:40 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{83B0ED60-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:42 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{81E2FF31-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:54 . 2012-02-10 15:59 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{81B6E435-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:01 . 2012-02-10 16:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{819AD1A9-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:47 . 2012-02-10 15:53 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8135DBEE-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:22 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8071A399-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:42 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{805A3C24-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:55 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D551AE3-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:14 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D43AD01-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:48 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7C1CEFB7-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A69AACD-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{760B6204-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:23 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{756773C0-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:18 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{71C4B9B5-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:12 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{714C2201-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F0A77DE-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:25 . 2012-02-10 15:25 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6DB0FE4E-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:22 . 2012-02-10 16:27 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6CF0B88F-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69B23E97-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:15 . 2012-02-10 16:21 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6967AFB0-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:32 . 2012-02-10 15:38 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{694D1C41-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:17 . 2012-02-10 15:17 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{651D08E0-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:24 . 2012-02-10 15:28 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{60CB69B2-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5D26A04E-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:46 . 2012-02-10 15:51 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{596C3BBA-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{58CAB8E6-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:55 . 2012-02-10 14:55 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51912BB1-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:14 . 2012-02-10 16:18 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4F8BDCD5-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:38 . 2012-02-10 15:44 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4601F177-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:45 . 2012-02-10 15:51 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3D551E9E-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:21 . 2012-02-10 16:21 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3C3069D3-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:23 . 2012-02-10 15:28 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3BCAB862-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:23 . 2012-02-10 15:30 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2C946D22-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:59 . 2012-02-10 16:05 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2915A579-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:44 . 2012-02-10 15:47 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{21C5AFF2-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:30 . 2012-02-10 15:35 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1F48F5F6-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:51 . 2012-02-10 15:57 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1EB70930-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:13 . 2012-02-10 16:19 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B005CA9-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:51 . 2012-02-10 15:58 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{18E4EBC4-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:22 . 2012-02-10 15:22 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{18388132-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:29 . 2012-02-10 15:29 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{158F838A-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:36 . 2012-02-10 15:36 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0F7B2D62-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:19 . 2012-02-10 16:19 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0852AE1B-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:58 . 2012-02-10 16:02 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0708B64E-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:12 . 2012-02-10 16:15 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FB16E9FE-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:43 . 2012-02-10 15:49 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EF6731C7-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:14 . 2012-02-10 15:18 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EDC2BFFA-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:57 . 2012-02-10 15:57 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ECF3C26E-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:04 . 2012-02-10 16:08 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E9433E19-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:28 . 2012-02-10 15:33 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E5F3FB87-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:28 . 2012-02-10 15:31 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E3DC65E9-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:17 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5EDD91B-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:18 . 2012-02-10 16:22 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5CE19EA-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:11 . 2012-02-10 16:15 5632 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D4E45518-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:18 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D304CA66-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:13 . 2012-02-10 15:18 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D0018C8D-53F9-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:35 . 2012-02-10 15:41 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CFF936D3-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:41 . 2012-02-10 15:46 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B448C4B9-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:24 . 2012-02-10 16:30 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AF16B5EE-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:43 . 2012-02-10 14:43 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9B0EAC38-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:50 . 2012-02-10 14:50 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{95C4BB34-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:57 . 2012-02-10 14:57 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{90A34194-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:01 . 2012-02-10 16:01 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8B2776E3-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:54 . 2012-02-10 15:54 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{893317F3-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:12 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{875CC36C-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:14 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{86D0523B-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:40 . 2012-02-10 15:40 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{83B0ED61-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:43 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{81E2FF32-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:54 . 2012-02-10 15:59 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{81B6E436-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:01 . 2012-02-10 16:01 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{819AD1AA-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:47 . 2012-02-10 15:53 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8135DBEF-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:22 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8071A39A-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:43 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{805A3C25-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:55 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D551AE4-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:14 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D43AD02-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:42 . 2012-02-10 14:48 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7C1CEFB8-53F5-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A69AACE-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{760B6205-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:23 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{756773C1-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:18 . 2012-02-10 15:18 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{71C4B9B6-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:08 . 2012-02-10 16:12 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{714C2202-5401-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6F0A77DF-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:25 . 2012-02-10 15:25 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6DB0FE4F-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:22 . 2012-02-10 16:27 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6CF0B890-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{69B23E98-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:15 . 2012-02-10 16:21 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6967AFB1-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:32 . 2012-02-10 15:38 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{694D1C42-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:17 . 2012-02-10 15:17 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{651D08E1-53FA-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:24 . 2012-02-10 15:28 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{60CB69B3-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:49 . 2012-02-10 14:49 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5D26A04F-53F6-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 15:46 . 2012-02-10 15:51 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{596C3BBB-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 14:56 . 2012-02-10 14:56 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{58CAB8E7-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 14:55 . 2012-02-10 14:55 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{51912BB2-53F7-11E1-9C07-0022159883DB}.dat
+ 2012-02-10 16:14 . 2012-02-10 16:18 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4F8BDCD6-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:38 . 2012-02-10 15:44 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4601F178-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:45 . 2012-02-10 15:51 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3D551E9F-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:21 . 2012-02-10 16:21 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3C3069D4-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:23 . 2012-02-10 15:28 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3BCAB863-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:23 . 2012-02-10 15:29 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2C946D23-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:59 . 2012-02-10 16:05 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2915A57A-5400-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:44 . 2012-02-10 15:47 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{21C5AFF3-53FE-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:30 . 2012-02-10 15:35 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1F48F5F7-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:51 . 2012-02-10 15:57 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1EB70931-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:13 . 2012-02-10 16:19 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1B005CAA-5402-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:51 . 2012-02-10 15:58 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{18E4EBC5-53FF-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:22 . 2012-02-10 15:22 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{18388133-53FB-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:29 . 2012-02-10 15:29 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{158F838B-53FC-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:36 . 2012-02-10 15:37 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0F7B2D63-53FD-11E1-8535-0022159883DB}.dat
+ 2012-02-10 16:19 . 2012-02-10 16:19 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0852AE1C-5403-11E1-8535-0022159883DB}.dat
+ 2012-02-10 15:58 . 2012-02-10 16:02 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0708B64F-5400-11E1-8535-0022159883DB}.dat
+ 2011-02-24 22:17 . 2012-02-10 15:11 8460 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4117625595-3377170590-1022986480-1000_UserData.bin
+ 2012-02-10 16:37 . 2012-02-10 16:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-02-10 14:38 . 2012-02-10 14:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-02-10 16:37 . 2012-02-10 16:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-01-29 15:36 . 2012-02-10 14:25 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2012-01-29 15:36 . 2012-02-10 16:30 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2009-07-14 05:01 . 2012-02-10 16:37 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-02-10 14:37 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:54 . 2012-02-10 16:38 1048576 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-10 16:38 2555904 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-24 23:27 . 2012-02-10 16:37 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
- 2011-02-24 23:27 . 2012-02-10 14:37 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 15:31 1514152 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,30,9e,50,63,38,03,41,87,cb,ea,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,30,9e,50,63,38,03,41,87,cb,ea,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\folding@homecpu\1\Fah.exe
c:\folding@homecpu\2\Fah.exe
c:\folding@homecpu\3\Fah.exe
c:\folding@homecpu\1\FahCore_a4.exe
c:\folding@homecpu\4\Fah.exe
c:\folding@homecpu\2\FahCore_a4.exe
c:\folding@homecpu\3\FahCore_a4.exe
c:\folding@homecpu\4\FahCore_a4.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Celkový čas: 2012-02-10 17:43:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-10 16:42
ComboFix2.txt 2012-02-10 14:42
ComboFix3.txt 2012-02-09 20:36
.
Před spuštěním: Volných bajtů: 105 181 413 376
Po spuštění: Volných bajtů: 105 109 913 600
.
- - End Of File - - 3CBA0CC93D92FEC588C1BB5BBFD9573E

[Rossi46]

folding a home cpu sem smazal..

[Rossi46]

Stale to same, ESS mi hned po startu najde trojana.. user32.dll

ComboFix 12-02-10.01 - Administrator 10.02.2012 18:03:50.4.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2760 [GMT 1:00]
Spuštěný z: c:\users\Administrator\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Administrator\Desktop\CFScript.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\qqaibaa.tmp
c:\programdata\rqaibaa.tmp
c:\programdata\sqaibaa.tmp
c:\programdata\tqaibaa.tmp
c:\programdata\uqaibaa.tmp
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll --> c:\windows\SysWOW64\user32.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-10 do 2012-02-10 )))))))))))))))))))))))))))))))
.
.
2012-02-10 17:08 . 2012-02-10 17:08 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-10 17:08 . 2012-02-10 17:08 -------- d-----w- c:\users\Pepos7\AppData\Local\temp
2012-02-10 17:08 . 2012-02-10 17:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-10 15:25 . 2012-02-10 15:25 -------- d-----w- c:\users\Administrator
2012-02-10 14:52 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C408FC1E-1606-4F5C-B31B-89E084DF7A10}\mpengine.dll
2012-02-09 19:58 . 2012-02-09 19:58 -------- d-----w- c:\programdata\B7E85889000435DB000009C6B4EB2331
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- c:\program files\trend micro
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- C:\rsit
2012-02-09 19:48 . 2012-02-09 19:48 -------- d-----w- c:\windows\system32\IO
2012-02-07 10:45 . 2012-02-07 10:45 -------- d-----w- c:\programdata\InstallShield
2012-02-07 10:42 . 2012-02-07 10:42 -------- d-----w- c:\users\Pepos7\AppData\Roaming\Petroglyph
2012-02-07 10:32 . 2012-02-07 10:32 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2012-01-11 22:43 . 2012-01-11 22:45 -------- d-----w- c:\users\Pepos7\AppData\Local\PokerStars.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2011-12-20 17:05 . 2011-12-20 17:05 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-12-13 21:20 . 2011-12-13 21:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 07:14 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-19 14:58 . 2012-01-11 12:38 77312 ----a-w- c:\windows\system32\packager.dll
2011-11-19 14:01 . 2012-01-11 12:38 67072 ----a-w- c:\windows\SysWow64\packager.dll
2011-11-17 06:41 . 2012-01-11 13:08 1731920 ----a-w- c:\windows\system32\ntdll.dll
2011-11-17 06:35 . 2012-01-31 13:39 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:38 . 2012-01-11 13:08 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2011-11-17 05:34 . 2012-01-31 13:39 224768 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-11-21 . !HASH: COULD NOT OPEN FILE !!!!! . 858112 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
((((((((((((((((((((((((((((( SnapShot_2012-02-10_16.39.33 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-01-29 15:36 . 2012-02-10 16:24 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
+ 2012-01-29 15:36 . 2012-02-10 17:01 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2012-01-29 15:36 . 2012-02-10 14:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-01-29 15:36 . 2012-02-10 16:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:54 . 2012-02-10 17:09 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-10 16:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-01-29 15:36 . 2012-02-10 17:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
- 2012-01-29 15:36 . 2012-02-10 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
+ 2009-07-14 05:10 . 2012-02-10 16:40 32342 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-25 19:09 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-25 19:09 . 2012-02-10 16:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-25 19:09 . 2012-02-10 17:10 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 16:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 16:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-10 16:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-10 16:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-02-09 20:06 . 2012-02-10 16:30 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-09 20:06 . 2012-02-10 17:02 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-10 17:02 . 2012-02-10 17:02 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{FB9A17AD-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:48 . 2012-02-10 16:52 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FDF8B0E1-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:47 . 2012-02-10 16:54 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB94EF3B-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:55 . 2012-02-10 17:01 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F906D2C7-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E98905FD-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E176DB8F-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D732EC60-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:46 . 2012-02-10 16:51 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4EC5B30-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:53 . 2012-02-10 16:56 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA35020C-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:52 . 2012-02-10 16:55 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{958B3034-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:51 . 2012-02-10 16:54 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{861E254D-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:58 . 2012-02-10 17:01 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{64780F46-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:49 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4792B7D2-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:49 . 2012-02-10 16:56 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{432DD2F9-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:56 . 2012-02-10 17:02 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{358A4E3F-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:47 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2FBDD0F4-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:46 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2CD984FE-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:48 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{278A5341-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:56 . 2012-02-10 17:01 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{212D48A7-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:48 . 2012-02-10 16:53 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1748128B-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:55 . 2012-02-10 16:55 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{07E50B1E-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:48 . 2012-02-10 16:52 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FDF8B0E2-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:47 . 2012-02-10 16:54 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FB94EF3C-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:55 . 2012-02-10 17:01 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F906D2C8-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E98905FE-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E176DB90-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 17:01 . 2012-02-10 17:01 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D732EC61-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:46 . 2012-02-10 16:51 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C4EC5B31-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:53 . 2012-02-10 16:56 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BA35020D-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:52 . 2012-02-10 16:55 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{958B3035-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:51 . 2012-02-10 16:54 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{861E254E-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:58 . 2012-02-10 17:01 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{64780F47-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:49 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4792B7D3-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:49 . 2012-02-10 16:56 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{432DD2FA-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:56 . 2012-02-10 17:02 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{358A4E40-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:47 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2FBDD0F5-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:46 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2CD984FF-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:42 . 2012-02-10 16:48 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{278A5342-5406-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:56 . 2012-02-10 17:01 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{212D48A8-5408-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:48 . 2012-02-10 16:53 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1748128C-5407-11E1-953C-0022159883DB}.dat
+ 2012-02-10 16:55 . 2012-02-10 16:55 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{07E50B1F-5408-11E1-953C-0022159883DB}.dat
- 2012-02-10 16:37 . 2012-02-10 16:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-10 17:09 . 2012-02-10 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-10 17:09 . 2012-02-10 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-10 16:37 . 2012-02-10 16:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-01-29 15:36 . 2012-02-10 16:30 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2012-01-29 15:36 . 2012-02-10 17:01 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2012-02-10 14:22 . 2012-02-10 17:01 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012021020120211\index.dat
- 2009-07-14 05:01 . 2012-02-10 16:37 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-02-10 17:08 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:54 . 2012-02-10 17:09 1064960 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-10 17:09 2572288 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 15:31 1514152 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,30,9e,50,63,38,03,41,87,cb,ea,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,30,9e,50,63,38,03,41,87,cb,ea,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Celkový čas: 2012-02-10 18:13:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-10 17:13
ComboFix2.txt 2012-02-10 16:43
ComboFix3.txt 2012-02-10 14:42
ComboFix4.txt 2012-02-09 20:36
.
Před spuštěním: Volných bajtů: 105 252 392 960
Po spuštění: Volných bajtů: 104 965 328 896
.
- - End Of File - - 7AA2CF52B809A7C6C5A96BD82B792085

[Rossi46]

C:\PhysicalMBR.bin (cisty)
https://www.virustotal.com/file/7c61bf4 ... 328895415/

OTL je moc velke, hodim to do linku

[Rossi46]

jj mam, pripravim to a zitra pisnu. pro dnesek to balim

dekuji za ochotu

[Rossi46]

Ahoj, tak sem nasel cd Win 7, bootoval jsem pres nej do prikazoveho radku a slozku Sysnative nevidi! C:\Windows\SysNative\user32.dll
Slozku SysWOW64 uz vidi ale soubor user32.dll v ni neni.. C:\Windows\SysWOW64\user32.dll

Jestli je to boot cd tak mi prosim napis odkaz presne co si mam stahnout na bootovani. Diky

[Rossi46]

Tak uz to slo prekopirovat - naslo to ve slozce C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

ale kdyz chci najet do WIN - nacitani systemu windows, testne pred tim nez se mi ma zobrazit tabulka s vyberem uzivatele mi vyskoci modra smrt!!!

STOP: c000007b (Bad Image)

[Rossi46]

tak kdyz jsem bootoval z CD Win 7 tak kdyz sem chtel dat prikazovy radek tak me to do nej napustila asamo mi to zaclo opravovat bootovani systemu, pak mi to reklo jen restartuj.
Restartoval sem a nabehlo to v pohode do win - bez toho aby me ESS hlasil trojana v user32.dll

[Rossi46]

qoobox viz SZ
na ComboFixu se pracuje

[Rossi46]

Já děkuju


ComboFix 12-02-10.01 - Pepos7 11.02.2012 10:35:47.5.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2676 [GMT 1:00]
Spuštěný z: c:\users\Pepos7\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\gfoqaaa.tmp
c:\programdata\hfoqaaa.tmp
c:\programdata\ifoqaaa.tmp
c:\programdata\jfoqaaa.tmp
c:\programdata\kfoqaaa.tmp
c:\users\Administrator\AppData\Local\temp\dxtmsft.dll
c:\users\Administrator\AppData\Local\temp\dxtrans.dll
c:\users\Administrator\AppData\Local\temp\ieframe.dll
c:\users\Administrator\AppData\Local\temp\mshtml.tlb
c:\users\Administrator\AppData\Local\temp\msscript.ocx
c:\users\Administrator\AppData\Local\temp\ntoskrnl.exe
c:\users\Administrator\AppData\Local\temp\stdole2.tlb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-11 do 2012-02-11 )))))))))))))))))))))))))))))))
.
.
2012-02-11 09:40 . 2012-02-11 09:40 -------- d-----w- c:\programdata\AutoKMS
2012-02-11 09:39 . 2012-02-11 09:39 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-11 09:39 . 2012-02-11 09:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-11 09:07 . 2012-02-11 09:07 -------- d-----w- c:\program files\ESET
2012-02-11 08:54 . 2012-02-11 08:54 -------- d-----w- c:\program files\CCleaner
2012-02-10 17:35 . 2012-02-10 17:35 512 ----a-w- C:\PhysicalMBR.bin
2012-02-10 17:13 . 2012-02-11 09:41 -------- d-----w- c:\users\Pepos7\AppData\Local\temp
2012-02-10 15:25 . 2012-02-10 15:25 -------- d-----w- c:\users\Administrator
2012-02-10 14:52 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C408FC1E-1606-4F5C-B31B-89E084DF7A10}\mpengine.dll
2012-02-09 19:58 . 2012-02-09 19:58 -------- d-----w- c:\programdata\B7E85889000435DB000009C6B4EB2331
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- c:\program files\trend micro
2012-02-09 19:55 . 2012-02-09 19:56 -------- d-----w- C:\rsit
2012-02-09 19:48 . 2012-02-09 19:48 -------- d-----w- c:\windows\system32\IO
2012-02-07 10:45 . 2012-02-07 10:45 -------- d-----w- c:\programdata\InstallShield
2012-02-07 10:42 . 2012-02-07 10:42 -------- d-----w- c:\users\Pepos7\AppData\Roaming\Petroglyph
2012-02-07 10:32 . 2012-02-07 10:32 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-11 09:31 . 2012-02-11 09:31 917290 ----a-w- C:\SysWOW64.zip
2012-02-11 08:43 . 2010-11-21 03:24 1008128 ----a-w- c:\windows\system32\user32.dll
2012-01-26 23:52 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2011-12-20 17:05 . 2011-12-20 17:05 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-12-13 21:20 . 2011-12-13 21:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 07:14 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-19 14:58 . 2012-01-11 12:38 77312 ----a-w- c:\windows\system32\packager.dll
2011-11-19 14:01 . 2012-01-11 12:38 67072 ----a-w- c:\windows\SysWow64\packager.dll
2011-11-17 06:41 . 2012-01-11 13:08 1731920 ----a-w- c:\windows\system32\ntdll.dll
2011-11-17 06:35 . 2012-01-31 13:39 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:38 . 2012-01-11 13:08 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2011-11-17 05:34 . 2012-01-31 13:39 224768 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2012-02-10_17.10.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-01-29 15:36 . 2012-02-10 17:01 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
+ 2012-01-29 15:36 . 2012-02-10 19:05 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2012-01-29 15:36 . 2012-02-10 16:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-01-29 15:36 . 2012-02-10 17:32 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:54 . 2012-02-11 09:03 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-10 17:09 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-02-10 17:38 . 2012-02-10 17:38 27136 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{FA3A57C3-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-01-29 15:36 . 2012-02-10 19:05 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
- 2012-01-29 15:36 . 2012-02-10 17:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
+ 2010-11-21 03:09 . 2012-02-11 09:05 40928 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-11 09:05 32366 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-03-03 17:24 . 2012-02-11 08:26 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
- 2011-03-03 17:24 . 2012-01-02 10:23 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
+ 2009-07-14 05:30 . 2012-02-11 09:08 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-11-17 19:44 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-08-04 08:20 . 2011-08-04 08:20 38288 c:\windows\system32\DriverStore\FileRepository\epfwlwf.inf_amd64_neutral_97e5bc8a9df262cc\EpfwLWF.sys
+ 2011-08-04 08:20 . 2011-08-04 08:20 62496 c:\windows\system32\drivers\epfwwfp.sys
+ 2011-08-04 08:20 . 2011-08-04 08:20 38288 c:\windows\system32\drivers\EpfwLWF.sys
- 2011-02-24 21:59 . 2012-02-10 15:28 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 21:59 . 2012-02-11 09:08 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-24 21:59 . 2012-02-10 15:28 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-24 21:59 . 2012-02-11 09:08 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-10 15:28 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-11 09:08 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-25 19:09 . 2012-02-11 09:03 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-25 19:09 . 2012-02-10 17:10 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-11 09:03 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-25 19:09 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-25 19:09 . 2012-02-11 09:03 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-24 22:41 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-24 22:41 . 2012-02-11 09:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-24 22:41 . 2012-02-10 17:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-24 22:41 . 2012-02-11 09:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-02-11 09:07 . 2012-02-11 09:07 10134 c:\windows\Installer\{BA0C98EF-FDD6-423D-BFFD-57580DE283F0}\callmsi.exe
+ 2012-02-10 17:38 . 2012-02-10 17:38 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{FA3A57C2-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-09 20:06 . 2012-02-10 19:07 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
- 2012-02-09 20:06 . 2012-02-10 17:02 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{7D37BA70-5359-11E1-A295-0022159883DB}.dat
+ 2012-02-10 19:07 . 2012-02-10 19:07 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{6D6BA10D-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:45 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FFB3D686-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:49 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FE80C504-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:52 . 2012-02-10 17:56 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FE665851-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:49 . 2012-02-10 18:56 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F8FC6119-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:49 . 2012-02-10 18:53 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F7C6EE36-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:05 . 2012-02-10 18:05 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C617C6C5-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:40 . 2012-02-10 18:44 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C0270897-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:19 . 2012-02-10 18:24 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFD63762-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:33 . 2012-02-10 18:33 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BAA6C42F-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:29 . 2012-02-10 17:29 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA76534F-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:47 . 2012-02-10 18:47 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B70F84C2-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:40 . 2012-02-10 18:43 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B6497494-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:36 . 2012-02-10 17:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B627EBB1-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:28 . 2012-02-10 17:28 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B303A513-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:54 . 2012-02-10 19:00 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B2B5FEBA-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:01 . 2012-02-10 19:01 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AFCB0C9C-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:35 . 2012-02-10 17:41 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AEBA0036-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:57 . 2012-02-10 18:03 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9E39B2F-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:04 . 2012-02-10 18:08 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9C662C78-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:54 . 2012-02-10 18:54 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9B0009BF-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:01 . 2012-02-10 19:07 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{96A683B7-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:19 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E502DE2-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:49 . 2012-02-10 17:53 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E2FF9E7-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:19 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B5B384B-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:56 . 2012-02-10 17:59 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{89B2BF3A-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:18 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{885CBD33-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:17 . 2012-02-10 18:23 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{875D38DD-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:13 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{86132AAE-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:17 . 2012-02-10 18:23 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{82F6FFD0-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:20 . 2012-02-10 17:20 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{81B6672E-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:31 . 2012-02-10 18:36 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{81274255-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:27 . 2012-02-10 17:34 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D61A3E6-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:41 . 2012-02-10 17:41 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7B9EBAC2-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:24 . 2012-02-10 18:29 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A7F1718-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:34 . 2012-02-10 17:38 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7904F408-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:19 . 2012-02-10 17:25 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{708516D4-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:52 . 2012-02-10 18:57 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F001A2F-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:19 . 2012-02-10 17:25 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6EAB64FE-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:41 . 2012-02-10 17:47 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{68F2EF9C-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:45 . 2012-02-10 18:49 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{66A3A721-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:48 . 2012-02-10 17:48 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5FEFFD54-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:23 . 2012-02-10 18:23 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5CF52FEC-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:23 . 2012-02-10 18:30 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5BC9428A-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:55 . 2012-02-10 17:55 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5B9B3A0C-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:59 . 2012-02-10 19:04 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5B8816A9-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:30 . 2012-02-10 18:36 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{589938FF-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:02 . 2012-02-10 18:07 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5748D824-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:18 . 2012-02-10 17:24 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50D987EF-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:25 . 2012-02-10 17:25 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{475484CE-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:30 . 2012-02-10 18:30 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{41AB379D-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:05 . 2012-02-10 19:05 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{38B1507E-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:08 . 2012-02-10 18:15 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{36A64795-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:15 . 2012-02-10 18:20 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{324A5076-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:18 . 2012-02-10 17:24 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{32101BC4-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:36 . 2012-02-10 18:36 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{30712CDF-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:53 . 2012-02-10 17:53 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F7071B6-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:53 . 2012-02-10 17:53 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{288571EA-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:36 . 2012-02-10 18:40 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27DFFECB-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:24 . 2012-02-10 17:28 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2517FA1D-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:07 . 2012-02-10 18:11 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{24FC7B74-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:29 . 2012-02-10 18:29 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{24AAD3A6-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:00 . 2012-02-10 18:00 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{24298A82-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:57 . 2012-02-10 18:57 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1EDC23CD-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:04 . 2012-02-10 19:04 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1A876085-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:04 . 2012-02-10 19:04 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{156C8D0E-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:07 . 2012-02-10 18:07 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{14F34023-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:14 . 2012-02-10 18:19 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1097D595-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:31 . 2012-02-10 17:31 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0C6F6894-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:38 . 2012-02-10 17:38 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0819DCDD-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:24 . 2012-02-10 17:29 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0720070A-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:38 . 2012-02-10 17:38 3584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0409A386-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:14 . 2012-02-10 18:17 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{03E99CE7-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:52 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{03C40FDF-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:45 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FFB3D687-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:49 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FE80C505-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:52 . 2012-02-10 17:56 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FE665852-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:49 . 2012-02-10 18:56 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F8FC611A-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:49 . 2012-02-10 18:53 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F7C6EE37-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:05 . 2012-02-10 18:05 5632 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C617C6C6-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:40 . 2012-02-10 18:44 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C0270898-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:19 . 2012-02-10 18:24 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BFD63763-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:33 . 2012-02-10 18:33 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BAA6C430-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:29 . 2012-02-10 17:29 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BA765350-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:47 . 2012-02-10 18:47 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B70F84C3-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:40 . 2012-02-10 18:43 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B6497495-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:36 . 2012-02-10 17:41 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B627EBB2-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:28 . 2012-02-10 17:28 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B303A514-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:54 . 2012-02-10 19:00 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B2B5FEBB-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:01 . 2012-02-10 19:01 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AFCB0C9D-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:35 . 2012-02-10 17:41 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AEBA0037-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:57 . 2012-02-10 18:03 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A9E39B30-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:04 . 2012-02-10 18:08 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9C662C79-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:54 . 2012-02-10 18:54 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9B0009C0-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:01 . 2012-02-10 19:07 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{96A683B8-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:19 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8E502DE3-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:49 . 2012-02-10 17:53 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8E2FF9E8-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:19 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8B5B384C-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:56 . 2012-02-10 17:59 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{89B2BF3B-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:18 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{885CBD34-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:17 . 2012-02-10 18:23 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{875D38DE-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:13 . 2012-02-10 17:13 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{86132AAF-540A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:17 . 2012-02-10 18:23 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{82F6FFD1-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:20 . 2012-02-10 17:20 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{81B6672F-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:31 . 2012-02-10 18:36 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{81274256-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:27 . 2012-02-10 17:34 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D61A3E7-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:41 . 2012-02-10 17:41 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B9EBAC3-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:24 . 2012-02-10 18:29 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A7F1719-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:34 . 2012-02-10 17:38 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7904F409-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:19 . 2012-02-10 17:25 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{708516D5-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:52 . 2012-02-10 18:57 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6F001A30-5418-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:19 . 2012-02-10 17:25 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6EAB64FF-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:41 . 2012-02-10 17:47 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{68F2EF9D-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:45 . 2012-02-10 18:49 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{66A3A722-5417-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:48 . 2012-02-10 17:48 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5FEFFD55-540F-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:23 . 2012-02-10 18:24 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5CF52FED-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:23 . 2012-02-10 18:30 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5BC9428B-5414-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:55 . 2012-02-10 17:55 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5B9B3A0D-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:59 . 2012-02-10 19:04 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5B8816AA-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:30 . 2012-02-10 18:36 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{58993900-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:02 . 2012-02-10 18:07 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5748D825-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:18 . 2012-02-10 17:24 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{50D987F0-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:25 . 2012-02-10 17:25 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{475484CF-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:30 . 2012-02-10 18:30 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{41AB379E-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:05 . 2012-02-10 19:06 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{38B1507F-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:08 . 2012-02-10 18:15 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{36A64796-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:15 . 2012-02-10 18:20 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{324A5077-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:18 . 2012-02-10 17:24 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{32101BC5-540B-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:36 . 2012-02-10 18:36 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{30712CE0-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:53 . 2012-02-10 17:53 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F7071B7-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:53 . 2012-02-10 17:53 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{288571EB-5410-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:36 . 2012-02-10 18:40 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27DFFECC-5416-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:24 . 2012-02-10 17:28 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2517FA1E-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:07 . 2012-02-10 18:11 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{24FC7B75-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:29 . 2012-02-10 18:29 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{24AAD3A7-5415-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:00 . 2012-02-10 18:00 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{24298A83-5411-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:57 . 2012-02-10 18:57 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1EDC23CE-5419-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:04 . 2012-02-10 19:05 4608 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1A876086-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 19:04 . 2012-02-10 19:04 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{156C8D0F-541A-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:07 . 2012-02-10 18:07 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{14F34024-5412-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:14 . 2012-02-10 18:19 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1097D596-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:31 . 2012-02-10 17:31 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C6F6895-540D-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:38 . 2012-02-10 17:38 6144 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0819DCDE-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:24 . 2012-02-10 17:29 7168 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0720070B-540C-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:38 . 2012-02-10 17:38 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0409A387-540E-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 18:14 . 2012-02-10 18:17 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{03E99CE8-5413-11E1-AEDD-0022159883DB}.dat
+ 2012-02-10 17:45 . 2012-02-10 17:52 6656 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{03C40FE0-540F-11E1-AEDD-0022159883DB}.dat
+ 2011-02-24 22:17 . 2012-02-11 09:05 8460 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4117625595-3377170590-1022986480-1000_UserData.bin
- 2011-02-24 22:17 . 2012-02-10 15:11 8460 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4117625595-3377170590-1022986480-1000_UserData.bin
- 2012-02-10 17:09 . 2012-02-10 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-11 09:40 . 2012-02-11 09:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-11 09:40 . 2012-02-11 09:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-10 17:09 . 2012-02-10 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-11-21 03:24 . 2010-11-21 03:24 833024 c:\windows\SysWOW64\user32.dll
+ 2012-01-29 15:36 . 2012-02-10 19:05 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
- 2012-01-29 15:36 . 2012-02-10 17:01 171008 c:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\AskToolbar\cache.dat
+ 2012-02-10 14:22 . 2012-02-10 19:04 212992 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012021020120211\index.dat
+ 2009-07-14 05:30 . 2012-02-11 09:08 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-11-17 19:44 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-11-17 19:44 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2012-02-11 09:08 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-08-04 08:20 . 2011-08-04 08:20 187632 c:\windows\system32\drivers\epfw.sys
+ 2011-08-04 08:20 . 2011-08-04 08:20 146432 c:\windows\system32\drivers\ehdrv.sys
+ 2011-08-09 13:24 . 2011-08-09 13:24 202576 c:\windows\system32\drivers\eamonm.sys
+ 2009-07-14 05:12 . 2012-02-11 09:08 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:12 . 2012-02-08 22:49 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2012-02-10 17:08 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-02-11 09:40 254168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-02-11 09:07 . 2012-02-11 09:07 105624 c:\windows\Installer\{BA0C98EF-FDD6-423D-BFFD-57580DE283F0}\egui.exe
+ 2009-07-14 04:54 . 2012-02-11 09:03 1277952 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-11 09:03 2686976 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-24 23:27 . 2012-02-11 09:40 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
- 2011-02-24 23:27 . 2012-02-10 16:37 4097352 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4117625595-3377170590-1022986480-1000-12288.dat
+ 2012-02-11 09:00 . 2012-02-11 09:00 63605760 c:\windows\Installer\21e9a.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Steam"="c:\hry\Steam\steam.exe" [2011-08-02 1242448]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,38,3f,f2,76,49,1a,1d,4a,88,c9,b2,\
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:89,f9,ed,8d,13,6b,ca,ed,ce,2b,37,3c,dc,17,c6,16,e0,4d,f7,34,58,b3,37,
ea,35,db,12,2f,c7,a0,84,4a,c2,8c,e7,09,47,43,11,33,a0,db,1b,57,1c,b8,7b,c1,\
"??"=hex:40,b9,f6,74,c6,21,0f,76,20,31,c1,f5,1c,10,ea,71
.
[HKEY_USERS\S-1-5-21-4117625595-3377170590-1022986480-1000\Software\SecuROM\License information*]
"datasecu"=hex:51,1b,86,ff,8e,82,c0,ac,9c,61,51,46,bc,d9,a0,92,fa,1e,6d,6d,ac,
5e,3e,de,6c,fa,d5,73,d0,81,22,b9,3e,ed,40,cd,18,90,05,41,cd,77,5f,95,45,18,\
"rkeysecu"=hex:84,ff,9b,0c,9d,2f,d8,30,e2,8b,7d,55,7a,f3,fc,f4
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Celkový čas: 2012-02-11 10:44:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-11 09:44
ComboFix2.txt 2012-02-10 17:13
ComboFix3.txt 2012-02-10 16:43
ComboFix4.txt 2012-02-10 14:42
ComboFix5.txt 2012-02-11 09:34
.
Před spuštěním: Volných bajtů: 105 904 893 952
Po spuštění: Volných bajtů: 105 854 676 992
.
- - End Of File - - 902E10088FA0F5C5D36A23CAF54C73FC

[Rossi46]

OTL mi blbne, kdyz ho spustim tak scennuje a za dlouhou dobu mi vyskoci chyba "Cannot create file C:\Users\Pepos7\Desktop\cmd.bat" a program se sekne. Pomuze jen vypnout a zapnout OTL.. vyzkouseno 4x