špatně vygoogleno

Zpráva

#16 Příspěvek od **vyosek** » 25 čer 2012 09:41

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Pockejte na dokonceni PreScanu
Zvolte moznost Prohledat (scan)
Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte

had12 · #17 Příspěvek od **had12** » 25 čer 2012 11:29

RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Honza [Práva správce]
Mód: Kontrola -- Datum: 06/25/2012 12:28:17

¤¤¤ Škodlivé procesy: 0 ¤¤¤

¤¤¤ Záznamy Registrů: 8 ¤¤¤
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
127.0.0.1 localhost

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST9500420AS ATA Device +++++
--- User ---
[MBR] 91a3417c25630351f5add386dd7df8f2
[BSP] 7e9edc00906195a83ef317d8a16947c1 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 59900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 122882048 | Size: 416938 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: WD Elements 1023 USB Device +++++
--- User ---
[MBR] 691dc1116449eeb535b637dc581b3fb8
[BSP] 58bfbdede1811b9dfc5b354815058d53 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 476937 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Dokončeno : << RKreport[1].txt >>
RKreport[1].txt

#18 Příspěvek od **vyosek** » 25 čer 2012 13:36

Spustte znovu RogueKiller

Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Zvolte moznost Prohledat a pote Smazat a nasledne Zprava - otevre se log, ten sem vlozte

had12 · #19 Příspěvek od **had12** » 25 čer 2012 13:41

RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v: Normální režim
Uživatel: Honza [Práva správce]
Mód: Odebrat -- Datum: 06/25/2012 14:41:31

¤¤¤ Škodlivé procesy: 0 ¤¤¤

¤¤¤ Záznamy Registrů: 8 ¤¤¤
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač: [NENAHRÁNO] ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
127.0.0.1 localhost

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST9500420AS ATA Device +++++
--- User ---
[MBR] 91a3417c25630351f5add386dd7df8f2
[BSP] 7e9edc00906195a83ef317d8a16947c1 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 59900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 122882048 | Size: 416938 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: WD Elements 1023 USB Device +++++
--- User ---
[MBR] 691dc1116449eeb535b637dc581b3fb8
[BSP] 58bfbdede1811b9dfc5b354815058d53 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 476937 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Dokončeno : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

#20 Příspěvek od **vyosek** » 25 čer 2012 21:24

Spustte HJT a provedeme fixnuti polozek

HJT najdete zde C:\Program Files\trend micro\Honza.exe
Otevre se Vam okno, kliknete na Do a system scan only
V dalsim okne najdete radky které jsem Vam vypsal nize, vedle nich je ctverecek, do ktereho udelate zatrzitko
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F08FC2E-BA37-4DB3-B876-61B689BEC127}: NameServer = 192.168.97.1
Kliknete na Fix checked (vlevo dole)
HJT se Vas zepta zda opravdu ANO, s tim souhlasite a je hotovo

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Novy log z RSIT a napiste co PC

had12 · #21 Příspěvek od **had12** » 25 čer 2012 22:58

Logfile of random's system information tool 1.09 (written by random/random)
Run by Honza at 2012-06-25 23:51:11
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 18 GB (31%) free of 60 GB
Total RAM: 4007 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:51:15, on 25.6.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\server\apache\bin\ApacheMonitor.exe
C:\Program Files (x86)\winometer\winometer.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Honza.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKCU\..\Run: [chromium] C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window
O4 - Startup: winometer.lnk = C:\Program Files (x86)\winometer\winometer.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Monitor Apache Servers.lnk = C:\server\apache\bin\ApacheMonitor.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apache2.2 - Apache Software Foundation - C:\server\apache\bin\httpd.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Connectify - Unknown owner - C:\Program Files (x86)\Connectify\ConnectifyService.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HyperW7 Service (HyperW7Svc) - Lenovo Group Limited - C:\Program Files\Lenovo\RapidBoot\HyperW7Svc64.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\server\mysql\bin\mysqld (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10151 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-aa7fed87-2520-4b42-a555-ae451acb0804 -SystemEventPortName:HostProcess-fd1efa47-da0d-4970-bccc-1df8d48a797a -IoCancelEventPortName:HostProcess-7e3852c5-6819-41c5-89c9-ae770861db7a -NonStateChangingEventPortName:HostProcess-6e00be4c-907a-414a-8988-0f0680f303a8 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c17dc0e9-ff85-4166-b0a6-c6dc783e7f1c
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service
"C:\server\apache\bin\httpd.exe" -k runservice
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
"C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbguard.exe" -s DefaultInstance
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
"C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe"
"C:\server\mysql\bin\mysqld" --defaults-file="C:\server\mysql\my.ini" MySQL
C:\Windows\SysWOW64\SAsrv.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe"
"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe"
C:\Windows\SysWOW64\vmnat.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
"C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
taskeng.exe {CB233631-91C0-4D2A-B33B-B09413249219}
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
"C:\Windows\system32\Dwm.exe"
C:\server\apache\bin\httpd.exe -d C:/server/apache -f C:\server\apache\conf\httpd.conf -d C:\server\apache\.
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe"
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
"C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbserver.exe" -s DefaultInstance
"C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\Version7\TeamViewer7_Logfile.log
"C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\Version7\TeamViewer7_Logfile.log
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window
"C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe"
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ComodoDNSExperiment/inactive/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/IdleSktToImpact/idle_timeout_10/Instant/Hidden/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/16/Prerender/ContentPrefetchPrerender1/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/WebStoreLinkExperiment/FooterLink/ --extension-process --renderer-print-preview --channel="2640.0.1641760354\1603769639" /prefetch:3
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ComodoDNSExperiment/inactive/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/Hidden/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/16/Prerender/ContentPrefetchPrerender1/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/WebStoreLinkExperiment/FooterLink/ --extension-process --renderer-print-preview --channel="2640.1.790733237\1003487888" /prefetch:3
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ComodoDNSExperiment/inactive/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/Hidden/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/16/Prerender/ContentPrefetchPrerender1/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/WebStoreLinkExperiment/FooterLink/ --extension-process --renderer-print-preview --channel="2640.2.527132257\2052691830" /prefetch:3
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\server\apache\bin\ApacheMonitor.exe"
"C:\Program Files (x86)\winometer\winometer.exe"
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="2640.3.251231992\414799965" /prefetch:12
"C:\Windows\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ComodoDNSExperiment/inactive/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/Hidden/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/16/PepperFlash/DisableByDefault/Prerender/ContentPrefetchPrerender1/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwnd10/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/WebStoreLinkExperiment/FooterLink/ --renderer-print-preview --channel="2640.5.1313264932\1232949298" /prefetch:3
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"D:\Plocha\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4163163076-1683261631-2132254409-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4163163076-1683261631-2132254409-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Honza\AppData\Roaming\Mozilla\Firefox\Profiles\z7q4kjm7.default

prefs.js - "browser.startup.homepage" - "http://veka.signaly.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\npctrl.1.0.20926.0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
flashplayer.xpt
nsIQTScriptablePlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
GetFlash.exe
GetFlash.exe.manifest
np-mswmp.dll
np32dsw.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
NPSWF32.dll
QuickTimePlugin.class
ShockwavePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
wikipedia-cz.xml

C:\Users\Honza\AppData\Roaming\Mozilla\Firefox\Profiles\z7q4kjm7.default\extensions\
centrumpomocnik@centrum.cz
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-09-15 42272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-05-05 2785064]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-09-14 168216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-09-14 392472]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-09-14 416024]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2011-05-31 40808]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2011-04-26 310912]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"mail"=akfak.naj@seznam.cz []
"smtp"= []
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-09-22 4035152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"chromium"=C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe [2012-06-07 1239576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connectify]
C:\Program Files (x86)\Connectify\Connectify.exe [2011-12-01 3073864]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"RotateImage"=C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [2008-10-30 55808]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2011-09-27 59240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Monitor Apache Servers.lnk - C:\server\apache\bin\ApacheMonitor.exe

C:\Users\Honza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
winometer.lnk - C:\Program Files (x86)\winometer\winometer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-09-14 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-10-10 249344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - C:\Windows\NOTEPAD.EXE %1

======List of files/folders created in the last 1 month======

2012-06-25 23:51:11 ----D---- C:\rsit
2012-06-24 16:15:32 ----A---- C:\Windows\system32\wups2.dll
2012-06-24 16:15:32 ----A---- C:\Windows\system32\wuauclt.exe
2012-06-24 16:15:31 ----A---- C:\Windows\system32\wucltux.dll
2012-06-24 16:15:31 ----A---- C:\Windows\system32\wuaueng.dll
2012-06-24 16:15:20 ----A---- C:\Windows\system32\wups.dll
2012-06-24 16:15:20 ----A---- C:\Windows\system32\wudriver.dll
2012-06-24 16:15:20 ----A---- C:\Windows\system32\wuapi.dll
2012-06-24 16:14:59 ----A---- C:\Windows\system32\wuwebv.dll
2012-06-24 16:14:59 ----A---- C:\Windows\system32\wuapp.exe
2012-06-23 17:56:23 ----D---- C:\Users\Honza\AppData\Roaming\avidemux
2012-06-23 17:56:15 ----D---- C:\Program Files (x86)\Avidemux 2.5
2012-06-22 22:38:28 ----SHD---- C:\$RECYCLE.BIN
2012-06-22 15:33:51 ----D---- C:\ProgramData\Kaspersky Lab
2012-06-22 13:43:53 ----D---- C:\Program Files\trend micro
2012-06-19 13:41:49 ----A---- C:\Windows\SYSWOW64\XAudio2_7.dll
2012-06-19 13:41:49 ----A---- C:\Windows\SYSWOW64\XAPOFX1_5.dll
2012-06-19 13:41:49 ----A---- C:\Windows\SYSWOW64\xactengine3_7.dll
2012-06-19 13:41:49 ----A---- C:\Windows\system32\XAudio2_7.dll
2012-06-19 13:41:49 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2012-06-19 13:41:49 ----A---- C:\Windows\system32\xactengine3_7.dll
2012-06-19 13:41:48 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2012-06-19 13:41:48 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\SYSWOW64\d3dx11_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\SYSWOW64\d3dx10_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\SYSWOW64\d3dcsx_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\system32\D3DX9_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\system32\d3dx11_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\system32\d3dx10_43.dll
2012-06-19 13:41:47 ----A---- C:\Windows\system32\d3dcsx_43.dll
2012-06-19 13:41:46 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2012-06-19 13:41:46 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2012-06-19 13:41:46 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2012-06-19 13:41:46 ----A---- C:\Windows\system32\XAudio2_6.dll
2012-06-19 13:41:46 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2012-06-19 13:41:46 ----A---- C:\Windows\system32\xactengine3_6.dll
2012-06-19 13:41:45 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2012-06-19 13:41:45 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2012-06-19 13:41:45 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2012-06-19 13:41:45 ----A---- C:\Windows\system32\XAudio2_5.dll
2012-06-19 13:41:45 ----A---- C:\Windows\system32\xactengine3_5.dll
2012-06-19 13:41:45 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2012-06-19 13:41:44 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2012-06-19 13:41:44 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2012-06-19 13:41:44 ----A---- C:\Windows\system32\d3dcsx_42.dll
2012-06-19 13:41:44 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\system32\D3DX9_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\system32\d3dx11_42.dll
2012-06-19 13:41:43 ----A---- C:\Windows\system32\d3dx10_42.dll
2012-06-19 13:41:42 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2012-06-19 13:41:42 ----A---- C:\Windows\SYSWOW64\d3dx10_41.dll
2012-06-19 13:41:42 ----A---- C:\Windows\SYSWOW64\D3DCompiler_41.dll
2012-06-19 13:41:42 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2012-06-19 13:41:42 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-06-19 13:41:42 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-06-19 13:41:41 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2012-06-19 13:41:41 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2012-06-19 13:41:41 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2012-06-19 13:41:41 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2012-06-19 13:41:41 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2012-06-19 13:41:41 ----A---- C:\Windows\system32\XAudio2_4.dll
2012-06-19 13:41:41 ----A---- C:\Windows\system32\xactengine3_4.dll
2012-06-19 13:41:41 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2012-06-19 13:41:41 ----A---- C:\Windows\system32\d3dx10_40.dll
2012-06-19 13:41:41 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2012-06-19 13:41:40 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2012-06-19 13:41:40 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2012-06-19 13:41:40 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2012-06-19 13:41:40 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2012-06-19 13:41:40 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2012-06-19 13:41:40 ----A---- C:\Windows\system32\XAudio2_3.dll
2012-06-19 13:41:40 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2012-06-19 13:41:40 ----A---- C:\Windows\system32\xactengine3_3.dll
2012-06-19 13:41:40 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2012-06-19 13:41:40 ----A---- C:\Windows\system32\D3DX9_40.dll
2012-06-19 13:41:39 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2012-06-19 13:41:39 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2012-06-19 13:41:39 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2012-06-19 13:41:39 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2012-06-19 13:41:39 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2012-06-19 13:41:39 ----A---- C:\Windows\system32\XAudio2_2.dll
2012-06-19 13:41:39 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2012-06-19 13:41:39 ----A---- C:\Windows\system32\xactengine3_2.dll
2012-06-19 13:41:39 ----A---- C:\Windows\system32\d3dx10_39.dll
2012-06-19 13:41:39 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2012-06-19 13:41:38 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2012-06-19 13:41:38 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2012-06-19 13:41:38 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2012-06-19 13:41:38 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2012-06-19 13:41:38 ----A---- C:\Windows\system32\XAudio2_1.dll
2012-06-19 13:41:38 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2012-06-19 13:41:38 ----A---- C:\Windows\system32\xactengine3_1.dll
2012-06-19 13:41:38 ----A---- C:\Windows\system32\D3DX9_39.dll
2012-06-19 13:41:37 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2012-06-19 13:41:37 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2012-06-19 13:41:37 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2012-06-19 13:41:37 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2012-06-19 13:41:37 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2012-06-19 13:41:37 ----A---- C:\Windows\system32\D3DX9_38.dll
2012-06-19 13:41:37 ----A---- C:\Windows\system32\d3dx10_38.dll
2012-06-19 13:41:37 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2012-06-19 13:41:36 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2012-06-19 13:41:36 ----A---- C:\Windows\system32\XAudio2_0.dll
2012-06-19 13:41:35 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2012-06-19 13:41:35 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2012-06-19 13:41:35 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2012-06-19 13:41:35 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2012-06-19 13:41:35 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2012-06-19 13:41:35 ----A---- C:\Windows\system32\xactengine3_0.dll
2012-06-19 13:41:35 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2012-06-19 13:41:35 ----A---- C:\Windows\system32\D3DX9_37.dll
2012-06-19 13:41:35 ----A---- C:\Windows\system32\d3dx10_37.dll
2012-06-19 13:41:35 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2012-06-19 13:41:34 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2012-06-19 13:41:34 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2012-06-19 13:41:34 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2012-06-19 13:41:34 ----A---- C:\Windows\system32\xactengine2_10.dll
2012-06-19 13:41:34 ----A---- C:\Windows\system32\d3dx10_36.dll
2012-06-19 13:41:34 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2012-06-19 13:41:33 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2012-06-19 13:41:33 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2012-06-19 13:41:33 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2012-06-19 13:41:33 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2012-06-19 13:41:33 ----A---- C:\Windows\system32\xactengine2_9.dll
2012-06-19 13:41:33 ----A---- C:\Windows\system32\d3dx9_36.dll
2012-06-19 13:41:33 ----A---- C:\Windows\system32\d3dx10_35.dll
2012-06-19 13:41:33 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2012-06-19 13:41:32 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2012-06-19 13:41:32 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2012-06-19 13:41:32 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2012-06-19 13:41:32 ----A---- C:\Windows\system32\xactengine2_8.dll
2012-06-19 13:41:32 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2012-06-19 13:41:32 ----A---- C:\Windows\system32\d3dx9_35.dll
2012-06-19 13:41:31 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2012-06-19 13:41:31 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2012-06-19 13:41:31 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2012-06-19 13:41:31 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2012-06-19 13:41:31 ----A---- C:\Windows\system32\xinput1_3.dll
2012-06-19 13:41:31 ----A---- C:\Windows\system32\d3dx9_34.dll
2012-06-19 13:41:31 ----A---- C:\Windows\system32\d3dx10_34.dll
2012-06-19 13:41:31 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2012-06-19 13:41:30 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2012-06-19 13:41:30 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2012-06-19 13:41:30 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2012-06-19 13:41:30 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2012-06-19 13:41:30 ----A---- C:\Windows\system32\xactengine2_7.dll
2012-06-19 13:41:30 ----A---- C:\Windows\system32\d3dx9_33.dll
2012-06-19 13:41:30 ----A---- C:\Windows\system32\d3dx10_33.dll
2012-06-19 13:41:30 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2012-06-19 13:41:29 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2012-06-19 13:41:29 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2012-06-19 13:41:29 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2012-06-19 13:41:29 ----A---- C:\Windows\system32\xactengine2_6.dll
2012-06-19 13:41:29 ----A---- C:\Windows\system32\xactengine2_5.dll
2012-06-19 13:41:29 ----A---- C:\Windows\system32\d3dx10.dll
2012-06-19 13:41:28 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2012-06-19 13:41:28 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2012-06-19 13:41:28 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2012-06-19 13:41:28 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2012-06-19 13:41:28 ----A---- C:\Windows\system32\xactengine2_4.dll
2012-06-19 13:41:28 ----A---- C:\Windows\system32\x3daudio1_1.dll
2012-06-19 13:41:28 ----A---- C:\Windows\system32\d3dx9_32.dll
2012-06-19 13:41:28 ----A---- C:\Windows\system32\d3dx9_31.dll
2012-06-19 13:41:27 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2012-06-19 13:41:27 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2012-06-19 13:41:27 ----A---- C:\Windows\system32\xinput1_2.dll
2012-06-19 13:41:27 ----A---- C:\Windows\system32\xactengine2_3.dll
2012-06-19 13:41:25 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2012-06-19 13:41:25 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2012-06-19 13:41:25 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2012-06-19 13:41:25 ----A---- C:\Windows\system32\xinput1_1.dll
2012-06-19 13:41:25 ----A---- C:\Windows\system32\xactengine2_2.dll
2012-06-19 13:41:25 ----A---- C:\Windows\system32\xactengine2_1.dll
2012-06-19 13:41:22 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2012-06-19 13:41:22 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2012-06-19 13:41:22 ----A---- C:\Windows\system32\xactengine2_0.dll
2012-06-19 13:41:22 ----A---- C:\Windows\system32\x3daudio1_0.dll
2012-06-19 13:41:22 ----A---- C:\Windows\system32\d3dx9_30.dll
2012-06-19 13:41:21 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2012-06-19 13:41:21 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2012-06-19 13:41:21 ----A---- C:\Windows\system32\d3dx9_29.dll
2012-06-19 13:41:21 ----A---- C:\Windows\system32\d3dx9_28.dll
2012-06-19 13:41:21 ----A---- C:\Windows\system32\d3dx9_27.dll
2012-06-19 13:41:20 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2012-06-19 13:41:20 ----A---- C:\Windows\system32\d3dx9_26.dll
2012-06-19 13:41:19 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2012-06-19 13:41:19 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2012-06-19 13:41:19 ----A---- C:\Windows\system32\d3dx9_25.dll
2012-06-19 13:41:19 ----A---- C:\Windows\system32\d3dx9_24.dll
2012-06-19 13:37:46 ----D---- C:\Windows\SYSWOW64\directx
2012-06-19 13:37:22 ----D---- C:\Users\Honza\AppData\Roaming\Media Player Classic
2012-06-19 13:37:07 ----A---- C:\Windows\system32\unrar64.dll
2012-06-19 13:37:05 ----D---- C:\Program Files\MediaPlayerClassic
2012-06-17 13:12:13 ----D---- C:\Program Files (x86)\CDCheck
2012-06-16 09:49:44 ----D---- C:\Program Files (x86)\D_back
2012-06-14 08:13:00 ----D---- C:\Users\Honza\AppData\Roaming\Apple Computer
2012-06-13 17:17:08 ----D---- C:\ProgramData\Apple Computer
2012-06-13 17:17:08 ----D---- C:\Program Files (x86)\QuickTime
2012-06-13 17:16:05 ----D---- C:\ProgramData\Apple
2012-06-13 17:16:05 ----D---- C:\Program Files (x86)\Apple Software Update
2012-06-08 12:53:57 ----D---- C:\Program Files (x86)\Resource Hacker
2012-06-05 11:58:43 ----D---- C:\ProgramData\SecTaskMan
2012-06-05 10:59:34 ----D---- C:\Program Files (x86)\BHODemon 2

======List of files/folders modified in the last 1 month======

2012-06-25 23:51:16 ----D---- C:\Windows\Prefetch
2012-06-25 23:50:30 ----D---- C:\Windows
2012-06-25 23:50:24 ----D---- C:\Windows\Temp
2012-06-25 23:50:24 ----A---- C:\Windows\SYSWOW64\log.txt
2012-06-25 23:48:10 ----D---- C:\ProgramData\VMware
2012-06-25 23:45:55 ----D---- C:\Windows\System32
2012-06-25 23:45:55 ----D---- C:\Windows\inf
2012-06-25 23:45:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-06-25 23:42:38 ----D---- C:\Windows\system32\catroot2
2012-06-25 23:41:40 ----D---- C:\Windows\winsxs
2012-06-25 23:41:08 ----D---- C:\Windows\system32\config
2012-06-25 23:40:51 ----D---- C:\Windows\system32\cs-CZ
2012-06-25 23:38:01 ----D---- C:\Users\Honza\AppData\Roaming\Wireshark
2012-06-25 23:35:52 ----SHD---- C:\System Volume Information
2012-06-25 23:33:26 ----D---- C:\Windows\system32\drivers
2012-06-25 23:26:04 ----D---- C:\Users\Honza\AppData\Roaming\vlc
2012-06-25 21:53:13 ----D---- C:\Users\Honza\AppData\Roaming\foobar2000
2012-06-25 09:14:22 ----D---- C:\Users\Honza\AppData\Roaming\VMware
2012-06-24 20:15:58 ----D---- C:\Windows\rescache
2012-06-24 16:15:38 ----D---- C:\Windows\system32\catroot
2012-06-24 16:10:54 ----D---- C:\Windows\Tasks
2012-06-24 16:10:54 ----D---- C:\Windows\system32\wfp
2012-06-24 16:10:53 ----D---- C:\Windows\system32\wbem
2012-06-24 16:10:10 ----D---- C:\Windows\SYSWOW64\cs-CZ
2012-06-24 16:10:10 ----D---- C:\Windows\SysWOW64
2012-06-24 16:10:10 ----D---- C:\Windows\system32\DriverStore
2012-06-24 16:10:08 ----D---- C:\Windows\system32\NDF
2012-06-24 16:10:08 ----D---- C:\Windows\system32\drivers\etc
2012-06-24 16:10:08 ----D---- C:\Windows\system32\CodeIntegrity
2012-06-24 16:10:06 ----D---- C:\Windows\AppCompat
2012-06-24 16:10:06 ----D---- C:\Users\Honza\AppData\Roaming\PSpad
2012-06-24 16:10:06 ----D---- C:\Users\Honza\AppData\Roaming\GHISLER
2012-06-24 16:10:06 ----D---- C:\Users\Honza\AppData\Roaming\Audacity
2012-06-24 16:10:05 ----RD---- C:\Program Files (x86)
2012-06-24 16:10:05 ----D---- C:\Program Files (x86)\PSPad editor
2012-06-24 16:10:02 ----D---- C:\Windows\registration
2012-06-24 16:09:35 ----RD---- C:\Users
2012-06-24 16:09:34 ----RD---- C:\Program Files
2012-06-24 16:09:34 ----D---- C:\ProgramData\MySQL
2012-06-24 16:09:34 ----D---- C:\ProgramData
2012-06-22 21:26:31 ----A---- C:\Windows\system.ini
2012-06-22 21:10:15 ----D---- C:\Windows\SYSWOW64\drivers
2012-06-22 21:10:15 ----D---- C:\Windows\AppPatch
2012-06-22 21:10:12 ----D---- C:\Program Files\Common Files
2012-06-22 21:10:12 ----D---- C:\Program Files (x86)\Common Files
2012-06-19 14:09:37 ----D---- C:\Users\Honza\AppData\Roaming\dvdcss
2012-06-19 14:08:49 ----D---- C:\Users\Honza\AppData\Roaming\Ahead
2012-06-19 13:41:25 ----RSD---- C:\Windows\assembly
2012-06-19 13:41:16 ----D---- C:\Windows\Microsoft.NET
2012-06-19 13:37:46 ----D---- C:\Temp
2012-06-19 12:26:47 ----D---- C:\Program Files (x86)\VideoLAN
2012-06-16 09:51:53 ----SHD---- C:\Windows\Installer
2012-06-13 17:17:28 ----D---- C:\Program Files (x86)\Internet Explorer
2012-06-09 00:00:31 ----D---- C:\Windows\Logs
2012-06-06 23:13:13 ----D---- C:\WORDS
2012-05-28 09:16:45 ----D---- C:\Program Files (x86)\Connectify

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 cnnctfy2;Connectify LightWeight Filter; C:\Windows\system32\DRIVERS\cnnctfy2.sys [2012-01-01 31344]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-11-28 279616]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2010-09-07 15472]
R1 PHCORE;PHCORE; \??\C:\Program Files\Lenovo\RapidBoot\PHCORE64.SYS [2010-12-03 31592]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2012-04-30 231376]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 137144]
R2 hcmon;VMware hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [2010-09-21 38448]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35344]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R2 vmci;VMware vmci; \??\C:\Windows\system32\drivers\vmci.sys [2010-09-21 80944]
R2 VMnetBridge;VMware Bridge Protocol; C:\Windows\system32\DRIVERS\vmnetbridge.sys [2010-09-21 45104]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\Windows\system32\drivers\vmnetuserif.sys [2010-09-21 30256]
R2 vmx86;VMware vmx86; \??\C:\Windows\system32\drivers\vmx86.sys [2010-09-21 68656]
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [2010-08-19 32816]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-03-24 1576064]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2011-02-01 39024]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-09-14 12223936]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-09-14 317440]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 NETw5s64;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-05-05 1439792]
R3 vmkbd;VMware kbd; \??\C:\Windows\system32\drivers\VMkbd.sys [2010-09-21 31792]
R3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 BTWAMPFL;btwampfl; C:\Windows\system32\DRIVERS\btwampfl.sys [2011-04-30 437288]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2011-07-12 146984]
S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\DRIVERS\btwavdt.sys [2011-07-12 164392]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-02-22 39976]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2011-07-12 21544]
S3 NETwNs64;___ Ovladač adaptéru řady Intel(R) Wireless WiFi Link 5000 pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwNs64.sys [2010-12-21 8505856]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver; \??\C:\Windows\syswow64\NSNDIS5.SYS []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys [2010-09-21 20016]
S3 vmusb;VMware USB Client Driver; C:\Windows\System32\Drivers\vmusb.sys [2010-09-21 37680]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 wdkmd;Intel WiDi KMD; C:\Windows\system32\DRIVERS\WDKMD.sys [2011-04-08 42392]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2009-02-16 660768]
R2 Apache2.2;Apache2.2; C:\server\apache\bin\httpd.exe [2008-01-18 24635]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2011-07-27 970016]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbguard.exe [2011-02-01 81920]
R2 IBMPMSVC;ThinkPad PM Service; C:\Windows\system32\ibmpmsvc.exe [2011-02-01 45928]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2011-05-31 41320]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2011-04-04 45496]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-05-31 59240]
R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-02-22 326168]
R2 MySQL;MySQL; C:\server\mysql\bin\mysqld --defaults-file=C:\server\mysql\my.ini MySQL []
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 TeamViewer7;TeamViewer 7; C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-04-20 144232]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2011-03-29 64952]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-22 2656280]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe [2010-09-21 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\Windows\syswow64\vmnetdhcp.exe [2010-09-21 334384]
R2 VMUSBArbService;VMware USB Arbitration Service; C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
R2 VMware NAT Service;VMware NAT Service; C:\Windows\syswow64\vmnat.exe [2010-09-21 404016]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files (x86)\Firebird\Firebird_2_1\bin\fbserver.exe [2011-02-01 2764800]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Connectify;Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [2011-12-01 69632]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-22 136176]
S2 HyperW7Svc;HyperW7 Service; C:\Program Files\Lenovo\RapidBoot\HyperW7Svc64.exe [2010-12-03 116072]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-22 136176]
S3 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2010-06-25 117264]
S3 ufad-ws60;VMware Agent Service; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [2010-08-19 191024]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-10-10 1255736]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [2007-11-07 4466688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

#22 Příspěvek od **vyosek** » 25 čer 2012 23:11

Otevrete si poznamkovy blok

Start->spustit->notepad
Vlozte text nize

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"mail"=-
"smtp"=-

Soubor ulozte jako oprava.reg
Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
Zavrit notepad a spustit dvojklikem oprava.reg
Pripadny dotaz na zmenu registru potvrdte
Okno jen problikne a opravi regsitry - soubor muzete smazat

Rucne smazte tyto soubory

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4163163076-1683261631-2132254409-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4163163076-1683261631-2132254409-1000UA.job

Jinak log vypada OK

had12 · #23 Příspěvek od **had12** » 25 čer 2012 23:16

po přejmenování Combofixu na Uninstall se sama od sebe vytvořila taková "složka" na ploše s uživatelským jménem Honza. Vypadá to jako zástupce na profil uživatele, ale není to "nic" => umožňuje akorát otevřít, vytvořit zástupce, kopírovat a odstranit (položky v menu pravého myšítka). Nic jako vlastnosti tam není a hodně mě to znepokojuje (samozřejmě, že jsem to neotvíral).
Žádná taková položka neexistuje při zobrazení složky plocha v total commanderu, ani přes tento počítač...

existuje C:/Recovery, kam nemám přístup a kterou jsem nevytvářel - vytváří to nějakej čistící program?

další složky, které jsem nevytvářel: D:/$RECYCLE.BIN/, F:/$RECYCLE.BIN/, F:/RECYCLER/, F:/autorun. Disk F je externí HDD, většinou připojený.

při zasunutí další fleshky se mi přiřazuje písmenko I, místo H, na který to připojovalo celý léta. Chápal bych, kdyby tam na H sedělo něco jinýho, ale to písmenko je nevyužitý.

zatím díky za pomoc i za čas, který tomu věnuješ...

#24 Příspěvek od **vyosek** » 25 čer 2012 23:25

Zkuste pouzit jeste tohle http://download.bleepingcomputer.com/sUBs/CF_UNINST.EXE

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

had12 · #25 Příspěvek od **had12** » 25 čer 2012 23:55

############################## | UsbFix 7.059 | [Deletion]

User: Honza (Administrator) # HAD [ ]
Updated 16/09/2011 by El Desaparecido
Started at 00:30:01 | 26/06/2012
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
CPU 2: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
Microsoft Windows 7 Home Premium (6.1.7601 64-Bit) # Service Pack 1
Internet Explorer 9.0.8112.16421

Windows Firewall: Enabled
RAM -> 4007 Mb
C:\ (%systemdrive%) -> Fixed drive # 58 Gb (18 Mb free - 31%) [system] # NTFS
D:\ -> Fixed drive # 407 Gb (345 Mb free - 85%) [data] # NTFS
E:\ -> CD-ROM
F:\ -> Fixed drive # 466 Gb (23 Mb free - 5%) [Hadův exterák] # NTFS
G:\ -> CD-ROM
H:\ -> Removable drive # 8 Gb (7 Mb free - 99%) [] # NTFS
I:\ -> Removable drive # 4 Gb (3 Mb free - 93%) [HAD] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\Users\Honza\AppData\Local\Temp\Done.vbs
Deleted ! C:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-20
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! F:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! F:\Recycler\S-1-5-21-1078081533-1409082233-725345543-1003
Deleted ! F:\Recycler\S-1-5-21-117609710-1563985344-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-117609710-1580436667-1708537768-1004
Deleted ! F:\Recycler\S-1-5-21-1229272821-1383384898-725345543-500
Deleted ! F:\Recycler\S-1-5-21-1801674531-725345543-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-1844237615-1450960922-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-300071691-2139591398-643669466-1005
Deleted ! F:\Recycler\S-1-5-21-3467891718-768066622-507647255-2241
Deleted ! F:\Recycler\S-1-5-21-3713795169-2005671613-1543313341-1005
Deleted ! F:\Recycler\S-1-5-21-527237240-413027322-1177238915-1003
Deleted ! I:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665

(!) Temporary files deleted.

################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives

################## | Mountpoints2 |

################## | Listing |

[26/06/2012 - 00:32:01 | SHD ] C:\$RECYCLE.BIN
[19/03/2012 - 18:18:33 | N | 1024] C:\.rnd
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[18/09/2011 - 19:51:09 | D ] C:\DRIVERS
[25/06/2012 - 23:47:56 | ASH | 3151417344] C:\hiberfil.sys
[14/09/2011 - 21:52:45 | D ] C:\Intel
[25/06/2012 - 23:48:00 | ASH | 4201889792] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[24/06/2012 - 16:09:34 | D ] C:\Program Files
[24/06/2012 - 16:10:05 | D ] C:\Program Files (x86)
[24/06/2012 - 16:09:34 | D ] C:\ProgramData
[14/09/2011 - 21:01:41 | D ] C:\Recovery
[25/06/2012 - 23:51:18 | D ] C:\rsit
[15/09/2011 - 23:28:48 | D ] C:\server
[15/09/2011 - 12:06:48 | D ] C:\swtools
[25/06/2012 - 23:35:52 | SHD ] C:\System Volume Information
[19/06/2012 - 13:37:46 | D ] C:\Temp
[19/10/2011 - 10:11:01 | D ] C:\totalcmd
[26/06/2012 - 00:32:01 | D ] C:\UsbFix
[26/06/2012 - 00:30:01 | A | 3348] C:\UsbFix.txt
[24/06/2012 - 16:09:35 | D ] C:\Users
[15/09/2011 - 17:04:01 | D ] C:\wifi
[25/06/2012 - 23:50:30 | D ] C:\Windows
[06/06/2012 - 23:13:13 | D ] C:\WORDS
[26/06/2012 - 00:32:01 | D ] D:\$RECYCLE.BIN
[09/03/2012 - 14:44:36 | D ] D:\.pdfsam
[17/04/2012 - 11:12:35 | N | 48128] D:\cenik-zahradni-architektura-a-doplnky.xls
[24/05/2012 - 15:39:07 | D ] D:\Dokumenty
[26/06/2012 - 00:29:25 | D ] D:\Download
[01/03/2012 - 12:37:06 | D ] D:\downloads_prebrat
[28/11/2011 - 20:53:33 | D ] D:\Filmy
[17/04/2012 - 10:56:04 | N | 2143605] D:\katalog-zahradni-architektura-a-doplnky.pdf
[23/11/2011 - 11:57:00 | RD ] D:\MSOCache
[13/03/2012 - 23:59:35 | N | 235654] D:\Mysticka teologie_vypisky_new.rtf
[26/06/2012 - 00:29:25 | D ] D:\Plocha
[25/04/2012 - 16:26:50 | N | 138860] D:\SKMBT_22312042516231.pdf
[25/06/2012 - 23:35:52 | SHD ] D:\System Volume Information
[26/06/2012 - 00:32:01 | D ] F:\$RECYCLE.BIN
[17/11/2011 - 15:04:34 | D ] F:\--misie
[24/06/2012 - 16:10:02 | D ] F:\autorun
[02/05/2012 - 21:27:38 | D ] F:\Dokumenty
[13/06/2012 - 16:48:32 | D ] F:\Filmy
[01/01/2012 - 22:29:31 | D ] F:\Fotky
[09/06/2012 - 22:22:28 | D ] F:\Hudba
[17/06/2012 - 16:34:14 | D ] F:\Instalačky
[19/08/2010 - 12:08:08 | N | 157859] F:\localhost.sql
[09/06/2012 - 22:32:53 | D ] F:\Noty
[14/11/2011 - 15:01:52 | D ] F:\programy
[30/04/2011 - 18:57:49 | D ] F:\Přednášky
[26/06/2012 - 00:32:00 | D ] F:\RECYCLER
[11/02/2012 - 13:09:25 | D ] F:\Seriály
[24/06/2012 - 16:08:42 | D ] F:\server
[07/05/2004 - 16:47:24 | N | 1311232] F:\slovníček-šlesinger.doc
[25/06/2012 - 23:35:52 | SHD ] F:\System Volume Information
[12/12/2010 - 19:32:17 | SH | 7168] F:\Thumbs.db
[17/08/2010 - 21:57:23 | N | 12288] F:\total_commander.exe
[14/09/2011 - 20:16:29 | D ] F:\zaloha-notebook
[03/10/2011 - 14:25:45 | D ] F:\__z_konviktu_prebrat
[23/06/2012 - 23:17:39 | D ] H:\kalendar
[16/06/2012 - 17:58:40 | D ] H:\misalek
[16/06/2012 - 09:58:00 | D ] H:\misalek-original
[23/06/2012 - 21:49:22 | N | 16188] I:\ComboFix.txt
[24/06/2012 - 15:43:40 | N | 34628832] I:\7zw406ww.exe
[15/03/2012 - 20:39:12 | N | 21504] I:\proglas-nespory.doc
[04/06/2012 - 21:21:16 | D ] I:\logy
[09/03/2012 - 16:45:28 | N | 425] I:\winamp_metadata.dat
[09/03/2012 - 16:45:28 | N | 52] I:\winamp_metadata.idx
[24/03/2012 - 13:44:50 | N | 24064] I:\křížová cesta rokole..doc
[19/04/2012 - 10:08:22 | D ] I:\zeitgeist
[22/04/2012 - 20:36:48 | D ] I:\odvirovani
[16/05/2012 - 09:54:26 | N | 32768] I:\kalendar-tt.xls
[16/05/2012 - 18:05:26 | N | 32768] I:\historicko-kriticka-metoda-pismo.doc
[01/10/2011 - 18:28:58 | N | 39395] I:\rozvrh.pdf
[01/10/2011 - 18:31:28 | RSHD ] I:\RECYCLER
[09/01/2012 - 21:15:22 | N | 40960] I:\kafka-jan-recenze-vlkova-slovo-bozi-a-slovo-lidske.doc
[06/12/2011 - 17:07:24 | N | 89600] I:\řecké báje a pověsti.doc
[09/03/2012 - 15:47:34 | N | 2089740] I:\WLAN_Atheros_PNP_Win7_64_Z920458.zip
[09/03/2012 - 15:48:50 | N | 54669316] I:\WiFi_Intel_WifiFamily_Win7_64_Z14113.zip

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
F:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
I:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_HAD.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |

Omlouvám se, zapomněl jsem připojit ještě mobil (OS Android 2.1), který jsem asi předevčírem připojoval přes usb... takže jsem provedl znova...

############################## | UsbFix 7.059 | [Deletion]

User: Honza (Administrator) # HAD [ ]
Updated 16/09/2011 by El Desaparecido
Started at 00:30:01 | 26/06/2012
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
CPU 2: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
Microsoft Windows 7 Home Premium (6.1.7601 64-Bit) # Service Pack 1
Internet Explorer 9.0.8112.16421

Windows Firewall: Enabled
RAM -> 4007 Mb
C:\ (%systemdrive%) -> Fixed drive # 58 Gb (18 Mb free - 31%) [system] # NTFS
D:\ -> Fixed drive # 407 Gb (345 Mb free - 85%) [data] # NTFS
E:\ -> CD-ROM
F:\ -> Fixed drive # 466 Gb (23 Mb free - 5%) [Hadův exterák] # NTFS
G:\ -> CD-ROM
H:\ -> Removable drive # 8 Gb (7 Mb free - 99%) [] # NTFS
I:\ -> Removable drive # 4 Gb (3 Mb free - 93%) [HAD] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\Users\Honza\AppData\Local\Temp\Done.vbs
Deleted ! C:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-20
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! F:\$RECYCLE.BIN\S-1-5-21-4163163076-1683261631-2132254409-1000
Deleted ! F:\Recycler\S-1-5-21-1078081533-1409082233-725345543-1003
Deleted ! F:\Recycler\S-1-5-21-117609710-1563985344-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-117609710-1580436667-1708537768-1004
Deleted ! F:\Recycler\S-1-5-21-1229272821-1383384898-725345543-500
Deleted ! F:\Recycler\S-1-5-21-1801674531-725345543-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-1844237615-1450960922-839522115-1003
Deleted ! F:\Recycler\S-1-5-21-300071691-2139591398-643669466-1005
Deleted ! F:\Recycler\S-1-5-21-3467891718-768066622-507647255-2241
Deleted ! F:\Recycler\S-1-5-21-3713795169-2005671613-1543313341-1005
Deleted ! F:\Recycler\S-1-5-21-527237240-413027322-1177238915-1003
Deleted ! I:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665

(!) Temporary files deleted.

################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives

################## | Mountpoints2 |

################## | Listing |

[26/06/2012 - 00:32:01 | SHD ] C:\$RECYCLE.BIN
[19/03/2012 - 18:18:33 | N | 1024] C:\.rnd
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[18/09/2011 - 19:51:09 | D ] C:\DRIVERS
[25/06/2012 - 23:47:56 | ASH | 3151417344] C:\hiberfil.sys
[14/09/2011 - 21:52:45 | D ] C:\Intel
[25/06/2012 - 23:48:00 | ASH | 4201889792] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[24/06/2012 - 16:09:34 | D ] C:\Program Files
[24/06/2012 - 16:10:05 | D ] C:\Program Files (x86)
[24/06/2012 - 16:09:34 | D ] C:\ProgramData
[14/09/2011 - 21:01:41 | D ] C:\Recovery
[25/06/2012 - 23:51:18 | D ] C:\rsit
[15/09/2011 - 23:28:48 | D ] C:\server
[15/09/2011 - 12:06:48 | D ] C:\swtools
[25/06/2012 - 23:35:52 | SHD ] C:\System Volume Information
[19/06/2012 - 13:37:46 | D ] C:\Temp
[19/10/2011 - 10:11:01 | D ] C:\totalcmd
[26/06/2012 - 00:32:01 | D ] C:\UsbFix
[26/06/2012 - 00:30:01 | A | 3348] C:\UsbFix.txt
[24/06/2012 - 16:09:35 | D ] C:\Users
[15/09/2011 - 17:04:01 | D ] C:\wifi
[25/06/2012 - 23:50:30 | D ] C:\Windows
[06/06/2012 - 23:13:13 | D ] C:\WORDS
[26/06/2012 - 00:32:01 | D ] D:\$RECYCLE.BIN
[09/03/2012 - 14:44:36 | D ] D:\.pdfsam
[17/04/2012 - 11:12:35 | N | 48128] D:\cenik-zahradni-architektura-a-doplnky.xls
[24/05/2012 - 15:39:07 | D ] D:\Dokumenty
[26/06/2012 - 00:29:25 | D ] D:\Download
[01/03/2012 - 12:37:06 | D ] D:\downloads_prebrat
[28/11/2011 - 20:53:33 | D ] D:\Filmy
[17/04/2012 - 10:56:04 | N | 2143605] D:\katalog-zahradni-architektura-a-doplnky.pdf
[23/11/2011 - 11:57:00 | RD ] D:\MSOCache
[13/03/2012 - 23:59:35 | N | 235654] D:\Mysticka teologie_vypisky_new.rtf
[26/06/2012 - 00:29:25 | D ] D:\Plocha
[25/04/2012 - 16:26:50 | N | 138860] D:\SKMBT_22312042516231.pdf
[25/06/2012 - 23:35:52 | SHD ] D:\System Volume Information
[26/06/2012 - 00:32:01 | D ] F:\$RECYCLE.BIN
[17/11/2011 - 15:04:34 | D ] F:\--misie
[24/06/2012 - 16:10:02 | D ] F:\autorun
[02/05/2012 - 21:27:38 | D ] F:\Dokumenty
[13/06/2012 - 16:48:32 | D ] F:\Filmy
[01/01/2012 - 22:29:31 | D ] F:\Fotky
[09/06/2012 - 22:22:28 | D ] F:\Hudba
[17/06/2012 - 16:34:14 | D ] F:\Instalačky
[19/08/2010 - 12:08:08 | N | 157859] F:\localhost.sql
[09/06/2012 - 22:32:53 | D ] F:\Noty
[14/11/2011 - 15:01:52 | D ] F:\programy
[30/04/2011 - 18:57:49 | D ] F:\Přednášky
[26/06/2012 - 00:32:00 | D ] F:\RECYCLER
[11/02/2012 - 13:09:25 | D ] F:\Seriály
[24/06/2012 - 16:08:42 | D ] F:\server
[07/05/2004 - 16:47:24 | N | 1311232] F:\slovníček-šlesinger.doc
[25/06/2012 - 23:35:52 | SHD ] F:\System Volume Information
[12/12/2010 - 19:32:17 | SH | 7168] F:\Thumbs.db
[17/08/2010 - 21:57:23 | N | 12288] F:\total_commander.exe
[14/09/2011 - 20:16:29 | D ] F:\zaloha-notebook
[03/10/2011 - 14:25:45 | D ] F:\__z_konviktu_prebrat
[23/06/2012 - 23:17:39 | D ] H:\kalendar
[16/06/2012 - 17:58:40 | D ] H:\misalek
[16/06/2012 - 09:58:00 | D ] H:\misalek-original
[23/06/2012 - 21:49:22 | N | 16188] I:\ComboFix.txt
[24/06/2012 - 15:43:40 | N | 34628832] I:\7zw406ww.exe
[15/03/2012 - 20:39:12 | N | 21504] I:\proglas-nespory.doc
[04/06/2012 - 21:21:16 | D ] I:\logy
[09/03/2012 - 16:45:28 | N | 425] I:\winamp_metadata.dat
[09/03/2012 - 16:45:28 | N | 52] I:\winamp_metadata.idx
[24/03/2012 - 13:44:50 | N | 24064] I:\křížová cesta rokole..doc
[19/04/2012 - 10:08:22 | D ] I:\zeitgeist
[22/04/2012 - 20:36:48 | D ] I:\odvirovani
[16/05/2012 - 09:54:26 | N | 32768] I:\kalendar-tt.xls
[16/05/2012 - 18:05:26 | N | 32768] I:\historicko-kriticka-metoda-pismo.doc
[01/10/2011 - 18:28:58 | N | 39395] I:\rozvrh.pdf
[01/10/2011 - 18:31:28 | RSHD ] I:\RECYCLER
[09/01/2012 - 21:15:22 | N | 40960] I:\kafka-jan-recenze-vlkova-slovo-bozi-a-slovo-lidske.doc
[06/12/2011 - 17:07:24 | N | 89600] I:\řecké báje a pověsti.doc
[09/03/2012 - 15:47:34 | N | 2089740] I:\WLAN_Atheros_PNP_Win7_64_Z920458.zip
[09/03/2012 - 15:48:50 | N | 54669316] I:\WiFi_Intel_WifiFamily_Win7_64_Z14113.zip

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
F:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
I:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_HAD.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |

počítač se zdá být trochu pomalejší (připojení k internetu) a když vytvořím na ploše nový poznámkový blok, nejde dvojklikem otevřít, musím z menu "upravit"...

had12 · #26 Příspěvek od **had12** » 25 čer 2012 23:58

...a pozoruju další jev: nelze použít "kolečko myši" při odpojené externí myši... mám Lenovo E520 edge, takže místo kolečka myše občas používám tlačítko pro kolečko a pohyb trackpointem... (dohromady to funguje jako otáčením kolečka na myši)

had12 · #27 Příspěvek od **had12** » 26 čer 2012 00:02

...pro dnešek musím už jít spát, zítra mám dvě zkoušky a brzo vstávám. Díky za pomoc a zatím dobrou noc, zítra budu pokračovat.

#28 Příspěvek od **vyosek** » 26 čer 2012 11:05

vyzkousejte jinou mys jestli neni zavada v ni

Tohle I:\7zw406ww.exe znate

had12 · #29 Příspěvek od **had12** » 26 čer 2012 12:28

ten trackpoint už zase funguje jak má...hm...

ten soubor - jedná se o ovladač k wifi, jak jsem ho zkoušel přeinstalovat, když nešla síťovka... je to digitálně podepsané společností Lenovo, staženo z lenovo.com. NOD32 neshledal žádný vir v tomto exe souboru, na virustotal to nahrát nejde, má to o 2 MB víc...

stále mi na disku zůstává D:/$RECYCLE.BIN/... a na ploše ten neznámý objekt (při najetí myše se nezobrazí popis, neexistuje v total commanderu ani přes tento počítač, ale při zobrazení plochy ano). - posílám screen.

#30 Příspěvek od **vyosek** » 26 čer 2012 17:49

OK, pokud je to driver, no problem, jen jsem se ptal

slozky jsou v poradku, muzete je smazat, ale jsou jiz ciste

Ten neznamy objekt, to je ten "Honza"

VIRY.CZ

špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno

Re: špatně vygoogleno