SKYPE TROJAN - NUTNÉ

[CoolGujin]

Postupoval jsem podle tohoto návodu od Rudyho

Stáněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte na Search
Proběhne skenováni a pak se objeví log, který sem vložte

Prosím pomozte mi...zablokoval se mi (asi) kvůli tomu facebook...
A notebook potřebuji ke studiu...

Tady je můj log: (opravený)
# AdwCleaner v2.004 - Logfile created 10/08/2012 at 21:54:58
# Updated 06/10/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Filda - FILDA-PC
# Boot Mode : Normal
# Running from : C:\Users\Filda\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default\searchplugins\Askcom.xml
Folder Deleted : C:\ProgramData\APN
Folder Deleted : C:\Users\Filda\AppData\Local\APN
Folder Deleted : C:\Users\Filda\AppData\Local\Temp\AskSearch

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0.1 (cs)

Profile name : default
File : C:\Users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default\prefs.js

Deleted : user_pref("browser.search.order.1", "Ask.com");

-\\ Google Chrome v22.0.1229.79

File : C:\Users\Filda\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.51] : icon_url = "hxxp://www.ask.com/favicon.ico",
Deleted [l.54] : keyword = "ask.com",
Deleted [l.57] : search_url = "hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=HIP&o=102876&locale=en_EU&apn_uid=29f341d1-6142-4aa9-b05e-5829e9890297&apn_ptnrs=6G&apn_sauid=49BA18E7-123F-4B54-9D1C-0B37DAA0AAE5&apn_dtid=YYYYYYYYCZ&q={searchTerms}",
Deleted [l.58] : suggest_url = "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}",

*************************

AdwCleaner[R1].txt - [2378 octets] - [08/10/2012 21:50:06]
AdwCleaner[R2].txt - [2438 octets] - [08/10/2012 21:51:18]
AdwCleaner[S2].txt - [2407 octets] - [08/10/2012 21:54:58]

########## EOF - C:\AdwCleaner[S2].txt - [2467 octets] ##########

[vyosek]

Zdravim a pekny vecer preji

Spustte znovu AdwCleaner

• Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete na Delete
• PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=13&t=105895

[CoolGujin]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Filda at 2012-10-08 22:01:02
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 459 GB (77%) free of 595 GB
Total RAM: 4003 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:01:08, on 8.10.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
C:\Users\Filda\AppData\Local\Seznam.cz\bin\postak.exe
C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe
C:\Users\Filda\AppData\Local\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\Users\Filda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\Filda\Desktop\Music\AirPlay.exe
C:\Users\Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Dell\Stage Remote\DMR.exe
C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Program Files\trend micro\Filda.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://szn.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot
O4 - HKLM\..\Run: [RoxWatchTray] "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
O4 - HKLM\..\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [ASUS Ai Charger] C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
O4 - HKLM\..\Run: [Shairport4w] "C:\Users\Filda\Desktop\Shairport4w.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Seznam Postak] "C:\Users\Filda\AppData\Local\Seznam.cz\bin\postak.exe" -s
O4 - HKCU\..\Run: [AirVideoServer] C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Filda\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Windows] "C:\Users\Public\Public Documents\Windows Movie Player\players.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Filda\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
O4 - HKCU\..\Run: [SkyDrive] "C:\Users\Filda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\WINDOWS\System32\StikyNot.exe
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\Run: [com.apple.dav.bookmarks.daemon] C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: AirPlay – zástupce.lnk = Filda\Desktop\Music\AirPlay.exe
O4 - Startup: Facebook Messenger.lnk = Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwar ... TSUEng.cab
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwar ... PIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE780BCA-5594-4309-B899-EB556D5E9622}: NameServer = 8.8.8.8
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Úložná technologie Intel(R) Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: RoxMediaDB12OEM - Sonic Solutions - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10122 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 17209 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
winlogon.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
taskeng.exe {1E371B52-5EA2-4D6F-BA1A-BFB2C02CFC7D}
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\IDT\WDM\AESTSr64.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe"
"C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\windows\System32\svchost.exe -k HPZ12
C:\windows\System32\svchost.exe -k HPZ12
"C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE"
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2296
"C:\windows\system32\Dwm.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\windows\Explorer.EXE
"taskhost.exe"
C:\windows\system32\svchost.exe -k HPService
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\windows\system32\svchost.exe -k bthsvcs
"C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE" C:\Users\Filda
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE"
"C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
C:\windows\system32\sppsvc.exe
"C:\WINDOWS\System32\igfxtray.exe"
"C:\WINDOWS\System32\hkcmd.exe"
"C:\WINDOWS\System32\igfxpers.exe"
"C:\Program Files\DellTPad\Apoint.exe"
"C:\Program Files\Dell\QuickSet\quickset.exe"
"C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe" -Quiet
"C:\Program Files\DellTPad\ApMsgFwd.exe" -s{05FA8492-C047-4207-BE65-780D8591C113}
C:\windows\system32\wbem\wmiprvse.exe
"Apntex.exe"
"C:\Program Files\DellTPad\HidFind.exe"
\??\C:\windows\system32\conhost.exe "1128880162205455998310799796852117028893-21368590881780494618-81891661-898562818
StageRemoteService.exe
"C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Users\Filda\AppData\Local\Seznam.cz\bin\postak.exe" -s
"C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Users\Filda\AppData\Local\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\Users\Filda\AppData\Local\Google\Update\1.3.21.123\GoogleCrashHandler64.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\Filda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background
"C:\WINDOWS\System32\StikyNot.exe"
"C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe"
"C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe"
"C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe"
"C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" -tray
C:\windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe"
"C:\Users\Filda\Desktop\Music\AirPlay.exe"
"C:\Users\Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe"
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" -Embedding
"C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
C:\windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
DMR.exe -Enable
"C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe"
"C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe"
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe" -CtxID "#Hewlett-Packard#HP Deskjet F2200 series#1347370164" -Startup
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe" -Embedding
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe" -Embedding
"C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe"
{06357461-C454-4B8A-A5A3-948EBA980C1F}
{84B6703E-8435-44CA-8577-8DCDC68BE7FF}
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=9160.ec125c0.872177900 "C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 9160 "\\.\pipe\gecko-crash-server-pipe.9160" plugin
"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe" --proxy-stub-channel=Flash3768.59F9F168.41 --host-broker-channel=Flash3768.59F9F168.18467 --host-pid=3768 --host-npapi-version=27 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll"
"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe" --channel=2168.003AF38C.1359879134 --proxy-stub-channel=Flash3768.59F9F168.41 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll" --host-npapi-version=27 --type=renderer
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
C:\windows\servicing\TrustedInstaller.exe
"C:\Users\Filda\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\AutoKMS.job
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default

prefs.js - "browser.startup.homepage" - "szn.cz"
prefs.js - "keyword.URL" - ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default\extensions\
{ea614400-e918-4741-9a97-7a972ff7c30b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-09-29 49440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-09-28 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll [2011-05-20 60576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-09-28 157672]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-04-20 168216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-04-20 392472]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-04-20 416024]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2011-01-25 525312]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2011-04-13 609144]
"QuickSet"=C:\Program Files\Dell\QuickSet\QuickSet.exe [2011-01-22 3666800]
"Stage Remote"=C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2011-08-08 2034752]
"AtherosBtStack"=C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [2011-05-20 627360]
"AthBtTray"=C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [2011-05-20 379552]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2012-09-12 1289704]
"DellStage"=C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2012-02-01 2195824]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"Seznam Postak"=C:\Users\Filda\AppData\Local\Seznam.cz\bin\postak.exe [2012-01-10 491040]
"AirVideoServer"=C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe [2010-09-22 4923784]
"Google Update"=C:\Users\Filda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 116648]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-11 3672384]
"Windows"=C:\Users\Public\Public Documents\Windows Movie Player\players.exe [2009-09-24 679936]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"Facebook Update"=C:\Users\Filda\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-20 138096]
"MobileDocuments"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe []
"SkyDrive"=C:\Users\Filda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [2012-09-19 238528]
"RESTART_STICKY_NOTES"=C:\WINDOWS\System32\StikyNot.exe [2009-07-14 427520]
"iCloudServices"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2012-08-29 59280]
"ApplePhotoStreams"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [2012-09-10 59280]
"com.apple.dav.bookmarks.daemon"=C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [2012-09-05 59280]
"NokiaSuite.exe"=C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [2012-08-03 1086376]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"=C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [2011-04-13 503942]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-11-06 283160]
"NUSB3MON"=C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2010-11-17 113288]
"Dell Registration"=C:\Program Files (x86)\System Registration\prodreg.exe [2010-11-10 4144448]
"RoxWatchTray"=c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [2010-11-25 240112]
"Desktop Disc Tool"=c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [2010-11-17 514544]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-07-27 35768]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-08-27 59280]
"ASUS Ai Charger"=C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe [2010-05-10 465536]
"Shairport4w"=C:\Users\Filda\Desktop\Shairport4w.exe []
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]
"HP Software Update"=C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2012-09-09 421776]
"AccuWeatherWidget"=C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [2012-02-01 968048]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Filda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
AirPlay – zástupce.lnk - C:\Users\Filda\Desktop\Music\AirPlay.exe
Facebook Messenger.lnk - C:\Users\Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2011-04-10 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-10-08 22:01:03 ----D---- C:\Program Files\trend micro
2012-10-08 22:01:02 ----D---- C:\rsit
2012-10-08 21:57:49 ----A---- C:\AdwCleaner[R3].txt
2012-10-08 21:54:58 ----A---- C:\AdwCleaner[S2].txt
2012-10-08 21:51:18 ----A---- C:\AdwCleaner[R2].txt
2012-10-08 21:50:06 ----A---- C:\AdwCleaner[R1].txt
2012-10-08 20:55:37 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-08 20:55:37 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2012-10-08 20:30:57 ----D---- C:\Users\Filda\AppData\Roaming\Malwarebytes
2012-10-08 20:30:48 ----D---- C:\ProgramData\Malwarebytes
2012-10-08 20:30:47 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-10-08 20:16:47 ----D---- C:\Program Files (x86)\Siber Systems
2012-10-08 20:14:51 ----D---- C:\ProgramData\AVAST Software
2012-10-08 20:14:51 ----D---- C:\Program Files\AVAST Software
2012-10-08 17:41:46 ----D---- C:\Users\Filda\AppData\Roaming\ESET
2012-10-05 17:58:12 ----D---- C:\Users\Filda\AppData\Roaming\Nokia Suite
2012-10-05 17:58:11 ----D---- C:\Users\Filda\AppData\Roaming\Nokia
2012-10-03 20:27:03 ----A---- C:\windows\system32\I like my new school.My favourite subjects are math, PE etc..I have lunch at school cafeteria every day (I think there is really very tasty food ). In my new class are very friendly people and we are .lnk
2012-09-28 20:26:56 ----D---- C:\windows\Sun
2012-09-28 20:16:01 ----A---- C:\windows\SYSWOW64\npDeployJava1.dll
2012-09-28 20:16:01 ----A---- C:\windows\SYSWOW64\javaws.exe
2012-09-28 20:15:48 ----A---- C:\windows\SYSWOW64\WindowsAccessBridge-32.dll
2012-09-28 20:15:48 ----A---- C:\windows\SYSWOW64\javaw.exe
2012-09-28 20:15:48 ----A---- C:\windows\SYSWOW64\java.exe
2012-09-28 18:32:51 ----D---- C:\Program Files\PlayReady
2012-09-28 18:24:26 ----A---- C:\windows\system32\drivers\IT9135BDA.sys
2012-09-28 18:00:18 ----D---- C:\windows\SYSWOW64\WinFast
2012-09-28 17:59:46 ----D---- C:\Users\Filda\AppData\Roaming\InstallShield
2012-09-28 17:53:17 ----D---- C:\windows\Minidump
2012-09-28 17:31:58 ----A---- C:\windows\system32\AF15BDAEX.dll
2012-09-28 17:31:57 ----A---- C:\windows\SYSWOW64\AF15BDAEX.dll
2012-09-28 17:12:53 ----D---- C:\Program Files (x86)\ProgDVB
2012-09-28 17:00:00 ----D---- C:\Users\Filda\AppData\Roaming\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
2012-09-28 17:00:00 ----D---- C:\ProgramData\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
2012-09-28 16:58:30 ----D---- C:\Users\Filda\AppData\Roaming\CMUV
2012-09-28 00:04:06 ----D---- C:\Program Files (x86)\Microsoft WSE
2012-09-27 12:37:20 ----D---- C:\Users\Filda\AppData\Roaming\HYL
2012-09-27 12:31:09 ----D---- C:\ProgramData\HYL
2012-09-27 12:31:09 ----D---- C:\Program Files (x86)\HYL
2012-09-26 07:17:56 ----A---- C:\windows\system32\OxpsConverter.exe
2012-09-25 18:40:03 ----D---- C:\Users\Filda\AppData\Roaming\AutoHideIP
2012-09-25 18:40:03 ----D---- C:\ProgramData\AutoHideIP
2012-09-24 14:47:33 ----D---- C:\Program Files (x86)\Dell Touch Software Suite
2012-09-23 11:04:48 ----A---- C:\windows\NeroDigital.ini
2012-09-23 11:04:24 ----D---- C:\Users\Filda\AppData\Roaming\Nero
2012-09-22 15:01:23 ----A---- C:\windows\system32\mshtmled.dll
2012-09-22 15:01:22 ----A---- C:\windows\SYSWOW64\mshtmled.dll
2012-09-22 15:01:21 ----A---- C:\windows\SYSWOW64\vbscript.dll
2012-09-22 15:01:20 ----A---- C:\windows\SYSWOW64\ieui.dll
2012-09-22 15:01:19 ----A---- C:\windows\SYSWOW64\url.dll
2012-09-22 15:01:19 ----A---- C:\windows\SYSWOW64\ieUnatt.exe
2012-09-22 15:01:19 ----A---- C:\windows\system32\url.dll
2012-09-22 15:01:19 ----A---- C:\windows\system32\ieUnatt.exe
2012-09-22 15:01:19 ----A---- C:\windows\system32\ieui.dll
2012-09-22 15:01:18 ----A---- C:\windows\SYSWOW64\urlmon.dll
2012-09-22 15:01:18 ----A---- C:\windows\system32\urlmon.dll
2012-09-22 15:01:17 ----A---- C:\windows\system32\msfeeds.dll
2012-09-22 15:01:17 ----A---- C:\windows\system32\jscript9.dll
2012-09-22 15:01:16 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2012-09-22 15:01:15 ----A---- C:\windows\SYSWOW64\wininet.dll
2012-09-22 15:01:15 ----A---- C:\windows\system32\wininet.dll
2012-09-22 15:01:15 ----A---- C:\windows\system32\jsproxy.dll
2012-09-22 15:01:14 ----A---- C:\windows\SYSWOW64\jscript9.dll
2012-09-22 15:01:14 ----A---- C:\windows\SYSWOW64\jscript.dll
2012-09-22 15:01:14 ----A---- C:\windows\system32\vbscript.dll
2012-09-22 15:01:13 ----A---- C:\windows\SYSWOW64\iertutil.dll
2012-09-22 15:01:13 ----A---- C:\windows\system32\jscript.dll
2012-09-22 15:01:13 ----A---- C:\windows\system32\iertutil.dll
2012-09-22 15:01:12 ----A---- C:\windows\SYSWOW64\jsproxy.dll
2012-09-22 15:01:11 ----A---- C:\windows\SYSWOW64\mshtml.dll
2012-09-22 15:01:06 ----A---- C:\windows\system32\mshtml.dll
2012-09-22 15:01:04 ----A---- C:\windows\system32\ieframe.dll
2012-09-22 15:01:03 ----A---- C:\windows\SYSWOW64\ieframe.dll
2012-09-20 16:30:26 ----D---- C:\Users\Filda\AppData\Roaming\TeamViewer
2012-09-20 16:30:11 ----D---- C:\Program Files (x86)\TeamViewer
2012-09-19 17:16:59 ----HD---- C:\SkyDriveTemp
2012-09-19 17:15:48 ----D---- C:\Program Files (x86)\Microsoft SkyDrive
2012-09-19 17:15:34 ----D---- C:\ProgramData\Microsoft SkyDrive
2012-09-19 16:05:17 ----D---- C:\Users\Filda\AppData\Roaming\ZinioReader4
2012-09-19 15:36:09 ----D---- C:\ProgramData\ArcSoft
2012-09-19 15:31:59 ----D---- C:\ProgramData\CyberLink
2012-09-19 15:31:55 ----D---- C:\Users\Filda\AppData\Roaming\CyberLink
2012-09-19 15:19:26 ----A---- C:\windows\system32\drivers\GEARAspiWDM.sys
2012-09-19 15:18:48 ----D---- C:\Program Files\iPod
2012-09-19 15:18:47 ----D---- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2012-09-19 15:18:47 ----D---- C:\Program Files\iTunes
2012-09-19 15:18:47 ----D---- C:\Program Files (x86)\iTunes
2012-09-18 11:11:18 ----D---- C:\Users\Filda\AppData\Roaming\Reallusion
2012-09-15 11:07:18 ----A---- C:\windows\SYSWOW64\D3DX9_43.dll
2012-09-15 11:05:29 ----HD---- C:\windows\msdownld.tmp
2012-09-15 11:05:29 ----D---- C:\windows\SYSWOW64\directx
2012-09-13 19:55:21 ----D---- C:\Program Files (x86)\uTorrent
2012-09-13 19:54:41 ----D---- C:\Users\Filda\AppData\Roaming\uTorrent
2012-09-12 10:29:41 ----D---- C:\Program Files (x86)\Counter-Strike 1.6
2012-09-12 10:00:47 ----A---- C:\windows\Burnout(TM) Paradise The Ultimate Box Patch Log.txt
2012-09-12 09:55:59 ----A---- C:\windows\SYSWOW64\d3dx10_40.dll
2012-09-12 09:55:59 ----A---- C:\windows\SYSWOW64\D3DCompiler_40.dll
2012-09-12 09:55:59 ----A---- C:\windows\system32\d3dx10_40.dll
2012-09-12 09:55:59 ----A---- C:\windows\system32\D3DCompiler_40.dll
2012-09-12 09:55:58 ----A---- C:\windows\SYSWOW64\XAudio2_3.dll
2012-09-12 09:55:58 ----A---- C:\windows\SYSWOW64\XAPOFX1_2.dll
2012-09-12 09:55:58 ----A---- C:\windows\system32\XAudio2_3.dll
2012-09-12 09:55:58 ----A---- C:\windows\system32\XAPOFX1_2.dll
2012-09-12 09:55:58 ----A---- C:\windows\system32\D3DX9_40.dll
2012-09-12 09:55:57 ----A---- C:\windows\SYSWOW64\XAudio2_2.dll
2012-09-12 09:55:57 ----A---- C:\windows\SYSWOW64\XAPOFX1_1.dll
2012-09-12 09:55:57 ----A---- C:\windows\SYSWOW64\xactengine3_3.dll
2012-09-12 09:55:57 ----A---- C:\windows\SYSWOW64\X3DAudio1_5.dll
2012-09-12 09:55:57 ----A---- C:\windows\system32\XAudio2_2.dll
2012-09-12 09:55:57 ----A---- C:\windows\system32\XAPOFX1_1.dll
2012-09-12 09:55:57 ----A---- C:\windows\system32\xactengine3_3.dll
2012-09-12 09:55:57 ----A---- C:\windows\system32\X3DAudio1_5.dll
2012-09-12 09:55:56 ----A---- C:\windows\SYSWOW64\xactengine3_2.dll
2012-09-12 09:55:56 ----A---- C:\windows\SYSWOW64\d3dx10_39.dll
2012-09-12 09:55:56 ----A---- C:\windows\SYSWOW64\D3DCompiler_39.dll
2012-09-12 09:55:56 ----A---- C:\windows\system32\xactengine3_2.dll
2012-09-12 09:55:56 ----A---- C:\windows\system32\d3dx10_39.dll
2012-09-12 09:55:56 ----A---- C:\windows\system32\D3DCompiler_39.dll
2012-09-12 09:55:55 ----A---- C:\windows\SYSWOW64\XAudio2_1.dll
2012-09-12 09:55:55 ----A---- C:\windows\SYSWOW64\XAPOFX1_0.dll
2012-09-12 09:55:55 ----A---- C:\windows\SYSWOW64\D3DX9_39.dll
2012-09-12 09:55:55 ----A---- C:\windows\system32\XAudio2_1.dll
2012-09-12 09:55:55 ----A---- C:\windows\system32\XAPOFX1_0.dll
2012-09-12 09:55:55 ----A---- C:\windows\system32\D3DX9_39.dll
2012-09-12 09:55:54 ----A---- C:\windows\SYSWOW64\xactengine3_1.dll
2012-09-12 09:55:54 ----A---- C:\windows\SYSWOW64\X3DAudio1_4.dll
2012-09-12 09:55:54 ----A---- C:\windows\SYSWOW64\d3dx10_38.dll
2012-09-12 09:55:54 ----A---- C:\windows\SYSWOW64\D3DCompiler_38.dll
2012-09-12 09:55:54 ----A---- C:\windows\system32\xactengine3_1.dll
2012-09-12 09:55:54 ----A---- C:\windows\system32\X3DAudio1_4.dll
2012-09-12 09:55:54 ----A---- C:\windows\system32\d3dx10_38.dll
2012-09-12 09:55:54 ----A---- C:\windows\system32\D3DCompiler_38.dll
2012-09-12 09:55:53 ----A---- C:\windows\SYSWOW64\XAudio2_0.dll
2012-09-12 09:55:53 ----A---- C:\windows\SYSWOW64\D3DX9_38.dll
2012-09-12 09:55:53 ----A---- C:\windows\system32\XAudio2_0.dll
2012-09-12 09:55:53 ----A---- C:\windows\system32\D3DX9_38.dll
2012-09-12 09:55:52 ----A---- C:\windows\SYSWOW64\xactengine3_0.dll
2012-09-12 09:55:52 ----A---- C:\windows\SYSWOW64\X3DAudio1_3.dll
2012-09-12 09:55:52 ----A---- C:\windows\SYSWOW64\d3dx10_37.dll
2012-09-12 09:55:52 ----A---- C:\windows\SYSWOW64\D3DCompiler_37.dll
2012-09-12 09:55:52 ----A---- C:\windows\system32\xactengine3_0.dll
2012-09-12 09:55:52 ----A---- C:\windows\system32\X3DAudio1_3.dll
2012-09-12 09:55:52 ----A---- C:\windows\system32\d3dx10_37.dll
2012-09-12 09:55:52 ----A---- C:\windows\system32\D3DCompiler_37.dll
2012-09-12 09:55:51 ----A---- C:\windows\SYSWOW64\D3DX9_37.dll
2012-09-12 09:55:51 ----A---- C:\windows\system32\D3DX9_37.dll
2012-09-12 07:07:30 ----A---- C:\windows\SYSWOW64\d3d10level9.dll
2012-09-12 07:07:30 ----A---- C:\windows\system32\drivers\RNDISMP.sys
2012-09-12 07:07:30 ----A---- C:\windows\system32\drivers\ndis.sys
2012-09-12 07:07:30 ----A---- C:\windows\system32\d3d10level9.dll
2012-09-12 07:07:29 ----A---- C:\windows\system32\drivers\tcpip.sys
2012-09-12 07:07:29 ----A---- C:\windows\system32\drivers\netio.sys
2012-09-12 07:07:29 ----A---- C:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 15:30:05 ----D---- C:\ProgramData\WEBREG
2012-09-11 15:30:03 ----D---- C:\Users\Filda\AppData\Roaming\HP
2012-09-11 15:27:41 ----D---- C:\ProgramData\HP Product Assistant
2012-09-11 15:25:42 ----D---- C:\Program Files (x86)\HP
2012-09-11 15:25:41 ----HD---- C:\Config.Msi
2012-09-11 15:19:54 ----N---- C:\windows\hpomdl27.dat
2012-09-11 15:19:54 ----A---- C:\windows\hpoins27.dat
2012-09-11 15:19:26 ----A---- C:\windows\system32\hpzids40.dll
2012-09-11 15:19:25 ----A---- C:\windows\system32\hppldcoi.dll
2012-09-11 15:19:25 ----A---- C:\windows\system32\hpowiax7.dll
2012-09-11 15:19:25 ----A---- C:\windows\system32\hpovst15.dll
2012-09-11 15:19:24 ----A---- C:\windows\system32\hpotscl6.dll
2012-09-11 15:15:10 ----D---- C:\ProgramData\HP
2012-09-11 15:13:32 ----D---- C:\ProgramData\Hewlett-Packard
2012-09-11 08:16:11 ----D---- C:\ProgramData\TrackMania
2012-09-11 08:14:22 ----D---- C:\Program Files (x86)\TrackMania
2012-09-09 19:19:30 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2012-10-08 22:01:03 ----RD---- C:\Program Files
2012-10-08 22:00:49 ----AD---- C:\windows\Temp
2012-10-08 22:00:23 ----D---- C:\windows\system32\config
2012-10-08 21:58:24 ----A---- C:\windows\SYSWOW64\log.txt
2012-10-08 21:57:34 ----D---- C:\windows\system32\Tasks
2012-10-08 21:57:15 ----D---- C:\windows\Tasks
2012-10-08 21:57:09 ----D---- C:\windows\Prefetch
2012-10-08 21:56:52 ----HD---- C:\jexepackres
2012-10-08 21:56:23 ----D---- C:\Program Files (x86)\Dell DataSafe Local Backup
2012-10-08 21:54:58 ----AHD---- C:\ProgramData
2012-10-08 21:50:01 ----SHD---- C:\windows\Installer
2012-10-08 21:50:00 ----RD---- C:\Program Files (x86)
2012-10-08 21:50:00 ----D---- C:\ProgramData\Skype
2012-10-08 21:50:00 ----D---- C:\Program Files (x86)\Common Files
2012-10-08 21:49:56 ----D---- C:\Users\Filda\AppData\Roaming\Skype
2012-10-08 21:49:33 ----D---- C:\System Volume Information
2012-10-08 21:40:29 ----D---- C:\windows\inf
2012-10-08 21:40:29 ----AD---- C:\windows\System32
2012-10-08 21:40:29 ----A---- C:\windows\system32\PerfStringBackup.INI
2012-10-08 21:38:52 ----D---- C:\windows\SysWOW64
2012-10-08 21:38:48 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2012-10-08 21:29:07 ----D---- C:\windows\system32\wfp
2012-10-08 21:29:03 ----D---- C:\windows\system32\wbem
2012-10-08 21:29:03 ----AD---- C:\WINDOWS
2012-10-08 21:28:22 ----D---- C:\windows\system32\DriverStore
2012-10-08 21:28:21 ----D---- C:\windows\system32\drivers\UMDF
2012-10-08 21:28:21 ----D---- C:\windows\system32\drivers
2012-10-08 21:28:21 ----D---- C:\windows\system32\CodeIntegrity
2012-10-08 21:28:21 ----D---- C:\windows\system32\catroot2
2012-10-08 21:28:20 ----D---- C:\windows\AutoKMS
2012-10-08 21:28:20 ----D---- C:\ProgramData\Atheros
2012-10-08 21:28:14 ----D---- C:\windows\registration
2012-10-08 21:28:08 ----D---- C:\windows\system32\catroot
2012-10-08 14:23:24 ----D---- C:\ProgramData\Sonic
2012-10-07 10:23:03 ----D---- C:\windows\Logs
2012-10-05 18:52:15 ----D---- C:\windows\system32\NDF
2012-10-05 17:44:07 ----D---- C:\windows\ModemLogs
2012-10-05 17:43:04 ----D---- C:\Users\Filda\AppData\Roaming\PC Suite
2012-10-03 22:59:25 ----D---- C:\Program Files\Microsoft Security Client
2012-10-03 22:59:13 ----D---- C:\Program Files (x86)\Microsoft Security Client
2012-10-03 15:43:29 ----D---- C:\Program Files (x86)\GTA San Andreas
2012-10-03 07:23:52 ----D---- C:\ProgramData\PCDr
2012-09-28 20:15:35 ----A---- C:\windows\SYSWOW64\deployJava1.dll
2012-09-28 20:15:32 ----D---- C:\Program Files (x86)\Java
2012-09-28 18:53:06 ----RSD---- C:\windows\assembly
2012-09-28 18:00:18 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-09-28 16:56:47 ----SD---- C:\Users\Filda\AppData\Roaming\Microsoft
2012-09-28 00:04:01 ----D---- C:\windows\winsxs
2012-09-27 23:54:33 ----D---- C:\Program Files (x86)\Electronic Arts
2012-09-27 21:35:16 ----D---- C:\Program Files (x86)\DsNET Corp
2012-09-26 23:30:37 ----D---- C:\windows\rescache
2012-09-26 16:50:59 ----D---- C:\Program Files (x86)\JDownloader
2012-09-25 19:00:54 ----D---- C:\windows\system32\wdi
2012-09-24 14:47:33 ----D---- C:\ProgramData\Dell
2012-09-24 14:47:33 ----D---- C:\Program Files (x86)\Dell Stage
2012-09-23 10:46:24 ----D---- C:\windows\SYSWOW64\migration
2012-09-23 10:46:24 ----D---- C:\Program Files (x86)\Internet Explorer
2012-09-23 10:46:23 ----D---- C:\windows\system32\migration
2012-09-23 10:46:23 ----D---- C:\Program Files\Internet Explorer
2012-09-21 20:17:28 ----D---- C:\Users\Filda\AppData\Roaming\Apple Computer
2012-09-19 16:09:59 ----D---- C:\Program Files (x86)\Dell
2012-09-19 16:05:33 ----D---- C:\ProgramData\Adobe
2012-09-19 16:05:02 ----D---- C:\Users\Filda\AppData\Roaming\Adobe
2012-09-19 15:34:03 ----D---- C:\ProgramData\Temp
2012-09-19 15:32:37 ----D---- C:\Users\Filda\AppData\Roaming\Fingertapps
2012-09-19 15:30:14 ----D---- C:\Users\Filda\AppData\Roaming\Dell
2012-09-19 15:19:26 ----DC---- C:\windows\system32\DRVSTORE
2012-09-19 15:15:15 ----D---- C:\Program Files (x86)\Safari
2012-09-19 15:13:59 ----D---- C:\Program Files\Common Files\Apple
2012-09-18 11:11:18 ----D---- C:\ProgramData\Creative
2012-09-18 09:17:57 ----D---- C:\windows\Downloaded Program Files
2012-09-18 09:12:49 ----D---- C:\Program Files (x86)\Creative
2012-09-12 14:40:37 ----A---- C:\windows\system32\MRT.exe
2012-09-12 14:40:29 ----D---- C:\ProgramData\Microsoft Help
2012-09-12 14:04:33 ----D---- C:\Program Files\Dell Support Center
2012-09-11 15:29:24 ----A---- C:\windows\win.ini
2012-09-11 15:27:50 ----RSD---- C:\windows\Fonts
2012-09-11 15:26:50 ----D---- C:\windows\twain_32
2012-09-10 07:39:50 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AiCharger;ASUS Charger Driver; C:\windows\system32\DRIVERS\AiCharger.sys [2010-05-05 14592]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2010-11-07 438808]
R0 MpFilter;Microsoft Malware Protection Driver; C:\windows\system32\DRIVERS\MpFilter.sys [2012-08-30 228768]
R0 PxHlpa64;PxHlpa64; C:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-08-27 283200]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 NisDrv;Microsoft Network Inspection System; C:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows x64; C:\windows\system32\DRIVERS\Apfiltr.sys [2011-05-13 363856]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\windows\system32\DRIVERS\btath_flt.sys [2011-05-20 36000]
R3 athr;Dell Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athrx.sys [2011-04-22 2727424]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\windows\system32\drivers\btath_a2dp.sys [2011-05-20 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\windows\system32\DRIVERS\btath_bus.sys [2011-05-20 29344]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\windows\system32\DRIVERS\btath_hcrp.sys [2011-05-20 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\windows\system32\DRIVERS\btath_lwflt.sys [2011-05-20 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\windows\system32\DRIVERS\btath_rcp.sys [2011-05-20 154272]
R3 BtFilter;BtFilter; C:\windows\system32\DRIVERS\btfilter.sys [2011-05-20 282272]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver; C:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2011-04-10 12223936]
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 Dot4;MS IEEE-1284.4 Driver; C:\windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\windows\system32\DRIVERS\Dot4Prt.sys [2010-11-21 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 HSPADataCardusbmdm;HSPADataCard Proprietary USB Driver; C:\windows\system32\DRIVERS\HSPADataCardusbmdm.sys []
S3 HSPADataCardusbnmea;HSPADataCard NMEA Port; C:\windows\system32\DRIVERS\HSPADataCardusbnmea.sys []
S3 HSPADataCardusbser;HSPADataCard Diagnostic Port; C:\windows\system32\DRIVERS\HSPADataCardusbser.sys []
S3 HSPADataCardusbvoice;HSPADataCard VoUSB Port; C:\windows\system32\DRIVERS\HSPADataCardusbvoice.sys []
S3 IT9135BDA;IT9135 BDA Devices; C:\windows\System32\Drivers\IT9135BDA.sys [2012-02-15 164864]
S3 massfilter;Mass Storage Filter Driver; C:\windows\system32\drivers\massfilter.sys []
S3 nmwcd;Nokia USB Phone Parent Driver; C:\windows\system32\drivers\ccdcmbx64.sys [2012-01-09 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\windows\system32\drivers\ccdcmbox64.sys [2012-01-09 27136]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\windows\system32\DRIVERS\pccsmcfdx64.sys [2012-06-27 26112]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUStor.sys [2010-10-30 250984]
S3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\windows\system32\DRIVERS\stwrt64.sys [2011-01-25 520192]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 upperdev;upperdev; C:\windows\system32\DRIVERS\usbser_lowerfltx64.sys [2012-01-09 9216]
S3 USBAAPL64;Apple Mobile USB Driver; C:\windows\System32\Drivers\usbaapl64.sys [2012-07-09 52736]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\windows\system32\drivers\usbser.sys [2010-11-21 32768]
S3 UsbserFilt;UsbserFilt; C:\windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2012-01-09 9216]
S3 WimFltr;WimFltr; C:\windows\system32\DRIVERS\wimfltr.sys [2006-11-01 151656]
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
R2 AESTFilters;Andrea ST Filters Service; C:\Program Files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-08-11 55184]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [2011-05-20 146592]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2011-05-20 80032]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\windows\system32\svchost.exe [2009-07-14 27136]
R2 HPSLPSVC;HP Network Devices Support; C:\windows\system32\svchost.exe [2009-07-14 27136]
R2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-10-06 325656]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-09-12 22072]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
R2 SftService;SoftThinks Agent Service; C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
R2 TeamViewer7;TeamViewer 7; C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 hpqcxs08;hpqcxs08; C:\windows\system32\svchost.exe [2009-07-14 27136]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-09-09 936848]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2012-08-01 724888]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 RoxWatch12;Roxio Hard Drive Watcher 12; c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10122; C:\Program Files\IDT\WDM\STacSV64.exe [2011-01-25 296448]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-19 44376]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-09 114144]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM; c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 stllssvr;stllssvr; c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [2010-11-09 74392]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2012-08-27 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------

[vyosek]

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[CoolGujin]

Log z ComboFixu:

ComboFix 12-10-08.03 - Filda 08.10.2012 22:23:37.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4003.2229 [GMT 2:00]
Spuštěný z: c:\users\Filda\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6032\AddOnDownloaded\06004c97-c212-44da-81de-706b46554efe.dll
c:\programdata\PCDr\6032\AddOnDownloaded\44ddba62-3b58-480f-a775-ae7e9dd9d5df.dll
c:\programdata\PCDr\6032\AddOnDownloaded\684a43a7-04d5-4797-bc20-4db8a316286c.dll
c:\users\Filda\AppData\Local\Temp\7zS4655\HPSLPSVC64.DLL
c:\windows\DPINST.LOG
c:\windows\RPSETUP.EXE.LOG
c:\windows\SysWow64\AF15BDAEX.dll
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_HPSLPSVC
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-08 do 2012-10-08 )))))))))))))))))))))))))))))))
.
.
2012-10-08 20:03 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-08 20:01 . 2012-10-08 20:01 -------- d-----w- c:\program files\trend micro
2012-10-08 20:01 . 2012-10-08 20:01 -------- d-----w- C:\rsit
2012-10-08 19:40 . 2012-10-04 06:45 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{62E21C1D-2CF9-4777-80AA-F1497D7ED2B3}\gapaengine.dll
2012-10-08 19:40 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{38FCB172-31EC-4AF7-B48C-4508BAA1B437}\mpengine.dll
2012-10-08 19:29 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-08 18:55 . 2012-10-08 19:28 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-10-08 18:55 . 2012-10-08 18:56 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-10-08 18:30 . 2012-10-08 18:30 -------- d-----w- c:\users\Filda\AppData\Roaming\Malwarebytes
2012-10-08 18:30 . 2012-10-08 18:30 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 18:30 . 2012-10-08 20:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-10-08 18:16 . 2012-10-08 18:16 -------- d-----w- c:\program files (x86)\Siber Systems
2012-10-08 18:14 . 2012-10-08 18:14 -------- d-----w- c:\programdata\AVAST Software
2012-10-08 18:14 . 2012-10-08 18:14 -------- d-----w- c:\program files\AVAST Software
2012-10-08 15:41 . 2012-10-08 15:41 -------- d-----w- c:\users\Filda\AppData\Local\ESET
2012-10-05 15:58 . 2012-10-05 15:58 -------- d-----w- c:\users\Filda\AppData\Roaming\Nokia Suite
2012-10-05 15:58 . 2012-10-05 15:58 -------- d-----w- c:\users\Filda\AppData\Roaming\Nokia
2012-10-05 15:42 . 2012-10-05 15:42 -------- d-----w- c:\users\Filda\AppData\Local\NokiaAccount
2012-10-04 06:46 . 2012-10-04 06:45 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-28 18:26 . 2012-09-28 18:26 -------- d-----w- c:\windows\Sun
2012-09-28 18:16 . 2012-09-28 18:16 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-09-28 18:16 . 2012-09-28 18:15 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-09-28 18:15 . 2012-09-28 18:15 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-09-28 16:34 . 2012-09-28 16:34 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-09-28 16:34 . 2012-09-28 16:34 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-09-28 16:32 . 2012-09-28 16:32 -------- d-----w- c:\program files\PlayReady
2012-09-28 16:24 . 2012-02-14 23:38 164864 ----a-w- c:\windows\system32\drivers\IT9135BDA.sys
2012-09-28 16:00 . 2012-09-28 16:00 -------- d-----w- c:\windows\SysWow64\WinFast
2012-09-28 15:59 . 2012-09-28 15:59 -------- d-----w- c:\users\Filda\AppData\Roaming\InstallShield
2012-09-28 15:31 . 2012-09-28 15:31 73728 ----a-w- c:\windows\system32\AF15BDAEX.dll
2012-09-28 15:12 . 2012-09-28 16:53 -------- d-----w- c:\program files (x86)\ProgDVB
2012-09-28 15:00 . 2012-09-28 15:00 -------- d-----w- c:\users\Filda\AppData\Roaming\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
2012-09-28 15:00 . 2012-09-28 15:00 -------- d-----w- c:\programdata\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
2012-09-28 14:58 . 2012-09-28 14:58 -------- d-----w- c:\users\Filda\AppData\Roaming\CMUV
2012-09-27 22:04 . 2012-09-27 22:04 -------- d-----w- c:\program files (x86)\Microsoft WSE
2012-09-27 10:37 . 2012-09-27 10:37 -------- d-----w- c:\users\Filda\AppData\Roaming\HYL
2012-09-27 10:31 . 2012-09-27 10:31 -------- d-----w- c:\programdata\HYL
2012-09-27 10:31 . 2012-09-27 10:31 -------- d-----w- c:\program files (x86)\HYL
2012-09-26 05:17 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-25 16:40 . 2012-09-25 16:40 -------- d-----w- c:\users\Filda\AppData\Roaming\AutoHideIP
2012-09-25 16:40 . 2012-09-25 16:40 -------- d-----w- c:\programdata\AutoHideIP
2012-09-24 12:47 . 2012-09-24 12:47 -------- d-----w- c:\program files (x86)\Dell Touch Software Suite
2012-09-23 09:04 . 2012-09-23 09:05 -------- d-----w- c:\users\Filda\AppData\Local\Nero
2012-09-23 09:04 . 2012-09-23 09:04 -------- d-----w- c:\users\Filda\AppData\Roaming\Nero
2012-09-20 14:30 . 2012-09-20 14:37 -------- d-----w- c:\users\Filda\AppData\Roaming\TeamViewer
2012-09-20 14:30 . 2012-09-20 14:30 -------- d-----w- c:\program files (x86)\TeamViewer
2012-09-19 15:15 . 2012-09-19 15:15 -------- d-----w- c:\program files (x86)\Microsoft SkyDrive
2012-09-19 15:15 . 2012-10-08 20:20 -------- d-----r- c:\users\Filda\SkyDrive
2012-09-19 15:15 . 2012-09-19 15:15 -------- d-----w- c:\programdata\Microsoft SkyDrive
2012-09-19 14:05 . 2012-09-19 14:05 -------- d-----w- c:\users\Filda\AppData\Roaming\ZinioReader4
2012-09-19 14:03 . 2012-09-19 14:03 -------- d-----w- c:\users\Filda\AppData\Local\Powercinema
2012-09-19 13:36 . 2012-09-19 13:36 -------- d-----w- c:\programdata\ArcSoft
2012-09-19 13:34 . 2012-09-19 14:09 -------- d-----w- c:\users\Filda\AppData\Local\Downloaded Installations
2012-09-19 13:31 . 2012-09-19 13:31 -------- d-----w- c:\programdata\CyberLink
2012-09-19 13:31 . 2012-09-19 14:03 -------- d-----w- c:\users\Filda\AppData\Roaming\CyberLink
2012-09-19 13:31 . 2012-09-19 13:31 -------- d-----w- c:\users\Filda\AppData\Local\ArcSoft
2012-09-19 13:19 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-09-19 13:18 . 2012-09-19 13:18 -------- d-----w- c:\program files\iPod
2012-09-19 13:18 . 2012-09-19 13:19 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2012-09-19 13:18 . 2012-09-19 13:19 -------- d-----w- c:\program files\iTunes
2012-09-19 13:18 . 2012-09-19 13:19 -------- d-----w- c:\program files (x86)\iTunes
2012-09-18 09:11 . 2012-09-18 09:11 -------- d-----w- c:\users\Filda\AppData\Roaming\Reallusion
2012-09-18 07:17 . 2003-06-12 21:25 7062 ----a-w- c:\windows\SysWow64\audiopid.vxd
2012-09-18 06:54 . 2012-09-20 15:17 -------- d-----w- c:\users\Filda\AppData\Local\Facebook
2012-09-15 09:07 . 2010-06-14 12:26 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2012-09-15 09:05 . 2012-09-15 09:05 -------- d--h--w- c:\windows\msdownld.tmp
2012-09-13 17:55 . 2012-09-13 17:55 -------- d-----w- c:\program files (x86)\uTorrent
2012-09-13 17:54 . 2012-09-27 21:50 -------- d-----w- c:\users\Filda\AppData\Roaming\uTorrent
2012-09-12 12:11 . 2012-09-27 10:32 -------- d-----w- c:\users\Filda\AppData\Local\HYL
2012-09-12 08:29 . 2012-09-12 08:31 -------- d-----w- c:\program files (x86)\Counter-Strike 1.6
2012-09-12 08:01 . 2012-09-12 08:01 -------- d-----w- c:\users\Filda\AppData\Local\Criterion Games
2012-09-12 05:07 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 05:07 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-12 05:07 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2012-09-12 05:07 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 05:07 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 05:07 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 05:07 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 13:30 . 2012-09-11 13:30 -------- d-----w- c:\programdata\WEBREG
2012-09-11 13:30 . 2012-09-11 13:30 -------- d-----w- c:\users\Filda\AppData\Roaming\HP
2012-09-11 13:29 . 2012-09-11 13:29 -------- d-----w- c:\users\Filda\AppData\Local\HP
2012-09-11 13:27 . 2012-09-11 13:27 -------- d-----w- c:\programdata\HP Product Assistant
2012-09-11 13:26 . 2012-09-11 13:26 -------- d-----w- c:\program files (x86)\Common Files\HP
2012-09-11 13:26 . 2012-09-11 13:26 -------- d-----w- c:\program files (x86)\Common Files\Hewlett-Packard
2012-09-11 13:25 . 2012-09-11 13:28 -------- d-----w- c:\program files (x86)\HP
2012-09-11 13:19 . 2009-07-08 10:51 642360 ----a-w- c:\windows\system32\hpzids40.dll
2012-09-11 13:19 . 2009-07-08 10:51 938496 ----a-w- c:\windows\system32\hpowiax7.dll
2012-09-11 13:19 . 2009-07-08 10:51 551424 ----a-w- c:\windows\system32\hppldcoi.dll
2012-09-11 13:19 . 2009-07-08 10:51 505344 ----a-w- c:\windows\system32\hpovst15.dll
2012-09-11 13:19 . 2009-07-08 10:51 740864 ----a-w- c:\windows\system32\hpotscl6.dll
2012-09-11 13:15 . 2012-09-11 13:29 -------- d-----w- c:\programdata\HP
2012-09-11 13:13 . 2012-09-11 13:13 -------- d-----w- c:\programdata\Hewlett-Packard
2012-09-11 13:13 . 2009-07-14 01:41 230400 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll
2012-09-11 06:16 . 2012-10-08 06:51 -------- d-----w- c:\programdata\TrackMania
2012-09-11 06:14 . 2012-09-11 06:34 -------- d-----w- c:\program files (x86)\TrackMania
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 19:38 . 2012-08-27 09:12 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-08 19:38 . 2012-08-27 09:12 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-28 18:15 . 2011-09-29 00:21 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-09-12 12:40 . 2012-08-28 06:56 64462936 ----a-w- c:\windows\system32\MRT.exe
2012-08-30 20:03 . 2012-08-30 20:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2012-03-20 18:44 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-27 17:52 . 2012-08-27 17:52 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-08-27 17:47 . 2012-08-27 17:46 1227264 ----a-w- c:\windows\SysWow64\dx8vb.dll
2012-08-27 17:46 . 2012-08-27 17:46 619008 ----a-w- c:\windows\SysWow64\dx7vb.dll
2012-08-21 11:01 . 2012-08-27 15:31 125872 ----a-w- c:\windows\system32\GEARAspi64.dll
2012-08-21 11:01 . 2012-08-27 15:31 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2012-08-19 23:53 . 2012-08-27 12:55 9309624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E8128B1F-D919-466E-873F-49B96DB51AEF}\mpengine.dll
2012-07-18 18:15 . 2012-08-27 12:55 3148800 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"="c:\users\Filda\AppData\Local\Seznam.cz\bin\postak.exe" [2012-01-10 491040]
"AirVideoServer"="c:\program files (x86)\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Facebook Update"="c:\users\Filda\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-09-20 138096]
"SkyDrive"="c:\users\Filda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" [2012-09-19 238528]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]
"com.apple.dav.bookmarks.daemon"="c:\program files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2012-09-05 59280]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-08-03 1086376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-11-10 4144448]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"ASUS Ai Charger"="c:\program files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe" [2010-05-10 465536]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\Filda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
AirPlay – zástupce.lnk - c:\users\Filda\Desktop\Music\AirPlay.exe [2012-9-9 1262080]
Facebook Messenger.lnk - c:\users\Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]
R3 HSPADataCardusbmdm;HSPADataCard Proprietary USB Driver;c:\windows\system32\DRIVERS\HSPADataCardusbmdm.sys [x]
R3 HSPADataCardusbnmea;HSPADataCard NMEA Port;c:\windows\system32\DRIVERS\HSPADataCardusbnmea.sys [x]
R3 HSPADataCardusbser;HSPADataCard Diagnostic Port;c:\windows\system32\DRIVERS\HSPADataCardusbser.sys [x]
R3 HSPADataCardusbvoice;HSPADataCard VoUSB Port;c:\windows\system32\DRIVERS\HSPADataCardusbvoice.sys [x]
R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys [2012-02-14 164864]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-09 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-27 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2010-05-05 14592]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-08-27 283200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [2011-05-20 146592]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2011-05-20 80032]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-05-20 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-05-20 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-05-20 29344]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-05-20 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-05-20 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-05-20 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-05-20 282272]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-10-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-27 19:38]
.
2012-10-08 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2012-08-27 14:13]
.
2012-10-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
- c:\users\Filda\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-18 15:16]
.
2012-10-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
- c:\users\Filda\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-18 15:16]
.
2012-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
- c:\users\Filda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:17]
.
2012-10-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
- c:\users\Filda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144]
"Stage Remote"="c:\program files (x86)\Dell\Stage Remote\StageRemote.exe" [2011-08-08 2034752]
"AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2011-05-20 627360]
"AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2011-05-20 379552]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://szn.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{CE780BCA-5594-4309-B899-EB556D5E9622}: NameServer = 8.8.8.8
FF - ProfilePath - c:\users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - szn.cz
FF - prefs.js: keyword.URL -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-Shairport4w - c:\users\Filda\Desktop\Shairport4w.exe
AddRemove-DVBViewer Pro Demo_is1 - c:\program files (x86)\DVBViewer Demo\unins000.exe
AddRemove-Fraps - c:\fraps\uninstall.exe
AddRemove-IT9130 DriverInstaller_11.10.19.1 - c:\users\Filda\AppData\Local\Temp\\DriverInstall64.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\program files (x86)\Dell\Stage Remote\StageRemoteService.exe
c:\program files (x86)\Dell\Stage Remote\DMR.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files (x86)\PC Connectivity Solution\ServiceLayer.exe
c:\program files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2012-10-08 23:00:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-10-08 21:00
.
Před spuštěním: Volných bajtů: 481 011 187 712
Po spuštění: Volných bajtů: 483 646 214 144
.
- - End Of File - - E43076411274B09D49D2B18C419F5E0A

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\program files (x86)\Spybot - Search & Destroy
  c:\programdata\Spybot - Search & Destroy
  C:\windows\AutoKMS
  C:\Users\Public\Public Documents\Windows Movie Player
  C:\Users\Filda\AppData\Roaming\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
  C:\ProgramData\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
  C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
  
  File::
  C:\windows\tasks\Adobe Flash Player Updater.job
  C:\windows\tasks\AutoKMS.job
  C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
  C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
  C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
  C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  ""=-
  "Google Update"=-
  "DAEMON Tools Lite"=-
  "Windows"=-
  "Facebook Update"=-
  "MobileDocuments"=-
  "SkyDrive"=-
  "NokiaSuite.exe"=-
  [HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "HP Software Update"-
  "iTunesHelper"=-
  "SunJavaUpdateSched"=-
  
  Collect::
  C:\windows\system32\I like my new school.My favourite subjects are math, PE etc..I have lunch at school cafeteria every day (I think there is really very tasty food ). In my new class are very friendly people and we are .lnk
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[CoolGujin]

Tady to je


ComboFix 12-10-08.03 - Filda 09.10.2012 7:56.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4003.2308 [GMT 2:00]
Spuštěný z: c:\users\Filda\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Filda\Desktop\CFScript.txt.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\AutoKMS.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job"
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Spybot - Search & Destroy
c:\program files (x86)\Spybot - Search & Destroy\blindman.exe
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.dap.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.data.xml
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.default.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.related.htm
c:\program files (x86)\Spybot - Search & Destroy\Help\Brasil.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Cesky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Deutsch.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\English.chm
c:\program files (x86)\Spybot - Search & Destroy\Help\English.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Espanol.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Francais.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Hellenic.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Italiano.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.ansi.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Korean.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Nederlands.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Polski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Russkiy.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Slovensky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Srpski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Suomi.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Includes\Adware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\AdwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Browserpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\CLSIDs.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\DialerC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Domains.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\HeavyDuty.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Hijackers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\HijackersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\iPhone.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Keyloggers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\KeyloggersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Logs.uts
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Malware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\MalwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\OperaPlugins.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\ProcWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPS.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPSC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegXLinks.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Searchpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Security.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SecurityC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Services.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spybots.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpybotsC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spyware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpywareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Startup.tnfo
c:\program files (x86)\Spybot - Search & Destroy\Includes\Tracks.uti
c:\program files (x86)\Spybot - Search & Destroy\Includes\Trojans.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-02.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-03.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-04.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-05.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TTLASSH.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\URL-Blacklist.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\X509White.sbs
c:\program files (x86)\Spybot - Search & Destroy\Languages\Afrikaans.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Arabic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Azeri.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bahasa Indonesia.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Belarusskiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bosanski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Brasil.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bulgarski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Catalan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Cesky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Dansk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Deutsch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Eesti.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\English.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Espanol.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Esperanto.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Euskera.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Farsi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Francais.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Furlan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Galego.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hebrew.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hellenic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hindi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hrvatski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (simplified).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (traditional).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Islenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Italiano.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Japanese.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Korean.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Latvian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Letzebuergesch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Lietuviu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Magyar.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Makedonski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Melayu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Nederlands.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Norsk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Polski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Portugues.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Romaneste.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Russkiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Shqip.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovenscina.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovensky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Srpski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Suomi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Svenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Thai.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Turkce.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Ukrainian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Uzbek.sbl
c:\program files (x86)\Spybot - Search & Destroy\messages.zres
c:\program files (x86)\Spybot - Search & Destroy\Skins\Italia.jpg
c:\program files (x86)\Spybot - Search & Destroy\Skins\Peace.jpg
c:\program files (x86)\Spybot - Search & Destroy\unins000.dat
c:\program files (x86)\Spybot - Search & Destroy\unins000.msg
c:\program files (x86)\Spybot - Search & Destroy\Updates\advcheck165.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\clsid.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\help.cesky.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\online.ini.uiz
c:\program files (x86)\Spybot - Search & Destroy\Updates\teatimer166.zip
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\GEARDIFx.exe
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DIFxAPI.dll
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DifXInst64.exe
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DIFxInstallLog.txt
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspi.dll
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspi64.dll
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspiWDM.inf
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\gearaspiwdmx64.cat
c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64\GEARAspiWDM.sys
c:\programdata\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
c:\programdata\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__\4.8\Data\app.dat
c:\programdata\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__\4.8\Data\updates.dat
c:\programdata\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy\Excludes\Bots.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\Single.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\SystemInternals.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\UpdateDL.sbe
c:\programdata\Spybot - Search & Destroy\Logs\Checks.121008-2057.log
c:\programdata\Spybot - Search & Destroy\Logs\Update downloads.log
c:\programdata\Spybot - Search & Destroy\ProcCache.sbc
c:\users\Filda\AppData\Roaming\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__
c:\users\Filda\AppData\Roaming\DBC2F6FD-3140-41E0-A2A1-D6BAB77D5E21__F893F7CA-8278-41DF-A76F-CAF0437A90CD__\4.8\Data\dya.dat
c:\users\Public\Public Documents\Windows Movie Player
c:\users\Public\Public Documents\Windows Movie Player\players.exe
c:\windows\AutoKMS
c:\windows\AutoKMS\AutoKMS.exe
c:\windows\AutoKMS\AutoKMS.ini
c:\windows\AutoKMS\AutoKMS.log
c:\windows\system32\I like my new school.My favourite subjects are math, PE etc..I have lunch at school cafeteria every day (I think there is really very tasty food ). In my new class are very friendly people and we are .lnk
c:\windows\SysWow64\DEBUG.log
c:\windows\tasks\Adobe Flash Player Updater.job
c:\windows\tasks\AutoKMS.job
c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000Core.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2784445265-4268745598-2048603260-1000UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-09 do 2012-10-09 )))))))))))))))))))))))))))))))
.
.
2012-10-09 06:02 . 2012-10-09 06:02 -------- d-----w- c:\users\Maminka\AppData\Local\temp
2012-10-09 06:02 . 2012-10-09 06:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-08 21:02 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{292CAFAC-A4DA-489E-AD62-D748E8AAAD39}\mpengine.dll
2012-10-08 20:03 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-08 20:01 . 2012-10-08 20:01 -------- d-----w- c:\program files\trend micro
2012-10-08 20:01 . 2012-10-08 20:01 -------- d-----w- C:\rsit
2012-10-08 19:40 . 2012-10-04 06:45 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{62E21C1D-2CF9-4777-80AA-F1497D7ED2B3}\gapaengine.dll
2012-10-08 19:29 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-08 18:30 . 2012-10-08 18:30 -------- d-----w- c:\users\Filda\AppData\Roaming\Malwarebytes
2012-10-08 18:30 . 2012-10-08 18:30 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 18:30 . 2012-10-08 20:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-10-08 18:16 . 2012-10-08 18:16 -------- d-----w- c:\program files (x86)\Siber Systems
2012-10-08 18:14 . 2012-10-08 18:14 -------- d-----w- c:\programdata\AVAST Software
2012-10-08 18:14 . 2012-10-08 18:14 -------- d-----w- c:\program files\AVAST Software
2012-10-08 15:41 . 2012-10-08 15:41 -------- d-----w- c:\users\Filda\AppData\Local\ESET
2012-10-05 15:58 . 2012-10-05 15:58 -------- d-----w- c:\users\Filda\AppData\Roaming\Nokia Suite
2012-10-05 15:58 . 2012-10-05 15:58 -------- d-----w- c:\users\Filda\AppData\Roaming\Nokia
2012-10-05 15:42 . 2012-10-05 15:42 -------- d-----w- c:\users\Filda\AppData\Local\NokiaAccount
2012-10-04 06:46 . 2012-10-04 06:45 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-28 18:26 . 2012-09-28 18:26 -------- d-----w- c:\windows\Sun
2012-09-28 18:16 . 2012-09-28 18:16 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-09-28 18:16 . 2012-09-28 18:15 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-09-28 18:15 . 2012-09-28 18:15 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-09-28 16:34 . 2012-09-28 16:34 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-09-28 16:34 . 2012-09-28 16:34 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-09-28 16:32 . 2012-09-28 16:32 -------- d-----w- c:\program files\PlayReady
2012-09-28 16:24 . 2012-02-14 23:38 164864 ----a-w- c:\windows\system32\drivers\IT9135BDA.sys
2012-09-28 16:00 . 2012-09-28 16:00 -------- d-----w- c:\windows\SysWow64\WinFast
2012-09-28 15:59 . 2012-09-28 15:59 -------- d-----w- c:\users\Filda\AppData\Roaming\InstallShield
2012-09-28 15:31 . 2012-09-28 15:31 73728 ----a-w- c:\windows\system32\AF15BDAEX.dll
2012-09-28 15:12 . 2012-09-28 16:53 -------- d-----w- c:\program files (x86)\ProgDVB
2012-09-28 14:58 . 2012-09-28 14:58 -------- d-----w- c:\users\Filda\AppData\Roaming\CMUV
2012-09-27 22:04 . 2012-09-27 22:04 -------- d-----w- c:\program files (x86)\Microsoft WSE
2012-09-27 10:37 . 2012-09-27 10:37 -------- d-----w- c:\users\Filda\AppData\Roaming\HYL
2012-09-27 10:31 . 2012-09-27 10:31 -------- d-----w- c:\programdata\HYL
2012-09-27 10:31 . 2012-09-27 10:31 -------- d-----w- c:\program files (x86)\HYL
2012-09-26 05:17 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-25 16:40 . 2012-09-25 16:40 -------- d-----w- c:\users\Filda\AppData\Roaming\AutoHideIP
2012-09-25 16:40 . 2012-09-25 16:40 -------- d-----w- c:\programdata\AutoHideIP
2012-09-24 12:47 . 2012-09-24 12:47 -------- d-----w- c:\program files (x86)\Dell Touch Software Suite
2012-09-23 09:04 . 2012-09-23 09:05 -------- d-----w- c:\users\Filda\AppData\Local\Nero
2012-09-23 09:04 . 2012-09-23 09:04 -------- d-----w- c:\users\Filda\AppData\Roaming\Nero
2012-09-20 14:30 . 2012-09-20 14:37 -------- d-----w- c:\users\Filda\AppData\Roaming\TeamViewer
2012-09-20 14:30 . 2012-09-20 14:30 -------- d-----w- c:\program files (x86)\TeamViewer
2012-09-19 15:15 . 2012-09-19 15:15 -------- d-----w- c:\program files (x86)\Microsoft SkyDrive
2012-09-19 15:15 . 2012-10-09 05:53 -------- d-----r- c:\users\Filda\SkyDrive
2012-09-19 15:15 . 2012-09-19 15:15 -------- d-----w- c:\programdata\Microsoft SkyDrive
2012-09-19 14:05 . 2012-09-19 14:05 -------- d-----w- c:\users\Filda\AppData\Roaming\ZinioReader4
2012-09-19 14:03 . 2012-09-19 14:03 -------- d-----w- c:\users\Filda\AppData\Local\Powercinema
2012-09-19 13:36 . 2012-09-19 13:36 -------- d-----w- c:\programdata\ArcSoft
2012-09-19 13:34 . 2012-09-19 14:09 -------- d-----w- c:\users\Filda\AppData\Local\Downloaded Installations
2012-09-19 13:31 . 2012-09-19 13:31 -------- d-----w- c:\programdata\CyberLink
2012-09-19 13:31 . 2012-09-19 14:03 -------- d-----w- c:\users\Filda\AppData\Roaming\CyberLink
2012-09-19 13:31 . 2012-09-19 13:31 -------- d-----w- c:\users\Filda\AppData\Local\ArcSoft
2012-09-19 13:19 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-09-19 13:18 . 2012-09-19 13:18 -------- d-----w- c:\program files\iPod
2012-09-19 13:18 . 2012-09-19 13:19 -------- d-----w- c:\program files\iTunes
2012-09-19 13:18 . 2012-09-19 13:19 -------- d-----w- c:\program files (x86)\iTunes
2012-09-18 09:11 . 2012-09-18 09:11 -------- d-----w- c:\users\Filda\AppData\Roaming\Reallusion
2012-09-18 07:17 . 2003-06-12 21:25 7062 ----a-w- c:\windows\SysWow64\audiopid.vxd
2012-09-18 06:54 . 2012-09-20 15:17 -------- d-----w- c:\users\Filda\AppData\Local\Facebook
2012-09-15 09:07 . 2010-06-14 12:26 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2012-09-15 09:05 . 2012-09-15 09:05 -------- d--h--w- c:\windows\msdownld.tmp
2012-09-13 17:55 . 2012-09-13 17:55 -------- d-----w- c:\program files (x86)\uTorrent
2012-09-13 17:54 . 2012-09-27 21:50 -------- d-----w- c:\users\Filda\AppData\Roaming\uTorrent
2012-09-12 12:11 . 2012-09-27 10:32 -------- d-----w- c:\users\Filda\AppData\Local\HYL
2012-09-12 08:29 . 2012-09-12 08:31 -------- d-----w- c:\program files (x86)\Counter-Strike 1.6
2012-09-12 08:01 . 2012-09-12 08:01 -------- d-----w- c:\users\Filda\AppData\Local\Criterion Games
2012-09-12 05:07 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 05:07 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-12 05:07 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2012-09-12 05:07 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 05:07 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 05:07 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 05:07 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 13:30 . 2012-09-11 13:30 -------- d-----w- c:\programdata\WEBREG
2012-09-11 13:30 . 2012-09-11 13:30 -------- d-----w- c:\users\Filda\AppData\Roaming\HP
2012-09-11 13:29 . 2012-09-11 13:29 -------- d-----w- c:\users\Filda\AppData\Local\HP
2012-09-11 13:27 . 2012-09-11 13:27 -------- d-----w- c:\programdata\HP Product Assistant
2012-09-11 13:26 . 2012-09-11 13:26 -------- d-----w- c:\program files (x86)\Common Files\HP
2012-09-11 13:26 . 2012-09-11 13:26 -------- d-----w- c:\program files (x86)\Common Files\Hewlett-Packard
2012-09-11 13:25 . 2012-09-11 13:28 -------- d-----w- c:\program files (x86)\HP
2012-09-11 13:19 . 2009-07-08 10:51 642360 ----a-w- c:\windows\system32\hpzids40.dll
2012-09-11 13:19 . 2009-07-08 10:51 938496 ----a-w- c:\windows\system32\hpowiax7.dll
2012-09-11 13:19 . 2009-07-08 10:51 551424 ----a-w- c:\windows\system32\hppldcoi.dll
2012-09-11 13:19 . 2009-07-08 10:51 505344 ----a-w- c:\windows\system32\hpovst15.dll
2012-09-11 13:19 . 2009-07-08 10:51 740864 ----a-w- c:\windows\system32\hpotscl6.dll
2012-09-11 13:15 . 2012-09-11 13:29 -------- d-----w- c:\programdata\HP
2012-09-11 13:13 . 2012-09-11 13:13 -------- d-----w- c:\programdata\Hewlett-Packard
2012-09-11 13:13 . 2009-07-14 01:41 230400 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll
2012-09-11 06:16 . 2012-10-08 06:51 -------- d-----w- c:\programdata\TrackMania
2012-09-11 06:14 . 2012-09-11 06:34 -------- d-----w- c:\program files (x86)\TrackMania
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 21:38 . 2012-08-27 09:12 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-08 21:38 . 2012-08-27 09:12 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-28 18:15 . 2011-09-29 00:21 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-09-12 12:40 . 2012-08-28 06:56 64462936 ----a-w- c:\windows\system32\MRT.exe
2012-08-30 20:03 . 2012-08-30 20:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2012-03-20 18:44 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-27 17:52 . 2012-08-27 17:52 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-08-27 17:47 . 2012-08-27 17:46 1227264 ----a-w- c:\windows\SysWow64\dx8vb.dll
2012-08-27 17:46 . 2012-08-27 17:46 619008 ----a-w- c:\windows\SysWow64\dx7vb.dll
2012-08-21 11:01 . 2012-08-27 15:31 125872 ----a-w- c:\windows\system32\GEARAspi64.dll
2012-08-21 11:01 . 2012-08-27 15:31 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2012-08-19 23:53 . 2012-08-27 12:55 9309624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E8128B1F-D919-466E-873F-49B96DB51AEF}\mpengine.dll
2012-07-18 18:15 . 2012-08-27 12:55 3148800 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-09-19 15:15 220608 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"="c:\users\Filda\AppData\Local\Seznam.cz\bin\postak.exe" [2012-01-10 491040]
"AirVideoServer"="c:\program files (x86)\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]
"com.apple.dav.bookmarks.daemon"="c:\program files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2012-09-05 59280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-11-10 4144448]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"ASUS Ai Charger"="c:\program files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe" [2010-05-10 465536]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
.
c:\users\Filda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
AirPlay – zástupce.lnk - c:\users\Filda\Desktop\Music\AirPlay.exe [2012-9-9 1262080]
Facebook Messenger.lnk - c:\users\Filda\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]
R3 HSPADataCardusbmdm;HSPADataCard Proprietary USB Driver;c:\windows\system32\DRIVERS\HSPADataCardusbmdm.sys [x]
R3 HSPADataCardusbnmea;HSPADataCard NMEA Port;c:\windows\system32\DRIVERS\HSPADataCardusbnmea.sys [x]
R3 HSPADataCardusbser;HSPADataCard Diagnostic Port;c:\windows\system32\DRIVERS\HSPADataCardusbser.sys [x]
R3 HSPADataCardusbvoice;HSPADataCard VoUSB Port;c:\windows\system32\DRIVERS\HSPADataCardusbvoice.sys [x]
R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys [2012-02-14 164864]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-09 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-27 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2010-05-05 14592]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-08-27 283200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [2011-05-20 146592]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2011-05-20 80032]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-05-20 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-05-20 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-05-20 29344]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-05-20 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-05-20 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-05-20 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-05-20 282272]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-09-19 15:15 244672 ----a-w- c:\users\Filda\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144]
"Stage Remote"="c:\program files (x86)\Dell\Stage Remote\StageRemote.exe" [2011-08-08 2034752]
"AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2011-05-20 627360]
"AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2011-05-20 379552]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://szn.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.3
TCP: Interfaces\{CE780BCA-5594-4309-B899-EB556D5E9622}: NameServer = 8.8.8.8
FF - ProfilePath - c:\users\Filda\AppData\Roaming\Mozilla\Firefox\Profiles\892j6z62.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - szn.cz
FF - prefs.js: keyword.URL -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-DVBViewer Pro Demo_is1 - c:\program files (x86)\DVBViewer Demo\unins000.exe
AddRemove-Fraps - c:\fraps\uninstall.exe
AddRemove-IT9130 DriverInstaller_11.10.19.1 - c:\users\Filda\AppData\Local\Temp\\DriverInstall64.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Dell\Stage Remote\StageRemoteService.exe
c:\program files (x86)\Dell\Stage Remote\DMR.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2012-10-09 08:08:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-10-09 06:08
ComboFix2.txt 2012-10-08 21:00
.
Před spuštěním: Volných bajtů: 481 094 459 392
Po spuštění: Volných bajtů: 481 015 623 680
.
- - End Of File - - B862155B95CAD45894C63312F8D9AE9E
Nahr nˇ probŘhlo ŁspŘçnŘ

[vyosek]

Jak se chova PC

[CoolGujin]

Klasicky, ale mám notebook http://www1.euro.dell.com/content/produ ... JlZ2lvbg== jsou tam 3 funkční mechanické klávesy. Na obrázku číslo 2 v odkazu jsou vidět (v pravo nahoře). První (z leva) spouští "Centrum nastavení mobilních zařízení" - to jede, druhé by mělo spustit nějaké nastavení od Dellu, a třetí talčítko by mělo vypnout displej - posledni dva nefungujou jenom se rosvítí a vypne se (světlo - tlačítka jsou podsvícené). Do posud mi to jelo. Facebook se mi z neznámeho důvodu odblokoval sám

[CoolGujin]

Je to v pořádku Nebo tam ten vir je

[vyosek]

Zabalte mi prosim slozku c:\qoobox a nekam uploadnete

[CoolGujin]

Když chci tu složku zRARovat tak mi winrar napíše: Nelze přečíst obsah souboru C:\Qoobox\BackEnv\*

[vyosek]

Tak tu slozku vynechte

[CoolGujin]

Tady to je http://leteckaposta.cz/305622469

[vyosek]

Muzete mi vysvetlit proc porad odstranujete a znovu pisete ten posledni prispevek

CoolGujin 89.176.143.85 08 říj 2012, 22:39 Odstranění příspěvku
» Re: SKYPE TROJAN - NUTNÉ

CoolGujin 89.176.143.85 09 říj 2012, 17:57 Odstranění příspěvku
» Re: SKYPE TROJAN - NUTNÉ

CoolGujin 89.176.143.85 09 říj 2012, 22:25 Odstranění příspěvku
» Re: SKYPE TROJAN - NUTNÉ

CoolGujin 89.176.143.85 10 říj 2012, 07:17 Odstranění příspěvku
» Re: SKYPE TROJAN - NUTNÉ