Linky na globalvisitorsurvey.com

Zpráva

11188 · #1 Příspěvek od **11188** » 02 Pro 2012 23:06

Zdravím,něco zakerneho se mě přes Avasta dostalo do kompu něco zákeřného a když procházím internet tak mě to neustále mění články na podtržené s odkazem na tento web.Je to i na webovych strankach které jsou moje,proto jsem si toho všiml.

Odkaz změřuje sem:
hxxp://globalvisitorsurvey.com/czech/kviz.php?engsec=7&t202kw=dostat

Když projdete google tak je tam o tom celkem dost napsano:
http://www.google.cz/#hl=cs&tbo=d&sclie ... 80&bih=612

Jinak takto to vypadá:
http://imgbank.cz/images/2012/12/02/5PlsA.jpg

11188 · #2 Příspěvek od **11188** » 02 Pro 2012 23:37

vypada to že to delá jenom na Firefoxu...na IE to je v poradku....

#3 Příspěvek od **vyosek** » 03 Pro 2012 01:40

Zdravim

A po nas chcete co

11188 · #4 Příspěvek od **11188** » 03 Pro 2012 11:13

no já nevím....že by radu???

#5 Příspěvek od **vyosek** » 03 Pro 2012 11:18

Ale z vestecke koule se spatne vesti pac snezi, takze budem muset prejit na osvedcenejsi zpusoby

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=13&t=105895

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Search
Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

11188 · #6 Příspěvek od **11188** » 03 Pro 2012 11:46

Logfile of random's system information tool 1.09 (written by random/random)
Run by Uzivatel at 2012-12-03 11:44:42
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 49 GB (65%) free of 76 GB
Total RAM: 1021 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:44:56, on 3.12.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\intelxpv_v103\wdm\STacSV.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Seznam.cz\bin\postak.exe
C:\Program Files\ICQ7.7\ICQ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
C:\Documents and Settings\Uzivatel\Data aplikací\Dropbox\bin\Dropbox.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Documents and Settings\Uzivatel\Plocha\RSIT.exe
C:\Program Files\trend micro\Uzivatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.3.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Programy\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files\Seznam.cz\bin\postak.exe" -s
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.7\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\intelxpv_v103\wdm\STacSV.exe

--
End of file - 9021 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\YourFile Update.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\xw0bvrk7.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - "http://search.babylon.com/?affID=116775 ... 11727db&q="

"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.110 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@canon.com/EPPEX]
"Description"=Canon Easy-PhotoPrint EX
"Path"=C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\xw0bvrk7.default\extensions\
504af6270027f@504af627002a8.info
{800b5000-a755-47e1-992b-48a1c1357f07}
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Documents and Settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\xw0bvrk7.default\searchplugins\
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-07-03 1160792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-11-22 4529344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-01-12 59272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-08-02 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files\Seznam.cz\core.3.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-07-03 1160792]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2011-08-17 1055808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-03-12 483422]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-07-03 4273976]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-09-30 252296]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [2007-02-04 79400]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2010-07-25 2569616]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ccleaner"=C:\Programy\CCleaner\CCleaner.exe [2011-06-24 2423608]
"Seznam Postak"=C:\Program Files\Seznam.cz\bin\postak.exe [2012-01-10 491040]
"ICQ"=C:\Program Files\ICQ7.7\ICQ.exe [2012-01-23 127040]
"GoogleDriveSync"=C:\Program Files\Google\Drive\googledrivesync.exe /autostart []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-07-13 17418928]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

C:\Documents and Settings\Uzivatel\Nabídka Start\Programy\Po spuštění
Dropbox.lnk - C:\Documents and Settings\Uzivatel\Data aplikací\Dropbox\bin\Dropbox.exe
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-02-11 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\ICQ7.7\ICQ.exe"="C:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"C:\Program Files\TeamViewer\Version7\TeamViewer.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Documents and Settings\Uzivatel\Plocha\Odorik.exe"="C:\Documents and Settings\Uzivatel\Plocha\Odorik.exe:*:Enabled:Odorik.exe"
"C:\Documents and Settings\Uzivatel\Data aplikací\Dropbox\bin\Dropbox.exe"="C:\Documents and Settings\Uzivatel\Data aplikací\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\YourFileDownloader\Downloader.exe"="C:\Program Files\YourFileDownloader\Downloader.exe:*:Enabled:YourFile Downloader"
"C:\Program Files\YourFileDownloader\YourFile.exe"="C:\Program Files\YourFileDownloader\YourFile.exe:*:Enabled:YourFile Downloader"
"C:\Games\World_of_Tanks\WoTLauncher.exe"="C:\Games\World_of_Tanks\WoTLauncher.exe:*:Enabled:World of Tanks Launcher"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.7\ICQ.exe"="C:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FFDS"=C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

======File associations======

.js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"
.reg - edit -
.reg - open - c:\Winnt\Regedit.exe %1

======List of files/folders created in the last 1 month======

2012-12-03 11:44:44 ----D---- C:\Program Files\trend micro
2012-12-03 11:44:42 ----D---- C:\rsit
2012-12-02 14:37:00 ----SHD---- C:\RECYCLER
2012-12-02 14:24:21 ----A---- C:\WINDOWS\zip.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\SWSC.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\SWREG.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\sed.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\PEV.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\NIRCMD.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\MBR.exe
2012-12-02 14:24:21 ----A---- C:\WINDOWS\grep.exe
2012-12-02 14:23:38 ----D---- C:\Qoobox
2012-12-02 14:23:04 ----D---- C:\WINDOWS\erdnt
2012-11-29 22:27:46 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2012-11-29 22:27:46 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2012-11-29 22:27:46 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2012-11-29 22:27:45 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2012-11-29 22:27:44 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2012-11-29 22:27:44 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2012-11-29 22:27:43 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2012-11-29 22:27:43 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2012-11-29 22:27:42 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2012-11-29 22:27:42 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2012-11-29 22:27:41 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2012-11-29 22:27:41 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2012-11-29 22:27:40 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2012-11-29 22:27:40 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2012-11-29 22:27:39 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2012-11-29 22:27:37 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2012-11-29 22:27:36 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2012-11-29 22:27:35 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2012-11-29 22:27:35 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2012-11-29 22:27:34 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2012-11-29 22:27:34 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2012-11-29 22:27:32 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2012-11-29 22:27:31 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2012-11-29 22:27:31 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2012-11-29 22:27:31 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2012-11-29 22:27:30 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2012-11-29 22:27:30 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2012-11-29 22:27:30 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2012-11-29 22:27:29 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2012-11-29 22:27:28 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2012-11-29 22:27:28 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2012-11-29 22:27:27 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2012-11-29 22:27:26 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2012-11-29 22:27:25 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2012-11-29 22:27:25 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2012-11-29 22:27:25 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2012-11-29 22:27:24 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2012-11-29 22:27:24 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2012-11-29 22:27:23 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2012-11-29 22:27:22 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2012-11-29 22:27:22 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2012-11-29 22:27:21 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2012-11-29 22:27:21 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2012-11-29 22:27:20 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2012-11-29 22:27:20 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2012-11-29 22:27:19 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2012-11-29 22:27:18 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2012-11-29 22:27:18 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2012-11-29 22:27:17 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2012-11-29 22:27:16 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2012-11-29 22:27:16 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2012-11-29 22:27:16 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2012-11-29 22:27:15 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2012-11-29 22:27:13 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2012-11-29 22:27:13 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2012-11-29 22:27:13 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2012-11-29 22:27:12 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2012-11-29 22:27:10 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2012-11-29 22:27:10 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2012-11-29 22:27:09 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2012-11-29 22:27:09 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2012-11-29 22:27:09 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2012-11-29 22:27:08 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2012-11-29 22:27:08 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2012-11-29 22:27:07 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2012-11-29 22:27:06 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-11-29 22:27:05 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2012-11-29 22:27:04 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2012-11-29 22:27:04 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2012-11-29 22:27:03 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2012-11-29 22:27:03 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2012-11-29 22:27:02 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2012-11-29 22:27:02 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2012-11-29 22:27:01 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-11-29 22:27:01 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-11-29 22:27:01 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-11-29 22:27:00 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-11-29 22:27:00 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-11-29 22:27:00 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-11-29 22:26:59 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-11-29 22:26:59 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-11-29 22:26:58 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-11-29 22:26:58 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-11-29 22:26:58 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-11-29 22:26:57 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-11-29 22:26:56 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-11-29 22:26:55 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-11-29 22:26:54 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-11-29 22:26:54 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-11-29 22:26:53 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-11-29 22:26:52 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-11-29 22:25:43 ----HD---- C:\WINDOWS\msdownld.tmp
2012-11-29 22:25:39 ----D---- C:\WINDOWS\Logs
2012-11-21 23:33:30 ----D---- C:\Program Files\Microsoft Silverlight
2012-11-21 00:33:33 ----D---- C:\Program Files\Mozilla Firefox
2012-11-17 23:57:47 ----HDC---- C:\WINDOWS\$NtUninstallKB2727528$
2012-11-17 23:57:33 ----HDC---- C:\WINDOWS\$NtUninstallKB2761226$
2012-11-05 20:49:46 ----D---- C:\Documents and Settings\Uzivatel\Data aplikací\Kastner software
2012-11-05 20:49:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\KASTNER software
2012-11-04 23:47:58 ----D---- C:\Program Files\Common Files\ABBYY
2012-11-04 23:44:51 ----D---- C:\Program Files\ABBYY FineReader 9.0
2012-11-04 23:40:45 ----D---- C:\FR90PE_VOL

======List of files/folders modified in the last 1 month======

2012-12-03 11:44:48 ----D---- C:\WINDOWS\Prefetch
2012-12-03 11:44:44 ----RD---- C:\Program Files
2012-12-03 11:25:03 ----D---- C:\Documents and Settings\Uzivatel\Data aplikací\Skype
2012-12-03 11:15:04 ----D---- C:\WINDOWS\Temp
2012-12-03 11:00:57 ----D---- C:\WINDOWS\SoftwareDistribution
2012-12-03 11:00:26 ----D---- C:\WINDOWS
2012-12-03 11:00:11 ----D---- C:\Documents and Settings\Uzivatel\Data aplikací\Dropbox
2012-12-02 23:38:02 ----N---- C:\WINDOWS\SchedLgU.Txt
2012-12-02 22:43:56 ----D---- C:\Program Files\CCleaner
2012-12-02 14:23:42 ----D---- C:\WINDOWS\system32\drivers
2012-11-30 00:36:06 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-29 22:28:00 ----SHD---- C:\WINDOWS\Installer
2012-11-29 22:27:59 ----D---- C:\WINDOWS\WinSxS
2012-11-29 22:27:49 ----D---- C:\WINDOWS\system32\DirectX
2012-11-29 22:27:47 ----D---- C:\WINDOWS\system32
2012-11-29 22:27:46 ----HD---- C:\WINDOWS\inf
2012-11-29 21:33:36 ----D---- C:\Documents and Settings\Uzivatel\Data aplikací\ICQ
2012-11-26 19:16:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2012-11-21 23:33:52 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-11-21 11:42:55 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-11-21 10:52:00 ----D---- C:\Program Files\PhotoFiltre
2012-11-18 09:35:13 ----D---- C:\WINDOWS\Debug
2012-11-18 00:02:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2012-11-18 00:00:20 ----A---- C:\WINDOWS\system32\MRT.exe
2012-11-17 23:57:49 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-11-17 23:56:19 ----A---- C:\WINDOWS\win.ini
2012-11-17 16:54:13 ----HD---- C:\WINDOWS\$hf_mig$
2012-11-12 19:17:20 ----D---- C:\Program Files\McAfee Security Scan
2012-11-11 14:46:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2012-11-11 14:46:18 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-11-04 23:56:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\ABBYY
2012-11-04 23:56:21 ----D---- C:\Program Files\Common Files\Adobe
2012-11-04 23:47:58 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-07-03 25256]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2012-07-03 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-07-03 721000]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-07-03 353688]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-07-03 54232]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-07-03 21256]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-07-03 97608]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-02-11 3565056]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-11-16 165496]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-03-12 1550613]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-24 6784]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2009-11-06 106880]
S3 cpuz133;cpuz133; \??\C:\DOCUME~1\Uzivatel\LOCALS~1\Temp\cpuz133\cpuz133_x32.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 660768]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-02-11 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-07-03 44808]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2011-08-17 247872]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-08-02 153376]
R2 Skype C2C Service;Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-11-22 3290304]
R2 STacSV;Audio Service; c:\program files\idt\intelxpv_v103\wdm\STacSV.exe [2009-03-12 254036]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-01-13 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-11 250808]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-01-13 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [2012-09-05 234776]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-11-21 115168]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]

-----------------EOF-----------------

#7 Příspěvek od **vyosek** » 03 Pro 2012 12:16

Poprosim jeste o ten AdwCleaner

11188 · #8 Příspěvek od **11188** » 03 Pro 2012 14:36

Tak tady to je...snad to bude dobře...

# AdwCleaner v2.011 - Logfile created 12/03/2012 at 14:31:15
# Updated 02/12/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Uzivatel - PC001
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Uzivatel\Plocha\adwcleaner.exe
# Option [Delete]

***** [Services] *****

Stopped & Deleted : ICQ Service

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\Babylon
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\InstallMate
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\Premium
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\wxDfast
Folder Deleted : C:\Documents and Settings\All Users\Nabídka Start\Programy\wxDfast
Folder Deleted : C:\Documents and Settings\Uzivatel\Data aplikací\Babylon
Folder Deleted : C:\Documents and Settings\Uzivatel\Data aplikací\yourfiledownloader
Folder Deleted : C:\Program Files\ICQ6Toolbar

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.dll.bhoclass.dll
Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.dll.bhoclass.dll.1.0
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4F4C5E11-0612-48D2-8055-987992AAC432}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4F4C5E11-0612-48D2-8055-987992AAC432}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=116775&tt=311012_niche_4412_8&babsrc=NT_ss&mntrId=a46fb4d30000000000000019d11727db --> hxxp://www.google.com

*************************

AdwCleaner[R1].txt - [4042 octets] - [03/12/2012 14:30:46]
AdwCleaner[S1].txt - [3823 octets] - [03/12/2012 14:31:15]

########## EOF - C:\AdwCleaner[S1].txt - [3883 octets] ##########

#9 Příspěvek od **vyosek** » 03 Pro 2012 14:45

Dobre to je, jdeme dale

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

11188 · #10 Příspěvek od **11188** » 03 Pro 2012 15:01

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/03/2012 02:58:43 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\WINDOWS\system32\Ati2evxx.exe (PID: 956) [WD-HEUR]
* C:\WINDOWS\system32\Ati2evxx.exe (PID: 1488) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\sfcfiles.dll [NoSig]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 12/03/2012 02:59:47 PM
Execution time: 0 hours(s), 1 minute(s), and 4 seconds(s)

#11 Příspěvek od **vyosek** » 03 Pro 2012 15:39

Fajn, soupnete tam ComboFix

11188 · #12 Příspěvek od **11188** » 03 Pro 2012 17:27

kde ho prosím najdu ten combofix?Ja ho nemohu najít

#13 Příspěvek od **vyosek** » 03 Pro 2012 17:37

Postup mate hned pod postupem na Rkill

11188 · #14 Příspěvek od **11188** » 03 Pro 2012 17:42

jojo

Vyhodilo to tento log:
# AdwCleaner v2.011 - Logfile created 12/03/2012 at 17:40:58
# Updated 02/12/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Uzivatel - PC001
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Uzivatel\Plocha\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [4042 octets] - [03/12/2012 14:30:46]
AdwCleaner[R2].txt - [592 octets] - [03/12/2012 17:40:58]
AdwCleaner[S1].txt - [3952 octets] - [03/12/2012 14:31:15]

########## EOF - C:\AdwCleaner[R2].txt - [711 octets] ##########

#15 Příspěvek od **cernohous13** » 03 Pro 2012 17:46

Trochu se soustřeď, to je log AdwCleaneru

vyosek napsal: PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.

Pokud mate Win XP spustte pod uctem Spravce\Administratora

Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce

Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano

Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste

Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna

Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit

Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte

Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

VIRY.CZ

Linky na globalvisitorsurvey.com

Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com

Re: Linky na globalvisitorsurvey.com