Claro Search - kontrola logu prosíííím

[melanmilan]

Ahoj, chytil jsem clarosearch a nové záložky otevřené ve FF nebo IE jsou otevřeny už s načetlým clarosearch. dá se to nějak zlikvidovat? co jsem se dočetl na netu, tak odinstalovat přes ovládací panely. to jsem udělal ale stejně tam je nějaké harampádí viz: C:\Users\snx\AppData\Roaming\DefaultTab\DefaultTab

Logfile of random's system information tool 1.09 (written by random/random)
Run by sonix at 2012-12-04 16:14:50
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 791 GB (83%) free of 954 GB
Total RAM: 3582 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:14:52, on 4.12.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\WPMP150\miranda32.exe
C:\Windows\system32\RUNDLL32.EXE
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\sonix\Desktop\RSIT.exe
C:\Program Files\trend micro\sonix.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [EasyTuneVI] C:\Program Files\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [DES2] C:\Program Files\GIGABYTE\EnergySaver2\des2.exe state
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\sonix\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Google Update] "C:\Users\sonix\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1375819553-3628044649-1228780745-1015\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1375819553-3628044649-1228780745-1015\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Global Startup: SetPointII.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Acunetix WVS Scheduler v8 (AcuWVSSchedulerv8) - Unknown owner - C:\Program Files\Acunetix\Web Vulnerability Scanner 8\WVSScheduler.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrlAPI - Unknown owner - C:\cygwin\bin\cygrunsrv.exe
O23 - Service: DefaultTabSearch - Unknown owner - C:\Program Files\DefaultTab\DefaultTabSearch.exe
O23 - Service: DefaultTabUpdate - Unknown owner - C:\Users\sonix\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
O23 - Service: DES2 Service for Energy Saving. (DES2 Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe
O23 - Service: DirMngr - Unknown owner - C:\Program Files\GNU\GnuPG\dirmngr.exe
O23 - Service: frameworkPostgreSQL - PostgreSQL Global Development Group - C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JMB36X - Unknown owner - C:\Windows\System32\XSrvSetup.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\Windows\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\Windows\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\Windows\system32\lktsrv.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\Windows\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Realtek87B - Realtek - C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe
O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files\RelevantKnowledge\rlservice.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SAiAdmin - TODO: <Company name> - C:\Windows\System32\SAiAdmin.exe
O23 - Service: SAiDownloader - TODO: <Company name> - C:\Program Files\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe
O23 - Service: SAiDownloaderVista - TODO: <Company name> - C:\Windows\System32\SAiDownloaderVista.exe
O23 - Service: SAiLicSvr - SA International - C:\Windows\System32\SAiLicSvr.exe
O23 - Service: SDLService - Unknown owner - C:\Program Files\Realtek\Smart Dual Lan\SDLService.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Smart TimeLock Service (Smart TimeLock) - Gigabyte Technology CO., LTD. - C:\Program Files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.16\bin\mysqld.exe

--
End of file - 13612 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AmiUpdXp.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.110 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.9.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
NPLV80Win32.dll
NPLV82Win32.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\extensions\
jid1-g0J5YenAv9JWlA@jetpack

C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\
icqplugin-2.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~2\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-11-13 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-11-13 155384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-15 375000]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-03-26 8546848]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-01-19 43632]
"NUSB3MON"=C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2009-11-20 106496]
"EasyTuneVI"=C:\Program Files\GIGABYTE\ET6\ETcall.exe [2007-07-26 20480]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-02-17 81920]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"Kernel and Hardware Abstraction Layer"=C:\Windows\KHALMNPR.EXE [2009-06-17 55824]
"itype"=C:\Program Files\Microsoft IntelliType Pro\itype.exe [2009-11-05 1505144]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2012-09-12 947176]
"NeroFilterCheck"=C:\Windows\system32\NeroCheck.exe [2006-01-12 155648]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"DES2"=C:\Program Files\GIGABYTE\EnergySaver2\des2.exe [2010-04-15 354856]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2005-02-17 221184]
"AdobeBridge"= []
"Facebook Update"=C:\Users\sonix\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver []
"Google Update"=C:\Users\sonix\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-27 116648]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06 500208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-07-22 402432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2011-08-19 421736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2011-07-05 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmware-tray]
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe [2012-06-09 129688]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
SetPointII.lnk - C:\Program Files\Logitech\SetPoint II\SetpointII.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\xchat\xchat.exe"="C:\Program Files\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.l3fhg"=mp3fhg.acm
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"VIDC.FFDS"=ff_vfw.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.VMnc"=vmnc.dll
"msacm.siren"=sirenacm.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-12-04 16:14:50 ----D---- C:\rsit
2012-12-04 16:14:50 ----D---- C:\Program Files\trend micro
2012-12-02 00:38:23 ----D---- C:\Program Files\Common Files\Skype
2012-12-02 00:38:20 ----RD---- C:\Program Files\Skype
2012-11-23 19:39:38 ----D---- C:\Users\sonix\AppData\Roaming\NVIDIA
2012-11-23 15:43:03 ----A---- C:\Windows\EngineExe.INI
2012-11-21 16:51:38 ----A---- C:\Windows\PanelExe.INI
2012-11-21 16:50:46 ----D---- C:\Users\sonix\AppData\Roaming\Mobile Action
2012-11-21 16:50:44 ----D---- C:\Program Files\Mobile Action
2012-11-18 14:52:30 ----A---- C:\Windows\NeroDigital.ini
2012-11-16 16:14:17 ----D---- C:\Program Files\GSC Game World
2012-11-14 03:04:02 ----A---- C:\Windows\system32\Wdfres.dll
2012-11-14 03:04:02 ----A---- C:\Windows\system32\drivers\WdfLdr.sys
2012-11-14 03:04:02 ----A---- C:\Windows\system32\drivers\Wdf01000.sys
2012-11-14 03:03:27 ----A---- C:\Windows\system32\WUDFSvc.dll
2012-11-14 03:03:27 ----A---- C:\Windows\system32\WUDFPlatform.dll
2012-11-14 03:03:27 ----A---- C:\Windows\system32\drivers\WUDFRd.sys
2012-11-14 03:03:27 ----A---- C:\Windows\system32\drivers\WUDFPf.sys
2012-11-14 03:03:26 ----A---- C:\Windows\system32\WUDFx.dll
2012-11-14 03:03:26 ----A---- C:\Windows\system32\WUDFHost.exe
2012-11-14 03:03:26 ----A---- C:\Windows\system32\WUDFCoinstaller.dll
2012-11-14 00:15:45 ----A---- C:\Windows\system32\netcorehc.dll
2012-11-14 00:15:45 ----A---- C:\Windows\system32\ncsi.dll
2012-11-14 00:15:45 ----A---- C:\Windows\system32\iphlpsvc.dll
2012-11-14 00:15:45 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-11-14 00:15:44 ----A---- C:\Windows\system32\nlasvc.dll
2012-11-14 00:15:43 ----A---- C:\Windows\system32\nlaapi.dll
2012-11-14 00:15:43 ----A---- C:\Windows\system32\netevent.dll
2012-11-14 00:15:43 ----A---- C:\Windows\system32\drivers\tcpipreg.sys
2012-11-14 00:15:38 ----A---- C:\Windows\system32\synceng.dll
2012-11-14 00:15:37 ----A---- C:\Windows\system32\win32k.sys
2012-11-14 00:15:36 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2012-11-14 00:15:36 ----A---- C:\Windows\system32\dhcpcore6.dll
2012-11-13 08:01:15 ----D---- C:\Program Files\Common Files\Java
2012-11-13 08:00:57 ----A---- C:\Windows\system32\javaws.exe
2012-11-13 08:00:47 ----A---- C:\Windows\system32\WindowsAccessBridge.dll
2012-11-13 08:00:47 ----A---- C:\Windows\system32\javaw.exe
2012-11-13 08:00:47 ----A---- C:\Windows\system32\java.exe
2012-11-13 06:02:04 ----A---- C:\Windows\wininit.ini
2012-11-13 05:37:19 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-11-13 05:22:57 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-11-10 20:04:41 ----D---- C:\Program Files\DefaultTab
2012-11-10 20:04:35 ----D---- C:\Users\sonix\AppData\Roaming\DefaultTab
2012-11-10 19:18:42 ----N---- C:\Windows\system32\drivers\imagesrv.sys
2012-11-10 19:18:42 ----N---- C:\Windows\system32\drivers\imagedrv.sys
2012-11-10 19:18:33 ----N---- C:\Windows\system32\TwnLib4.dll
2012-11-10 19:18:33 ----N---- C:\Windows\system32\ImagXRA7.dll
2012-11-10 19:18:33 ----N---- C:\Windows\system32\ImagXR7.dll
2012-11-10 19:18:33 ----N---- C:\Windows\system32\ImagXpr7.dll
2012-11-10 19:18:33 ----N---- C:\Windows\system32\ImagX7.dll
2012-11-10 19:18:33 ----D---- C:\Program Files\Common Files\Ahead
2012-11-10 19:18:33 ----D---- C:\Program Files\Ahead
2012-11-10 19:18:33 ----A---- C:\Windows\system32\TwnLib20.dll
2012-11-10 19:18:33 ----A---- C:\Windows\system32\NeroCheck.exe

======List of files/folders modified in the last 1 month======

2012-12-04 16:14:52 ----D---- C:\Windows\Prefetch
2012-12-04 16:14:50 ----RD---- C:\Program Files
2012-12-04 16:07:07 ----D---- C:\Windows\Temp
2012-12-04 15:45:47 ----D---- C:\Windows\System32
2012-12-04 15:45:47 ----D---- C:\Windows\inf
2012-12-04 15:45:47 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-12-04 14:03:28 ----D---- C:\Windows\system32\config
2012-12-04 02:00:18 ----SHD---- C:\System Volume Information
2012-12-03 16:01:14 ----D---- C:\Windows\Tasks
2012-12-02 00:38:42 ----D---- C:\Users\sonix\AppData\Roaming\Skype
2012-12-02 00:38:29 ----SHD---- C:\Windows\Installer
2012-12-02 00:38:29 ----D---- C:\ProgramData\Skype
2012-12-02 00:38:23 ----D---- C:\Program Files\Common Files
2012-12-01 14:45:27 ----D---- C:\ProgramData\Adobe
2012-12-01 14:44:52 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-11-28 12:29:26 ----A---- C:\functionalLog.txt
2012-11-28 12:29:25 ----D---- C:\Program Files\Mozilla Firefox
2012-11-28 03:00:30 ----D---- C:\Windows\winsxs
2012-11-28 03:00:23 ----D---- C:\Windows\AppPatch
2012-11-28 01:57:52 ----D---- C:\Windows\system32\catroot
2012-11-28 01:57:51 ----D---- C:\Windows\system32\catroot2
2012-11-27 20:16:31 ----D---- C:\Windows\rescache
2012-11-27 19:29:03 ----D---- C:\ProgramData\VMware
2012-11-27 19:28:57 ----D---- C:\Windows
2012-11-27 19:28:42 ----D---- C:\ProgramData\NVIDIA
2012-11-26 21:46:04 ----D---- C:\Windows\system32\cs-CZ
2012-11-22 09:08:32 ----D---- C:\Program Files\Opera
2012-11-19 12:10:49 ----D---- C:\Users\sonix\AppData\Roaming\gtk-2.0
2012-11-16 17:37:43 ----D---- C:\Windows\system32\drivers
2012-11-16 17:27:51 ----D---- C:\Windows\system32\Tasks
2012-11-16 16:44:37 ----D---- C:\Windows\Microsoft.NET
2012-11-16 16:42:09 ----RSD---- C:\Windows\assembly
2012-11-16 12:51:42 ----A---- C:\Windows\system32\MRT.exe
2012-11-16 12:51:29 ----RD---- C:\Users
2012-11-16 12:51:27 ----D---- C:\Program Files\NVIDIA Corporation
2012-11-16 12:50:49 ----D---- C:\Temp
2012-11-16 12:49:09 ----D---- C:\Windows\system32\DriverStore
2012-11-14 03:22:21 ----RSD---- C:\Windows\Fonts
2012-11-14 03:22:21 ----D---- C:\Windows\PolicyDefinitions
2012-11-14 03:22:20 ----D---- C:\Windows\system32\wbem
2012-11-14 03:22:20 ----D---- C:\Windows\system32\migration
2012-11-14 03:22:20 ----D---- C:\Windows\system32\drivers\cs-CZ
2012-11-14 03:06:42 ----D---- C:\ProgramData\Microsoft Help
2012-11-14 03:00:53 ----A---- C:\Windows\win.ini
2012-11-13 08:00:36 ----A---- C:\Windows\system32\npdeployJava1.dll
2012-11-13 08:00:35 ----A---- C:\Windows\system32\deployJava1.dll
2012-11-13 08:00:34 ----D---- C:\Program Files\Java
2012-11-13 05:24:46 ----SD---- C:\ProgramData\Microsoft
2012-11-13 05:22:57 ----HD---- C:\ProgramData
2012-11-13 04:25:06 ----A---- C:\Windows\ntbtlog.txt
2012-11-13 04:03:18 ----D---- C:\Windows\system32\wfp
2012-11-13 04:03:15 ----D---- C:\Program Files\CDBurnerXP
2012-11-13 04:03:14 ----D---- C:\Windows\registration
2012-11-13 03:58:13 ----D---- C:\Windows\system32\LogFiles
2012-11-12 23:56:10 ----D---- C:\Windows\debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-01-27 98928]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-08-30 193552]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2009-07-09 45200]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-22 19496]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-20 218688]
R1 hwinterface;hwinterface; C:\Windows\System32\Drivers\hwinterface.sys [2012-06-02 3026]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2012-02-06 231376]
R2 cvintdrv;cvintdrv; C:\Windows\system32\drivers\cvintdrv.sys [2006-07-27 4096]
R2 hcmon;VMware hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [2012-06-09 32408]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 99272]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35088]
R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2010-01-21 27648]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2012-11-27 17488]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-03-26 3048096]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2009-11-20 58880]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2009-11-20 137728]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2010-06-21 105576]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
R3 rtkio;rtkio; \??\C:\Program Files\Realtek\Smart Dual Lan\rtkio.sys [2010-01-21 5760]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2010-03-04 277536]
R3 USBlyzer;USBlyzer Capture Driver; C:\Windows\system32\DRIVERS\USBlyzer.sys [2011-12-20 99488]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 androidusb;ADB Interface Driver; C:\Windows\System32\Drivers\androidusb.sys [2010-04-29 26112]
S3 arusb_win7;Atheros 11n Wireless LAN device driver; C:\Windows\system32\DRIVERS\arusb_win7.sys [2010-04-27 624128]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 EC168BDA;EC168BDA service; C:\Windows\system32\DRIVERS\EC168BDA.sys [2006-11-29 107904]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2007-09-07 27672]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2011-10-28 17488]
S3 FTDIBUS;USB Serial Converter Driver; C:\Windows\system32\drivers\ftdibus.sys [2009-10-22 57800]
S3 FTSER2K;USB Serial Port Driver; C:\Windows\system32\drivers\ftser2k.sys [2009-10-22 72520]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\rtl8187.sys [2010-01-07 375808]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SiwvidStart;SiwvidStart; \??\C:\Users\sonix\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\siwvid.sys []
S3 SNTNLUSB;SafeNet USB SuperPro/UltraPro/HardwareKey; C:\Windows\system32\DRIVERS\SNTNLUSB.SYS [2008-07-11 37088]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2011-05-10 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S4 RsFx0150;RsFx0150 Driver; C:\Windows\system32\DRIVERS\RsFx0150.sys [2010-04-03 240608]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcuWVSSchedulerv8;Acunetix WVS Scheduler v8; C:\Program Files\Acunetix\Web Vulnerability Scanner 8\WVSScheduler.exe [2012-09-11 1011296]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-05-25 37664]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-07-12 387944]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DefaultTabSearch;DefaultTabSearch; C:\Program Files\DefaultTab\DefaultTabSearch.exe [2012-11-08 568832]
R2 DefaultTabUpdate;DefaultTabUpdate; C:\Users\sonix\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe [2012-11-10 107520]
R2 DES2 Service;DES2 Service for Energy Saving.; C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
R2 DirMngr;DirMngr; C:\Program Files\GNU\GnuPG\dirmngr.exe [2011-03-02 224256]
R2 frameworkPostgreSQL;frameworkPostgreSQL; C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N frameworkPostgreSQL -D C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data []
R2 JMB36X;JMB36X; C:\Windows\System32\XSrvSetup.exe [2010-01-19 72304]
R2 LkCitadelServer;Lookout Citadel Server; C:\Windows\system32\lkcitdl.exe [2006-06-19 688190]
R2 lkClassAds;National Instruments PSP Server Locator; C:\Windows\system32\lkads.exe [2006-07-25 45056]
R2 lkTimeSync;National Instruments Time Synchronization; C:\Windows\system32\lktsrv.exe [2006-07-25 57344]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-09-12 20472]
R2 NIDomainService;National Instruments Domain Service; C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe [2006-07-25 200704]
R2 niSvcLoc;NI Service Locator; C:\Windows\system32\nisvcloc.exe [2006-02-06 49152]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-10-02 645992]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-10-10 1258856]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2012-06-21 76888]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2010-03-10 189728]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Realtek87B;Realtek87B; C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
R2 SAiAdmin;SAiAdmin; C:\Windows\System32\SAiAdmin.exe [2007-08-27 65536]
R2 SAiDownloader;SAiDownloader; C:\Program Files\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe [2007-09-11 417792]
R2 SAiDownloaderVista;SAiDownloaderVista; C:\Windows\System32\SAiDownloaderVista.exe [2007-09-11 77824]
R2 SAiLicSvr;SAiLicSvr; C:\Windows\System32\SAiLicSvr.exe [2007-12-19 86016]
R2 SentinelKeysServer;Sentinel Keys Server; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2008-07-11 328992]
R2 Smart TimeLock;Smart TimeLock Service; C:\Program Files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2012-02-11 105048]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]
R2 TeamViewer7;TeamViewer 7; C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-12 287824]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 6to4;Microsoft 6to4 Adapter; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-07-08 104912]
S2 RelevantKnowledge;RelevantKnowledge; C:\Program Files\RelevantKnowledge\rlservice.exe /service []
S2 SDLService;SDLService; C:\Program Files\Realtek\Smart Dual Lan\SDLService.exe [2010-03-26 84512]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-11-09 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-01 250808]
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BrlAPI;BrlAPI; C:\cygwin\bin\cygrunsrv.exe [2008-03-18 68096]
S3 fussvc;Windows App Certification Kit Fast User Switching Utility Service; C:\Program Files\Windows Kits\8.0\App Certification Kit\fussvc.exe [2012-07-25 133632]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-05-09 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-08-19 821096]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
S3 MsDtsServer100;SQL Server Integration Services 10.0; C:\Program Files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2011-04-24 214880]
S3 MSOLAP$SQLSERVER;SQL Server Analysis Services (SQLSERVER); C:\Program Files\Microsoft SQL Server\MSAS10_50.SQLSERVER\OLAP\bin\msmdsrv.exe [2010-04-03 25768800]
S3 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S3 MSSQL$SQLSERVER;SQL Server (SQLSERVER); C:\Program Files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\sqlservr.exe [2011-04-24 42872672]
S3 MSSQLFDLauncher$SQLSERVER;SQL Full-text Filter Daemon Launcher (SQLSERVER); C:\Program Files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\fdlauncher.exe [2010-04-03 28512]
S3 NILM License Manager;NILM License Manager; C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe [2006-06-27 1007616]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ReportServer$SQLSERVER;SQL Server Reporting Services (SQLSERVER); C:\Program Files\Microsoft SQL Server\MSRS10_50.SQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2011-04-24 1177952]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2010-06-25 117264]
S3 SQLAgent$SQLSERVER;SQL Server Agent (SQLSERVER); C:\Program Files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\SQLAGENT.EXE [2011-04-24 367456]
S3 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2010-04-03 267616]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 Te.Service;Te.Service; C:\Program Files\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [2012-07-25 94208]
S3 ufad-ws60;VMware Agent Service; C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe [2010-08-19 191024]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2012-07-08 46528]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2010-12-10 44384]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 44896]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2008-07-29 3201024]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-08 139680]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-08 139680]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-08 139680]

-----------------EOF-----------------

[vyosek]

Zdravim

Odinstaluje Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Search
• Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

[melanmilan]

# AdwCleaner v2.011 - Logfile created 12/04/2012 at 16:43:34
# Updated 02/12/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : sonix - SONIX-PC
# Boot Mode : Normal
# Running from : C:\Users\sonix\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : DefaultTabSearch
Found : DefaultTabUpdate
Found : RelevantKnowledge

***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\bprotector_prefs.js
File Found : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin.xml
File Found : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin-2.xml
File Found : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin-3.xml
File Found : C:\Windows\system32\conduitEngine.tmp
Folder Found : C:\Program Files\DefaultTab
Folder Found : C:\Program Files\ICQ6Toolbar
Folder Found : C:\ProgramData\ICQ\ICQToolbar
Folder Found : C:\Users\sonix\AppData\Local\Conduit
Folder Found : C:\Users\sonix\AppData\Local\SwvUpdater
Folder Found : C:\Users\sonix\AppData\LocalLow\Conduit
Folder Found : C:\Users\sonix\AppData\LocalLow\PriceGong
Folder Found : C:\Users\sonix\AppData\Roaming\DefaultTab
Folder Found : C:\Users\sonix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\DefaultTab
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKCU\Software\Default Tab
Key Found : HKCU\Software\DefaultTab
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2790392
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\DataMngr
Key Found : HKLM\Software\Default Tab
Key Found : HKLM\Software\DefaultTab
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome
Key Found : HKU\S-1-5-21-1375819553-3628044649-1228780745-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Value Found : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
[HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220

-\\ Mozilla Firefox v14.0.1 (cs)

Profile name : default
File : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v23.0.1271.95

File : C:\Users\sonix\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.8] : homepage = "hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220",
Found [l.12] : urls_to_restore_on_startup = [ "hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220" ]
Found [l.1379] : homepage = "hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220",
Found [l.1632] : urls_to_restore_on_startup = [ "hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220" ]

-\\ Opera v12.11.1661.0

File : C:\Users\sonix\AppData\Roaming\Opera\Opera\operaprefs.ini

Found : HostName Web Lookup Address=hxxp://search.icq.com/search/afe_results.php?q=%s&ch_id=osd&icid=opera

*************************

AdwCleaner[R1].txt - [5147 octets] - [04/12/2012 16:43:34]

########## EOF - C:\AdwCleaner[R1].txt - [5207 octets] ##########

[vyosek]

Spustte znovu AdwCleaner

• Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete na Delete
• PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

[melanmilan]

# AdwCleaner v2.011 - Logfile created 12/04/2012 at 16:50:39
# Updated 02/12/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : sonix - SONIX-PC
# Boot Mode : Normal
# Running from : C:\Users\sonix\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : DefaultTabSearch
Stopped & Deleted : DefaultTabUpdate
Stopped & Deleted : RelevantKnowledge

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\bprotector_prefs.js
File Deleted : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin.xml
File Deleted : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin-2.xml
File Deleted : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\searchplugins\icqplugin-3.xml
File Deleted : C:\Windows\system32\conduitEngine.tmp
Folder Deleted : C:\Program Files\DefaultTab
Folder Deleted : C:\Program Files\ICQ6Toolbar
Folder Deleted : C:\ProgramData\ICQ\ICQToolbar
Folder Deleted : C:\Users\sonix\AppData\Local\Conduit
Folder Deleted : C:\Users\sonix\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\sonix\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\sonix\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\sonix\AppData\Roaming\DefaultTab
Folder Deleted : C:\Users\sonix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\Default Tab
Key Deleted : HKCU\Software\DefaultTab
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2790392
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Default Tab
Key Deleted : HKLM\Software\DefaultTab
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page]
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://www.claro-search.com/?affID=116690&tt=4 ... 6f65926220 --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (cs)

Profile name : default
File : C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\prefs.js

C:\Users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\user.js ... Deleted !

[OK] File is clean.

-\\ Google Chrome v23.0.1271.95

File : C:\Users\sonix\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.8] : homepage = "hxxp://www.claro-search.com/?affID=116690&tt=4 ... =a8674c930[...]
Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://www.claro-search.com/?affID=116690&tt=4512_7&babsrc[...]
Deleted [l.1379] : homepage = "hxxp://www.claro-search.com/?affID=116690&tt=4 ... 674c930000[...]
Deleted [l.1632] : urls_to_restore_on_startup = [ "hxxp://www.claro-search.com/?affID=116690&tt=4512_7&babsrc=HP[...]

-\\ Opera v12.11.1661.0

File : C:\Users\sonix\AppData\Roaming\Opera\Opera\operaprefs.ini

Deleted : HostName Web Lookup Address=hxxp://search.icq.com/search/afe_results.php?q=%s&ch_id=osd&icid=opera

*************************

AdwCleaner[R1].txt - [5276 octets] - [04/12/2012 16:43:34]
AdwCleaner[R2].txt - [5336 octets] - [04/12/2012 16:47:42]
AdwCleaner[S1].txt - [5195 octets] - [04/12/2012 16:50:39]

########## EOF - C:\AdwCleaner[S1].txt - [5255 octets] ##########

[vyosek]

Poprosim o log z DDS http://forum.viry.cz/viewtopic.php?f=30&t=125172

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[melanmilan]

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.9.2
Run by sonix at 16:57:26 on 2012-12-04
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.3582.1715 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Acunetix\Web Vulnerability Scanner 8\WVSScheduler.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe
C:\Program Files\GNU\GnuPG\dirmngr.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\pg_ctl.exe
C:\Windows\System32\XSrvSetup.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\lkcitdl.exe
C:\Windows\system32\lkads.exe
C:\Windows\system32\lktsrv.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\PROGRA~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
C:\Windows\system32\nisvcloc.exe
C:\Windows\system32\PnkBstrA.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe
C:\Windows\System32\SAiAdmin.exe
C:\Program Files\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe
C:\Windows\System32\SAiDownloaderVista.exe
C:\Windows\System32\SAiLicSvr.exe
C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\Windows\system32\vmnat.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\vmnetdhcp.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Opera\opera.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\GIGABYTE\Smart6\Timelock\AlarmClock.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mURLSearchHooks: <No Name>: - LocalServer32 - <no file>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
uRun: [AdobeBridge] <no file>
mRun: [BCU] "c:\program files\devicevm\browser configuration utility\BCU.exe"
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [NUSB3MON] "c:\program files\nec electronics\usb 3.0 host controller driver\application\nusb3mon.exe"
mRun: [EasyTuneVI] c:\program files\gigabyte\et6\ETcall.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Windows Mobile Device Center] c:\windows\windowsmobile\wmdc.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRunOnce: [DES2] c:\program files\gigabyte\energysaver2\des2.exe state
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\setpoi~1.lnk - c:\program files\logitech\setpoint ii\SetpointII.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
TCP: NameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{240131DD-466C-48EF-81A5-3C74227B123B} : DHCPNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{240131DD-466C-48EF-81A5-3C74227B123B}\454545 : DHCPNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{7E837EAA-C07D-42EF-8A30-295B46DED16A} : DHCPNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{A86870D7-0D83-425F-BA1C-07807EEB2895} : DHCPNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{A86870D7-0D83-425F-BA1C-07807EEB2895}\454545 : DHCPNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
TCP: Interfaces\{A86870D7-0D83-425F-BA1C-07807EEB2895}\7596D264960225F657475627028647 : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\sonix\appdata\roaming\mozilla\firefox\profiles\3sleeqx7.default\
FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV80Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV82Win32.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\users\sonix\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_110.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2011-6-19 19496]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-6-20 218688]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2012-6-2 3026]
R1 MpKsle7ad66a8;MpKsle7ad66a8;c:\programdata\microsoft\microsoft antimalware\definition updates\{9dede880-11d1-4cdc-bf30-2ac7d72f7ae0}\MpKsle7ad66a8.sys [2012-12-4 29904]
R2 AcuWVSSchedulerv8;Acunetix WVS Scheduler v8;c:\program files\acunetix\web vulnerability scanner 8\WVSScheduler.exe [2012-9-15 1011296]
R2 BCUService;Browser Configuration Utility Service;c:\program files\devicevm\browser configuration utility\BCUService.exe [2009-10-15 223464]
R2 DES2 Service;DES2 Service for Energy Saving.;c:\program files\gigabyte\energysaver2\des2svr.exe [2011-6-19 68136]
R2 DirMngr;DirMngr;c:\program files\gnu\gnupg\dirmngr.exe [2011-3-2 224256]
R2 frameworkPostgreSQL;frameworkPostgreSQL;C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N "frameworkPostgreSQL" -D "C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data" --> C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N frameworkPostgreSQL [?]
R2 JMB36X;JMB36X;c:\windows\system32\XSrvSetup.exe [2011-6-19 72304]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 99272]
R2 Realtek87B;Realtek87B;c:\program files\realtek\rtl8187 wireless lan utility\RtlService.exe [2011-7-4 40960]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2011-6-19 27648]
R2 SAiAdmin;SAiAdmin;c:\windows\system32\SAiAdmin.exe [2012-1-22 65536]
R2 SAiDownloader;SAiDownloader;c:\program files\secabo\flexistarter secabo edition\program\SAiDownloaderVistaUI.exe [2012-1-22 417792]
R2 SAiDownloaderVista;SAiDownloaderVista;c:\windows\system32\SAiDownloaderVista.exe [2012-1-22 77824]
R2 SAiLicSvr;SAiLicSvr;c:\windows\system32\SAiLicSvr.exe [2012-1-22 86016]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2008-7-11 328992]
R2 Smart TimeLock;Smart TimeLock Service;c:\program files\gigabyte\smart6\timelock\TimeMgmtDaemon.exe [2011-6-19 114688]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-10-2 382824]
R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-1-25 3027840]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2012-6-9 539288]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\microsoft security client\NisSrv.exe [2012-9-12 287824]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2009-11-20 58880]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2009-11-20 137728]
R3 rtkio;rtkio;c:\program files\realtek\smart dual lan\rtkio.sys [2011-6-19 5760]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-6-19 277536]
R3 USBlyzer;USBlyzer Capture Driver;c:\windows\system32\drivers\USBlyzer.sys [2011-12-20 99488]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2009-2-13 11520]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-7-8 104912]
S2 SDLService;SDLService;c:\program files\realtek\smart dual lan\SDLService.exe [2011-6-19 84512]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-11-9 160944]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2010-4-29 26112]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 arusb_win7;Atheros 11n Wireless LAN device driver;c:\windows\system32\drivers\arusb_win7.sys [2011-8-17 624128]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 BrlAPI;BrlAPI;c:\cygwin\bin\cygrunsrv.exe [2011-7-2 68096]
S3 EC168BDA;EC168BDA service;c:\windows\system32\drivers\EC168BDA.sys [2006-11-29 107904]
S3 etdrv;etdrv;c:\windows\etdrv.sys [2011-10-28 17488]
S3 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\microsoft sql server\100\dts\binn\MsDtsSrvr.exe [2011-4-24 214880]
S3 MSOLAP$SQLSERVER;SQL Server Analysis Services (SQLSERVER);c:\program files\microsoft sql server\msas10_50.sqlserver\olap\bin\msmdsrv.exe [2010-4-3 25768800]
S3 MSSQL$SQLSERVER;SQL Server (SQLSERVER);c:\program files\microsoft sql server\mssql10_50.sqlserver\mssql\binn\sqlservr.exe [2011-4-24 42872672]
S3 MSSQLFDLauncher$SQLSERVER;SQL Full-text Filter Daemon Launcher (SQLSERVER);c:\program files\microsoft sql server\mssql10_50.sqlserver\mssql\binn\fdlauncher.exe [2010-4-3 28512]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-6-21 15872]
S3 ReportServer$SQLSERVER;SQL Server Reporting Services (SQLSERVER);c:\program files\microsoft sql server\msrs10_50.sqlserver\reporting services\reportserver\bin\ReportingServicesService.exe [2011-4-24 1177952]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187.sys [2011-7-4 375808]
S3 SQLAgent$SQLSERVER;SQL Server Agent (SQLSERVER);c:\program files\microsoft sql server\mssql10_50.sqlserver\mssql\binn\SQLAGENT.EXE [2011-4-24 367456]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 Te.Service;Te.Service;c:\program files\windows kits\8.0\testing\runtimes\taef\Wex.Services.exe [2012-7-25 94208]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-21 52224]
S3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\wat\WatAdminSvc.exe [2011-6-20 1343400]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-4-3 44896]
S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [2010-4-3 240608]
SUnknown GVTDrv;GVTDrv; [x]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=c:\windows\system32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2012-12-04 15:52:54 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{9dede880-11d1-4cdc-bf30-2ac7d72f7ae0}\MpKsle7ad66a8.sys
2012-12-04 15:14:50 -------- d-----w- c:\program files\trend micro
2012-12-03 13:11:06 6812136 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{9dede880-11d1-4cdc-bf30-2ac7d72f7ae0}\mpengine.dll
2012-12-02 11:42:12 6812136 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-12-01 23:38:20 -------- d-----r- c:\program files\Skype
2012-11-29 01:31:19 740840 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4574dcba-1b19-456a-9b5a-1852db3f24af}\gapaengine.dll
2012-11-23 18:39:38 -------- d-----w- c:\users\sonix\appdata\roaming\NVIDIA
2012-11-21 15:50:46 -------- d-----w- c:\users\sonix\appdata\roaming\Mobile Action
2012-11-21 15:50:44 -------- d-----w- c:\program files\Mobile Action
2012-11-16 15:14:17 -------- d-----w- c:\program files\GSC Game World
2012-11-16 11:50:29 3536817 ----a-w- c:\windows\system32\nvcoproc.bin
2012-11-14 02:04:02 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-14 02:04:02 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-14 02:04:02 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-14 02:03:27 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-14 02:03:27 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-14 02:03:27 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-14 02:03:27 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-14 02:03:26 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-14 02:03:26 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-14 02:03:26 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-13 23:15:45 499712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-11-13 23:15:45 175104 ----a-w- c:\windows\system32\netcorehc.dll
2012-11-13 23:15:45 156672 ----a-w- c:\windows\system32\ncsi.dll
2012-11-13 23:15:45 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-11-13 23:15:44 242176 ----a-w- c:\windows\system32\nlasvc.dll
2012-11-13 23:15:43 52224 ----a-w- c:\windows\system32\nlaapi.dll
2012-11-13 23:15:43 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-11-13 23:15:43 18944 ----a-w- c:\windows\system32\netevent.dll
2012-11-13 23:15:38 78336 ----a-w- c:\windows\system32\synceng.dll
2012-11-13 23:15:37 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-11-13 23:15:36 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-11-13 23:15:36 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-11-13 07:00:47 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-13 04:37:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-11-13 04:22:57 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-11-10 18:27:13 -------- d-----w- c:\users\sonix\appdata\local\Ahead
2012-11-10 18:18:42 5888 ------w- c:\windows\system32\drivers\imagedrv.sys
2012-11-10 18:18:42 127488 ------w- c:\windows\system32\drivers\imagesrv.sys
2012-11-10 18:18:33 476320 ------w- c:\windows\system32\ImagXpr7.dll
2012-11-10 18:18:33 471040 ------w- c:\windows\system32\ImagXRA7.dll
2012-11-10 18:18:33 364544 ------w- c:\windows\system32\TwnLib4.dll
2012-11-10 18:18:33 262144 ------w- c:\windows\system32\ImagXR7.dll
2012-11-10 18:18:33 1568768 ------w- c:\windows\system32\ImagX7.dll
2012-11-10 18:18:33 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2012-11-10 18:18:33 106496 ----a-w- c:\windows\system32\TwnLib20.dll
.
==================== Find3M ====================
.
2012-12-04 15:53:38 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-12-04 15:53:15 17488 ----a-w- c:\windows\gdrv.sys
2012-12-01 13:44:52 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-01 13:44:52 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-13 07:00:36 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-13 07:00:35 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-16 07:39:52 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-10 20:15:28 831848 ----a-w- c:\windows\system32\nvumdshim.dll
2012-10-10 20:15:04 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15:00 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14:50 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14:50 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14:46 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14:44 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14:42 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14:28 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14:22 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14:22 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14:18 202600 ----a-w- c:\windows\system32\nvinit.dll
2012-10-10 20:14:16 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14:16 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-02 19:29:42 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-10-02 19:29:41 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-10-02 19:29:41 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-10-02 19:29:41 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-10-02 19:29:22 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-10-02 19:28:53 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-10-02 12:15:52 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-09-14 18:28:53 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-09 19:17:36 111960 ----a-w- c:\windows\dxsdkuninst.exe
.
============= FINISH: 16:58:48,34 ===============

[vyosek]

Pockam si na ComboFix

[melanmilan]

Omlouvám se, ale trvalo to dlouho a nemohl jsem to zrychlit:

ComboFix 12-12-02.01 - sonix 04.12.2012 17:03:25.1.8 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.3582.1692 [GMT 1:00]
Spuštěný z: c:\users\sonix\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\sonix\.msf3
c:\users\sonix\.msf3\history
c:\users\sonix\.msf3\logs\framework.log
c:\users\sonix\.msf3\modcache
c:\users\sonix\.msf3\msfgui
c:\users\sonix\AppData\Local\assembly\tmp
c:\windows\inf\ndiscap64.inf
c:\windows\iun6002.exe
c:\windows\security\Database\tmp.edb
c:\windows\system32\c6to4.dll
c:\windows\system32\command.pif
c:\windows\system32\d2d1debug1.dll
c:\windows\system32\DEBUG.log
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\drivers\hwinterface.sys
c:\windows\system32\html
c:\windows\system32\html\calendar.html
c:\windows\system32\html\calendarbottom.html
c:\windows\system32\html\calendartop.html
c:\windows\system32\html\crystalexportdialog.htm
c:\windows\system32\html\crystalprinthost.html
c:\windows\system32\images
c:\windows\system32\images\toolbar\calendar.gif
c:\windows\system32\images\toolbar\crlogo.gif
c:\windows\system32\images\toolbar\export.gif
c:\windows\system32\images\toolbar\export_over.gif
c:\windows\system32\images\toolbar\exportd.gif
c:\windows\system32\images\toolbar\First.gif
c:\windows\system32\images\toolbar\first_over.gif
c:\windows\system32\images\toolbar\Firstd.gif
c:\windows\system32\images\toolbar\gotopage.gif
c:\windows\system32\images\toolbar\gotopage_over.gif
c:\windows\system32\images\toolbar\gotopaged.gif
c:\windows\system32\images\toolbar\grouptree.gif
c:\windows\system32\images\toolbar\grouptree_over.gif
c:\windows\system32\images\toolbar\grouptreed.gif
c:\windows\system32\images\toolbar\grouptreepressed.gif
c:\windows\system32\images\toolbar\Last.gif
c:\windows\system32\images\toolbar\last_over.gif
c:\windows\system32\images\toolbar\Lastd.gif
c:\windows\system32\images\toolbar\Next.gif
c:\windows\system32\images\toolbar\next_over.gif
c:\windows\system32\images\toolbar\Nextd.gif
c:\windows\system32\images\toolbar\Prev.gif
c:\windows\system32\images\toolbar\prev_over.gif
c:\windows\system32\images\toolbar\Prevd.gif
c:\windows\system32\images\toolbar\print.gif
c:\windows\system32\images\toolbar\print_over.gif
c:\windows\system32\images\toolbar\printd.gif
c:\windows\system32\images\toolbar\Refresh.gif
c:\windows\system32\images\toolbar\refresh_over.gif
c:\windows\system32\images\toolbar\refreshd.gif
c:\windows\system32\images\toolbar\Search.gif
c:\windows\system32\images\toolbar\search_over.gif
c:\windows\system32\images\toolbar\searchd.gif
c:\windows\system32\images\toolbar\up.gif
c:\windows\system32\images\toolbar\up_over.gif
c:\windows\system32\images\toolbar\upd.gif
c:\windows\system32\images\tree\begindots.gif
c:\windows\system32\images\tree\beginminus.gif
c:\windows\system32\images\tree\beginplus.gif
c:\windows\system32\images\tree\blank.gif
c:\windows\system32\images\tree\blankdots.gif
c:\windows\system32\images\tree\dots.gif
c:\windows\system32\images\tree\lastdots.gif
c:\windows\system32\images\tree\lastminus.gif
c:\windows\system32\images\tree\lastplus.gif
c:\windows\system32\images\tree\Magnify.gif
c:\windows\system32\images\tree\minus.gif
c:\windows\system32\images\tree\minusbox.gif
c:\windows\system32\images\tree\plus.gif
c:\windows\system32\images\tree\plusbox.gif
c:\windows\system32\images\tree\singleminus.gif
c:\windows\system32\images\tree\singleplus.gif
c:\windows\system32\tmp845D.tmp
c:\windows\system32\tmp845E.tmp
c:\windows\w32dasm8.ini
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_6to4
-------\Legacy_hwinterface
-------\Service_hwinterface
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-04 do 2012-12-04 )))))))))))))))))))))))))))))))
.
.
2012-12-04 15:52 . 2012-12-04 15:52 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DEDE880-11D1-4CDC-BF30-2AC7D72F7AE0}\MpKsle7ad66a8.sys
2012-12-04 15:14 . 2012-12-04 15:14 -------- d-----w- C:\rsit
2012-12-04 15:14 . 2012-12-04 15:14 -------- d-----w- c:\program files\trend micro
2012-12-03 13:11 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DEDE880-11D1-4CDC-BF30-2AC7D72F7AE0}\mpengine.dll
2012-12-02 11:42 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-12-01 23:38 . 2012-12-01 23:38 -------- d-----w- c:\program files\Common Files\Skype
2012-12-01 23:38 . 2012-12-01 23:38 -------- d-----r- c:\program files\Skype
2012-11-29 01:31 . 2012-11-29 01:31 740840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4574DCBA-1B19-456A-9B5A-1852DB3F24AF}\gapaengine.dll
2012-11-23 18:39 . 2012-11-23 18:39 -------- d-----w- c:\users\sonix\AppData\Roaming\NVIDIA
2012-11-21 15:50 . 2012-11-21 15:50 -------- d-----w- c:\users\sonix\AppData\Roaming\Mobile Action
2012-11-21 15:50 . 2012-11-21 15:50 -------- d-----w- c:\program files\Mobile Action
2012-11-16 15:14 . 2012-11-16 15:14 -------- d-----w- c:\program files\GSC Game World
2012-11-16 11:51 . 2012-11-16 11:51 -------- d-----w- c:\users\UpdatusUser
2012-11-16 11:50 . 2012-10-02 19:29 3536817 ----a-w- c:\windows\system32\nvcoproc.bin
2012-11-14 02:04 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-14 02:04 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-14 02:04 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-14 02:03 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-14 02:03 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-14 02:03 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-14 02:03 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-14 02:03 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-14 02:03 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-14 02:03 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-13 23:15 . 2012-10-03 16:58 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-11-13 23:15 . 2012-10-03 16:42 175104 ----a-w- c:\windows\system32\netcorehc.dll
2012-11-13 23:15 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2012-11-13 23:15 . 2012-10-03 16:40 499712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-11-13 23:15 . 2012-10-03 16:42 242176 ----a-w- c:\windows\system32\nlasvc.dll
2012-11-13 23:15 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2012-11-13 23:15 . 2012-10-03 16:42 18944 ----a-w- c:\windows\system32\netevent.dll
2012-11-13 23:15 . 2012-10-03 15:21 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-11-13 23:15 . 2012-09-25 22:47 78336 ----a-w- c:\windows\system32\synceng.dll
2012-11-13 23:15 . 2012-10-18 17:59 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-11-13 23:15 . 2012-10-09 17:40 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-11-13 23:15 . 2012-10-09 17:40 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-11-13 07:01 . 2012-11-13 07:01 -------- d-----w- c:\program files\Common Files\Java
2012-11-13 07:00 . 2012-11-13 07:00 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-13 04:37 . 2012-12-04 15:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-11-13 04:22 . 2012-12-04 15:42 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-11-10 18:27 . 2012-11-10 18:27 -------- d-----w- c:\users\sonix\AppData\Local\Ahead
2012-11-10 18:18 . 2005-09-01 11:03 5888 ------w- c:\windows\system32\drivers\imagedrv.sys
2012-11-10 18:18 . 2005-09-01 11:03 127488 ------w- c:\windows\system32\drivers\imagesrv.sys
2012-11-10 18:18 . 2012-11-10 18:18 -------- d-----w- c:\program files\Common Files\Ahead
2012-11-10 18:18 . 2012-11-10 18:18 -------- d-----w- c:\program files\Ahead
2012-11-10 18:18 . 2006-01-12 15:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2012-11-10 18:18 . 2004-07-26 16:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2012-11-10 18:18 . 2004-07-26 16:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2012-11-10 18:18 . 2004-07-26 16:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2012-11-10 18:18 . 2004-07-26 16:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2012-11-10 18:18 . 2004-07-09 08:43 364544 ------w- c:\windows\system32\TwnLib4.dll
2012-11-10 18:18 . 2000-06-26 10:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-04 16:18 . 2011-06-19 07:02 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-12-04 16:18 . 2011-06-19 19:56 17488 ----a-w- c:\windows\gdrv.sys
2012-12-01 13:44 . 2012-04-02 13:12 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-01 13:44 . 2011-06-20 18:28 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-13 07:00 . 2012-08-12 08:24 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-13 07:00 . 2011-06-20 19:11 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-16 07:39 . 2012-11-28 00:58 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-10 20:15 . 2012-10-10 20:15 831848 ----a-w- c:\windows\system32\nvumdshim.dll
2012-10-10 20:15 . 2012-10-10 20:15 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15 . 2012-10-10 20:15 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14 . 2012-10-10 20:14 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14 . 2010-07-09 22:37 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14 . 2012-10-10 20:14 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14 . 2010-07-09 22:37 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14 . 2012-10-10 20:14 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14 . 2012-10-10 20:14 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14 . 2012-10-10 20:14 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14 . 2012-10-10 20:14 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14 . 2012-10-10 20:14 202600 ----a-w- c:\windows\system32\nvinit.dll
2012-10-10 20:14 . 2012-10-10 20:14 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14 . 2010-07-09 22:37 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-03 21:37 . 2011-08-14 11:56 740784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-10-02 19:29 . 2010-07-09 14:20 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-10-02 19:29 . 2010-07-09 14:20 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-10-02 19:29 . 2010-07-09 14:20 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-10-02 19:29 . 2010-07-09 14:20 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-10-02 19:29 . 2010-07-09 14:20 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-10-02 19:28 . 2010-07-09 14:20 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-10-02 12:15 . 2012-10-02 12:15 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-09-19 01:12 . 2012-09-19 01:12 2477184 ----a-w- c:\programdata\Microsoft\VisualStudio\11.0\1033\ResourceCache.dll
2012-09-14 18:28 . 2012-10-10 13:00 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-09 19:17 . 2012-09-09 19:17 111960 ----a-w- c:\windows\dxsdkuninst.exe
2006-01-23 08:32 . 2006-01-23 08:32 131072 ----a-w- c:\program files\internet explorer\plugins\LV80ActiveXControl.dll
2006-06-07 12:40 . 2006-06-07 12:40 132848 ----a-w- c:\program files\internet explorer\plugins\LV82ActiveXControl.dll
2012-07-14 00:15 . 2012-07-29 08:09 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-02-25 . B0A5A2CD481563430D09B497605497B6 . 521216 . . [6.1.7601.17514] . . c:\windows\System32\termsrv.dll
[-] 2011-02-25 . B0A5A2CD481563430D09B497605497B6 . 521216 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_90a6abb3b286306d\termsrv.dll
[7] 2009-07-14 . A01E50A04D7B1960B33E92B9080E6A94 . 543232 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_8e7597ebb597acd3\termsrv.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-26 8546848]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"EasyTuneVI"="c:\program files\GIGABYTE\ET6\ETcall.exe" [2007-07-26 20480]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-05 1505144]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"DES2"="c:\program files\GIGABYTE\EnergySaver2\des2.exe" [2010-04-15 354856]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2009-7-21 323584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-07-22 20:10 402432 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-08-18 23:07 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmware-tray]
2012-06-09 17:55 129688 ----a-w- c:\program files\VMware\VMware Workstation\vmware-tray.exe
.
R0 GVTDrv;GVTDrv; [x]
R2 SDLService;SDLService;c:\program files\Realtek\Smart Dual Lan\SDLService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 arusb_win7;Atheros 11n Wireless LAN device driver;c:\windows\system32\DRIVERS\arusb_win7.sys [x]
R3 BrlAPI;BrlAPI;c:\cygwin\bin\cygrunsrv.exe [x]
R3 EC168BDA;EC168BDA service;c:\windows\system32\DRIVERS\EC168BDA.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [x]
R3 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [x]
R3 MSOLAP$SQLSERVER;SQL Server Analysis Services (SQLSERVER);c:\program files\Microsoft SQL Server\MSAS10_50.SQLSERVER\OLAP\bin\msmdsrv.exe [x]
R3 MSSQL$SQLSERVER;SQL Server (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\sqlservr.exe [x]
R3 MSSQLFDLauncher$SQLSERVER;SQL Full-text Filter Daemon Launcher (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\fdlauncher.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 ReportServer$SQLSERVER;SQL Server Reporting Services (SQLSERVER);c:\program files\Microsoft SQL Server\MSRS10_50.SQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [x]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
R3 SiwvidStart;SiwvidStart;c:\users\sonix\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\siwvid.sys [x]
R3 SQLAgent$SQLSERVER;SQL Server Agent (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\SQLAGENT.EXE [x]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 Te.Service;Te.Service;c:\program files\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 MpKsle7ad66a8;MpKsle7ad66a8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DEDE880-11D1-4CDC-BF30-2AC7D72F7AE0}\MpKsle7ad66a8.sys [x]
S2 AcuWVSSchedulerv8;Acunetix WVS Scheduler v8;c:\program files\Acunetix\Web Vulnerability Scanner 8\WVSScheduler.exe [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [x]
S2 DES2 Service;DES2 Service for Energy Saving.;c:\program files\GIGABYTE\EnergySaver2\des2svr.exe [x]
S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [x]
S2 frameworkPostgreSQL;frameworkPostgreSQL;C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N frameworkPostgreSQL -D C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data [x]
S2 JMB36X;JMB36X;c:\windows\System32\XSrvSetup.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 Realtek87B;Realtek87B;c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 SAiAdmin;SAiAdmin;c:\windows\System32\SAiAdmin.exe [x]
S2 SAiDownloader;SAiDownloader;c:\program files\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe [x]
S2 SAiDownloaderVista;SAiDownloaderVista;c:\windows\System32\SAiDownloaderVista.exe [x]
S2 SAiLicSvr;SAiLicSvr;c:\windows\System32\SAiLicSvr.exe [x]
S2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [x]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 rtkio;rtkio;c:\program files\Realtek\Smart Dual Lan\rtkio.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 USBlyzer;USBlyzer Capture Driver;c:\windows\system32\DRIVERS\USBlyzer.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 13:44]
.
2012-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job
- c:\users\sonix\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-27 10:28]
.
2012-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job
- c:\users\sonix\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-27 10:28]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
TCP: DhcpNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-Facebook Update - c:\users\sonix\AppData\Local\Facebook\Update\FacebookUpdate.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} - c:\users\sonix\AppData\Local\SwvUpdater\Updater.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\frameworkPostgreSQL]
"ImagePath"="C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"frameworkPostgreSQL\" -D \"C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\frameworkPostgreSQL]
"ImagePath"="C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"frameworkPostgreSQL\" -D \"C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data\""
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1375819553-3628044649-1228780745-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:46,b2,99,1a,5c,e1,6b,e7,61,a1,85,b4,b8,e2,84,9f,99,50,d5,34,6e,70,f1,
45,72,cb,83,e6,91,cb,65,59,e2,00,57,2e,b8,e5,30,bf,d2,99,78,50,7b,ea,47,9d,\
"??"=hex:f6,fe,6d,bd,61,69,67,5e,1a,b0,7f,8d,5f,a7,87,ee
.
[HKEY_USERS\S-1-5-21-1375819553-3628044649-1228780745-1000\Software\SecuROM\License information*]
"datasecu"=hex:5c,ec,d7,96,2a,8a,55,bd,74,a5,9f,47,01,32,57,82,94,08,71,0c,b6,
c4,26,5b,97,2a,d9,48,c2,c4,f0,85,d3,29,4c,2c,18,77,68,17,bc,cc,17,94,0e,46,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5092)
c:\program files\Altap Salamander\plugins\salamext.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\pg_ctl.exe
c:\windows\system32\lkcitdl.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\windows\system32\conhost.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\windows\system32\lkads.exe
c:\windows\system32\lktsrv.exe
c:\program files\National Instruments\Shared\Security\nidmsrv.exe
c:\windows\system32\nisvcloc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\vmnat.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\VMware\VMware Workstation\vmware-authd.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\vmnetdhcp.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft IntelliType Pro\dpupdchk.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\sppsvc.exe
c:\program files\GIGABYTE\Smart6\Timelock\AlarmClock.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2012-12-04 17:22:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-04 16:22
.
Před spuštěním: Volných bajtů: 833 310 425 088
Po spuštění: Volných bajtů: 833 086 398 464
.
- - End Of File - - F233A27A594DC8E4EA262E708BB351F4

[vyosek]

Nic se nedeje, neni kam spechat

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Restore::
  c:\windows\System32\termsrv.dll
  c:\windows\winsxs\x86_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_90a6abb3b286306d\termsrv.dll
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ISUSPM Startup"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BCU"=-
  "ISUSScheduler"=-
  "SwitchBoard"=-
  "Adobe ARM"=-
  "BCSSync"=-
  "NeroFilterCheck"=-
  "SunJavaUpdateSched"=-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmware-tray]
  
  File::
  c:\windows\Tasks\Adobe Flash Player Updater.job
  c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job
  c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job
  
  RegNull::
  [HKEY_USERS\S-1-5-21-1375819553-3628044649-1228780745-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
  [HKEY_USERS\S-1-5-21-1375819553-3628044649-1228780745-1000\Software\SecuROM\License information*]
  
  RegLock::
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[melanmilan]

šlo to bez chyby, ale dlouho to pracovalo opět :/

ComboFix 12-12-02.01 - sonix 04.12.2012 17:36:34.2.8 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.3582.1606 [GMT 1:00]
Spuštěný z: c:\users\sonix\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\sonix\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1375819553-3628044649-1228780745-1000UA.job
.
Nakažená kopie c:\windows\System32\termsrv.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\winsxs\x86_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_8e7597ebb597acd3\termsrv.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-04 do 2012-12-04 )))))))))))))))))))))))))))))))
.
.
2012-12-04 16:48 . 2012-12-04 16:48 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F5F936D-1100-4B8F-836B-4C3CE7B6181B}\MpKsl224fa338.sys
2012-12-04 16:46 . 2012-12-04 16:49 -------- d-----w- c:\users\sonix\AppData\Local\temp
2012-12-04 16:46 . 2012-12-04 16:46 -------- d-----w- c:\users\Guest\AppData\Local\temp
2012-12-04 16:46 . 2012-12-04 16:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-04 16:36 . 2012-12-04 16:36 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F5F936D-1100-4B8F-836B-4C3CE7B6181B}\MpKsld05a36b2.sys
2012-12-04 16:28 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F5F936D-1100-4B8F-836B-4C3CE7B6181B}\mpengine.dll
2012-12-04 16:22 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-12-04 15:14 . 2012-12-04 15:14 -------- d-----w- C:\rsit
2012-12-04 15:14 . 2012-12-04 15:14 -------- d-----w- c:\program files\trend micro
2012-12-01 23:38 . 2012-12-01 23:38 -------- d-----w- c:\program files\Common Files\Skype
2012-12-01 23:38 . 2012-12-01 23:38 -------- d-----r- c:\program files\Skype
2012-11-29 01:31 . 2012-11-29 01:31 740840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4574DCBA-1B19-456A-9B5A-1852DB3F24AF}\gapaengine.dll
2012-11-23 18:39 . 2012-11-23 18:39 -------- d-----w- c:\users\sonix\AppData\Roaming\NVIDIA
2012-11-21 15:50 . 2012-11-21 15:50 -------- d-----w- c:\users\sonix\AppData\Roaming\Mobile Action
2012-11-21 15:50 . 2012-11-21 15:50 -------- d-----w- c:\program files\Mobile Action
2012-11-16 15:14 . 2012-11-16 15:14 -------- d-----w- c:\program files\GSC Game World
2012-11-16 11:51 . 2012-11-16 11:51 -------- d-----w- c:\users\UpdatusUser
2012-11-16 11:50 . 2012-10-02 19:29 3536817 ----a-w- c:\windows\system32\nvcoproc.bin
2012-11-14 02:04 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-14 02:04 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-14 02:04 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-14 02:03 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-14 02:03 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-14 02:03 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-14 02:03 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-14 02:03 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-14 02:03 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-14 02:03 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-13 23:15 . 2012-10-03 16:58 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-11-13 23:15 . 2012-10-03 16:42 175104 ----a-w- c:\windows\system32\netcorehc.dll
2012-11-13 23:15 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2012-11-13 23:15 . 2012-10-03 16:40 499712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-11-13 23:15 . 2012-10-03 16:42 242176 ----a-w- c:\windows\system32\nlasvc.dll
2012-11-13 23:15 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2012-11-13 23:15 . 2012-10-03 16:42 18944 ----a-w- c:\windows\system32\netevent.dll
2012-11-13 23:15 . 2012-10-03 15:21 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-11-13 23:15 . 2012-09-25 22:47 78336 ----a-w- c:\windows\system32\synceng.dll
2012-11-13 23:15 . 2012-10-18 17:59 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-11-13 23:15 . 2012-10-09 17:40 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-11-13 23:15 . 2012-10-09 17:40 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-11-13 07:01 . 2012-11-13 07:01 -------- d-----w- c:\program files\Common Files\Java
2012-11-13 07:00 . 2012-11-13 07:00 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-13 04:37 . 2012-12-04 15:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-11-13 04:22 . 2012-12-04 15:42 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-11-10 18:27 . 2012-11-10 18:27 -------- d-----w- c:\users\sonix\AppData\Local\Ahead
2012-11-10 18:18 . 2005-09-01 11:03 5888 ------w- c:\windows\system32\drivers\imagedrv.sys
2012-11-10 18:18 . 2005-09-01 11:03 127488 ------w- c:\windows\system32\drivers\imagesrv.sys
2012-11-10 18:18 . 2012-11-10 18:18 -------- d-----w- c:\program files\Common Files\Ahead
2012-11-10 18:18 . 2012-11-10 18:18 -------- d-----w- c:\program files\Ahead
2012-11-10 18:18 . 2006-01-12 15:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2012-11-10 18:18 . 2004-07-26 16:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2012-11-10 18:18 . 2004-07-26 16:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2012-11-10 18:18 . 2004-07-26 16:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2012-11-10 18:18 . 2004-07-26 16:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2012-11-10 18:18 . 2004-07-09 08:43 364544 ------w- c:\windows\system32\TwnLib4.dll
2012-11-10 18:18 . 2000-06-26 10:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-04 16:49 . 2011-06-19 07:02 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-12-04 16:49 . 2011-06-19 19:56 17488 ----a-w- c:\windows\gdrv.sys
2012-12-01 13:44 . 2012-04-02 13:12 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-01 13:44 . 2011-06-20 18:28 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-13 07:00 . 2012-08-12 08:24 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-13 07:00 . 2011-06-20 19:11 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-16 07:39 . 2012-11-28 00:58 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-10 20:15 . 2012-10-10 20:15 831848 ----a-w- c:\windows\system32\nvumdshim.dll
2012-10-10 20:15 . 2012-10-10 20:15 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15 . 2012-10-10 20:15 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14 . 2012-10-10 20:14 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14 . 2010-07-09 22:37 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14 . 2012-10-10 20:14 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14 . 2010-07-09 22:37 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14 . 2012-10-10 20:14 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14 . 2012-10-10 20:14 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14 . 2012-10-10 20:14 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14 . 2012-10-10 20:14 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14 . 2012-10-10 20:14 202600 ----a-w- c:\windows\system32\nvinit.dll
2012-10-10 20:14 . 2012-10-10 20:14 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14 . 2010-07-09 22:37 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-03 21:37 . 2011-08-14 11:56 740784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-10-02 19:29 . 2010-07-09 14:20 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-10-02 19:29 . 2010-07-09 14:20 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-10-02 19:29 . 2010-07-09 14:20 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-10-02 19:29 . 2010-07-09 14:20 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-10-02 19:29 . 2010-07-09 14:20 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-10-02 19:28 . 2010-07-09 14:20 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-10-02 12:15 . 2012-10-02 12:15 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-09-19 01:12 . 2012-09-19 01:12 2477184 ----a-w- c:\programdata\Microsoft\VisualStudio\11.0\1033\ResourceCache.dll
2012-09-14 18:28 . 2012-10-10 13:00 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-09 19:17 . 2012-09-09 19:17 111960 ----a-w- c:\windows\dxsdkuninst.exe
2006-01-23 08:32 . 2006-01-23 08:32 131072 ----a-w- c:\program files\internet explorer\plugins\LV80ActiveXControl.dll
2006-06-07 12:40 . 2006-06-07 12:40 132848 ----a-w- c:\program files\internet explorer\plugins\LV82ActiveXControl.dll
2012-07-14 00:15 . 2012-07-29 08:09 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-26 8546848]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"EasyTuneVI"="c:\program files\GIGABYTE\ET6\ETcall.exe" [2007-07-26 20480]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-05 1505144]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"DES2"="c:\program files\GIGABYTE\EnergySaver2\des2.exe" [2010-04-15 354856]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2009-7-21 323584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R0 GVTDrv;GVTDrv; [x]
R2 SDLService;SDLService;c:\program files\Realtek\Smart Dual Lan\SDLService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 arusb_win7;Atheros 11n Wireless LAN device driver;c:\windows\system32\DRIVERS\arusb_win7.sys [x]
R3 BrlAPI;BrlAPI;c:\cygwin\bin\cygrunsrv.exe [x]
R3 EC168BDA;EC168BDA service;c:\windows\system32\DRIVERS\EC168BDA.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [x]
R3 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [x]
R3 MSOLAP$SQLSERVER;SQL Server Analysis Services (SQLSERVER);c:\program files\Microsoft SQL Server\MSAS10_50.SQLSERVER\OLAP\bin\msmdsrv.exe [x]
R3 MSSQL$SQLSERVER;SQL Server (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\sqlservr.exe [x]
R3 MSSQLFDLauncher$SQLSERVER;SQL Full-text Filter Daemon Launcher (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\fdlauncher.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 ReportServer$SQLSERVER;SQL Server Reporting Services (SQLSERVER);c:\program files\Microsoft SQL Server\MSRS10_50.SQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [x]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
R3 SiwvidStart;SiwvidStart;c:\users\sonix\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\siwvid.sys [x]
R3 SQLAgent$SQLSERVER;SQL Server Agent (SQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLSERVER\MSSQL\Binn\SQLAGENT.EXE [x]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 Te.Service;Te.Service;c:\program files\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 MpKsl224fa338;MpKsl224fa338;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F5F936D-1100-4B8F-836B-4C3CE7B6181B}\MpKsl224fa338.sys [x]
S1 MpKsld05a36b2;MpKsld05a36b2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F5F936D-1100-4B8F-836B-4C3CE7B6181B}\MpKsld05a36b2.sys [x]
S2 AcuWVSSchedulerv8;Acunetix WVS Scheduler v8;c:\program files\Acunetix\Web Vulnerability Scanner 8\WVSScheduler.exe [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [x]
S2 DES2 Service;DES2 Service for Energy Saving.;c:\program files\GIGABYTE\EnergySaver2\des2svr.exe [x]
S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [x]
S2 frameworkPostgreSQL;frameworkPostgreSQL;C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N frameworkPostgreSQL -D C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data [x]
S2 JMB36X;JMB36X;c:\windows\System32\XSrvSetup.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 Realtek87B;Realtek87B;c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 SAiAdmin;SAiAdmin;c:\windows\System32\SAiAdmin.exe [x]
S2 SAiDownloader;SAiDownloader;c:\program files\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe [x]
S2 SAiDownloaderVista;SAiDownloaderVista;c:\windows\System32\SAiDownloaderVista.exe [x]
S2 SAiLicSvr;SAiLicSvr;c:\windows\System32\SAiLicSvr.exe [x]
S2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [x]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [x]
S3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 rtkio;rtkio;c:\program files\Realtek\Smart Dual Lan\rtkio.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 USBlyzer;USBlyzer Capture Driver;c:\windows\system32\DRIVERS\USBlyzer.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL224FA338
*NewlyCreated* - RTKIO
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
TCP: DhcpNameServer = 10.10.10.1 193.85.1.100 193.85.2.100 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\sonix\AppData\Roaming\Mozilla\Firefox\Profiles\3sleeqx7.default\
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\frameworkPostgreSQL]
"ImagePath"="C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"frameworkPostgreSQL\" -D \"C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\frameworkPostgreSQL]
"ImagePath"="C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"frameworkPostgreSQL\" -D \"C:/PROGRA~1/Rapid7/FRAMEW~2/POSTGR~1/data\""
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3536)
c:\program files\Altap Salamander\plugins\salamext.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\pg_ctl.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\windows\system32\conhost.exe
c:\windows\system32\lkcitdl.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\windows\system32\lkads.exe
c:\windows\system32\lktsrv.exe
c:\program files\National Instruments\Shared\Security\nidmsrv.exe
c:\windows\system32\nisvcloc.exe
c:\windows\system32\PnkBstrA.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\progra~1\Rapid7\FRAMEW~2\POSTGR~1\bin\postgres.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\vmnat.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\VMware\VMware Workstation\vmware-authd.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\vmnetdhcp.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Microsoft IntelliType Pro\dpupdchk.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\GIGABYTE\Smart6\Timelock\AlarmClock.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2012-12-04 17:53:06 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-04 16:53
ComboFix2.txt 2012-12-04 16:22
.
Před spuštěním: Volných bajtů: 833 044 164 608
Po spuštění: Volných bajtů: 832 685 473 792
.
- - End Of File - - 96ACC0FD1C013DE29B502A4E5356158A

[vyosek]

Dlouho pracoval ale udelal co mel...

Jak se chova PC

[melanmilan]

no je to rychlejší a už v prohlížečích nemám ty šaškárny huráá. Díky PANE, vážím si Vaší pomoci a vašeho času

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

[melanmilan]

vše v pořádku proběhlo, jen to TFC a OTC nerestartovaly PC jen se ukončily