zablokované pc

Zpráva

Dadejs · #1 Příspěvek od **Dadejs** » 21 pro 2012 18:52

Zdravím,
Měl sem zablokované pc trojanem co se tváří jako policie čr. už jsem se toho nejspíš zbavil, ale pro jistotu bych poprosil o kontrolu logu

Logfile of random's system information tool 1.09 (written by random/random)
Run by Dadejs at 2012-12-21 18:42:45
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 357 GB (79%) free of 451 GB
Total RAM: 4078 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:42:52, on 21.12.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe
C:\Program Files\trend micro\Dadejs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb139?a=6OyOwz1bsm&i=26
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/burn4free/{A8 ... 4AF85B560F}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Burn4Free Toolbar\tbhelper.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Burn4Free Toolbar\tbcore3.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Burn4Free Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Burn4Free Toolbar\tbcore3.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe 1
O4 - HKLM\..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [4-Day Forecast] "C:\Program Files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe" /Startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [QuickTime Plugin Install] C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Přeložit - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - C:\Program Files (x86)\Verdict Free\etnxp.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files (x86)\Verdict Free\etnxp.dll
O9 - Extra 'Tools' menuitem: Internetový překladač... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files (x86)\Verdict Free\etnxp.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11156 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
winlogon.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
atieclxx
taskeng.exe {E4DA7229-FBD4-4B95-89C0-ED168CDB7563}
"taskhost.exe"
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\windows\system32\Dwm.exe"
C:\windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files\Logitech\Gaming Software\LWEMon.exe" /noui
"C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Windows\jmesoft\hotkey.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
"C:\Program Files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe" /Startup
KHALMNPR.EXE /API
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\jmesoft\Service.exe
C:\windows\System32\svchost.exe -k HPZ12
"C:\Windows\jmesoft\JME_LOAD.exe"
C:\windows\System32\svchost.exe -k HPZ12
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2816
C:\windows\system32\SearchIndexer.exe /Embedding
C:\windows\system32\svchost.exe -k HPService
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\windows\servicing\TrustedInstaller.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-a8f1fcf0-3388-42d9-b79d-b28a526120e5 -SystemEventPortName:HostProcess-77ee4dbb-4660-419a-85f1-f97bb04fc2e0 -IoCancelEventPortName:HostProcess-131167f0-5db0-4f57-ab37-46c25ff7db0c -NonStateChangingEventPortName:HostProcess-d41d42ea-a44e-4b52-a783-fcba196434a5 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:ef291591-ef5d-4275-927f-a7a5d6b126ff -DeviceGroupId:WpdFsGroup
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Users\Dadejs\Desktop\RSITx64.exe"
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\windows\system32\sppsvc.exe
C:\windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default

prefs.js - "browser.startup.homepage" - "http://www.centrum.cz/?utm_source=ch-to ... paign=home"
prefs.js - "keyword.URL" - "http://search.centrum.cz/?charset=UTF-8 ... toolbar-ff, ch-toolbar-ff-searchbox, tb-undefined&utm_source=ch-toolbar&utm_medium=ff-centrum-cz&utm_content=toolbar-searchbox&utm_campaign=undefined&q="

"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\IB Updater\Firefox

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.135 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19]
"Description"=Veetle TV Core
"Path"=C:\Program Files (x86)\Veetle\plugins\npVeetle.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18]
"Description"=Veetle TV Player
"Path"=C:\Program Files (x86)\Veetle\Player\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.135 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
NPOFFICE.DLL
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\extensions\
toolbar@centrumholdings.com

C:\Users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\searchplugins\
askcom.xml
MyStart Search.xml
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-10-30 1502288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-09-24 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-09-24 155384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
SMTTB2009 Class - C:\Program Files (x86)\Burn4Free Toolbar\tbcore3.dll [2011-06-22 2398720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2012-10-30 1502288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{338B4DFE-2E2C-4338-9E41-E176D497299E} - Burn4Free Toolbar - C:\Program Files (x86)\Burn4Free Toolbar\tbcore3.dll [2011-06-22 2398720]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-10-26 11543656]
"Lenovo EE Boot Optimizer"=C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [2011-08-26 114688]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2011-10-07 1744152]
"Start WingMan Profiler"=C:\Program Files\Logitech\Gaming Software\LWEMon.exe [2009-01-21 123400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-11-12 1104824]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-10-11 59280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files (x86)\iTunes\iTunesHelper.exe [2012-09-09 421776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage]
C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [2012-11-01 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-11-12 1104824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
C:\Program Files (x86)\Samsung\Kies\Kies.exe [2012-11-12 968120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2012-11-12 309688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Plugin Install]
C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe [2012-11-15 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files (x86)\QuickTime\QTTask.exe [2012-10-25 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~2\HP\DIGITA~1\bin\hpqtra08.exe [2009-09-20 270336]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2011-03-21 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-03-16 28672]
"Lenovo Eye Distance System"=C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe [2010-09-09 265216]
"Lenovo Dynamic Brightness System"=C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe [2010-10-08 285696]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]
"UpdatePRCShortCut"=C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe [2009-05-14 222504]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-10-30 4297136]
"4-Day Forecast"=C:\Program Files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe [2008-11-10 1060864]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2012-10-25 421888]
"QuickTime Plugin Install"=C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe [2012-11-15 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2011-09-27 68376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-12-21 18:42:46 ----D---- C:\Program Files\trend micro
2012-12-21 18:42:45 ----D---- C:\rsit
2012-12-21 16:58:51 ----D---- C:\Users\Dadejs\AppData\Roaming\Malwarebytes
2012-12-21 16:58:37 ----D---- C:\ProgramData\Malwarebytes
2012-12-21 16:58:37 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-12-21 16:58:37 ----A---- C:\windows\system32\drivers\mbam.sys
2012-12-21 16:58:06 ----A---- C:\AdwCleaner[R1].txt
2012-12-21 16:57:23 ----A---- C:\TDSSKiller.2.8.15.0_21.12.2012_16.57.23_log.txt
2012-12-21 15:53:49 ----A---- C:\windows\SYSWOW64\atmlib.dll
2012-12-21 15:53:48 ----A---- C:\windows\system32\atmlib.dll
2012-12-21 15:53:45 ----A---- C:\windows\SYSWOW64\atmfd.dll
2012-12-21 15:53:45 ----A---- C:\windows\system32\atmfd.dll
2012-12-12 23:16:34 ----A---- C:\windows\SYSWOW64\mshtmled.dll
2012-12-12 23:16:34 ----A---- C:\windows\system32\mshtmled.dll
2012-12-12 23:16:33 ----A---- C:\windows\SYSWOW64\vbscript.dll
2012-12-12 23:16:33 ----A---- C:\windows\SYSWOW64\ieui.dll
2012-12-12 23:16:33 ----A---- C:\windows\system32\ieUnatt.exe
2012-12-12 23:16:33 ----A---- C:\windows\system32\ieui.dll
2012-12-12 23:16:32 ----A---- C:\windows\SYSWOW64\urlmon.dll
2012-12-12 23:16:32 ----A---- C:\windows\SYSWOW64\url.dll
2012-12-12 23:16:32 ----A---- C:\windows\SYSWOW64\ieUnatt.exe
2012-12-12 23:16:32 ----A---- C:\windows\system32\urlmon.dll
2012-12-12 23:16:32 ----A---- C:\windows\system32\url.dll
2012-12-12 23:16:31 ----A---- C:\windows\SYSWOW64\wininet.dll
2012-12-12 23:16:31 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2012-12-12 23:16:31 ----A---- C:\windows\system32\msfeeds.dll
2012-12-12 23:16:31 ----A---- C:\windows\system32\jscript9.dll
2012-12-12 23:16:30 ----A---- C:\windows\system32\wininet.dll
2012-12-12 23:16:30 ----A---- C:\windows\system32\jsproxy.dll
2012-12-12 23:16:29 ----A---- C:\windows\SYSWOW64\jscript9.dll
2012-12-12 23:16:29 ----A---- C:\windows\SYSWOW64\jscript.dll
2012-12-12 23:16:29 ----A---- C:\windows\SYSWOW64\iertutil.dll
2012-12-12 23:16:29 ----A---- C:\windows\system32\vbscript.dll
2012-12-12 23:16:29 ----A---- C:\windows\system32\jscript.dll
2012-12-12 23:16:29 ----A---- C:\windows\system32\iertutil.dll
2012-12-12 23:16:28 ----A---- C:\windows\SYSWOW64\jsproxy.dll
2012-12-12 23:16:26 ----A---- C:\windows\SYSWOW64\mshtml.dll
2012-12-12 23:16:25 ----A---- C:\windows\system32\mshtml.dll
2012-12-12 23:16:24 ----A---- C:\windows\system32\ieframe.dll
2012-12-12 23:16:23 ----A---- C:\windows\SYSWOW64\ieframe.dll
2012-12-12 06:28:39 ----A---- C:\windows\SYSWOW64\tzres.dll
2012-12-12 06:28:39 ----A---- C:\windows\system32\tzres.dll
2012-12-12 06:28:35 ----A---- C:\windows\system32\win32k.sys
2012-12-12 06:28:30 ----A---- C:\windows\system32\KernelBase.dll
2012-12-12 06:28:30 ----A---- C:\windows\system32\kernel32.dll
2012-12-12 06:28:29 ----A---- C:\windows\system32\winsrv.dll
2012-12-12 06:28:29 ----A---- C:\windows\system32\conhost.exe
2012-12-12 06:28:28 ----A---- C:\windows\SYSWOW64\KernelBase.dll
2012-12-12 06:28:28 ----A---- C:\windows\SYSWOW64\kernel32.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-12-12 06:28:27 ----AH---- C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-12-12 06:28:27 ----A---- C:\windows\SYSWOW64\wow32.dll
2012-12-12 06:28:27 ----A---- C:\windows\SYSWOW64\setup16.exe
2012-12-12 06:28:27 ----A---- C:\windows\SYSWOW64\ntvdm64.dll
2012-12-12 06:28:27 ----A---- C:\windows\SYSWOW64\instnm.exe
2012-12-12 06:28:27 ----A---- C:\windows\system32\wow64win.dll
2012-12-12 06:28:27 ----A---- C:\windows\system32\wow64cpu.dll
2012-12-12 06:28:27 ----A---- C:\windows\system32\wow64.dll
2012-12-12 06:28:27 ----A---- C:\windows\system32\ntvdm64.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-12-12 06:28:26 ----AH---- C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-12-12 06:28:26 ----A---- C:\windows\SYSWOW64\user.exe
2012-12-12 06:28:15 ----A---- C:\windows\SYSWOW64\dpnet.dll
2012-12-12 06:28:15 ----A---- C:\windows\system32\dpnet.dll
2012-12-04 22:20:52 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-11-23 22:48:56 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

======List of files/folders modified in the last 1 month======

2012-12-21 18:42:48 ----D---- C:\Windows
2012-12-21 18:42:46 ----RD---- C:\Program Files
2012-12-21 18:42:46 ----A---- C:\windows\SYSWOW64\log.txt
2012-12-21 18:42:31 ----D---- C:\windows\Temp
2012-12-21 18:42:29 ----D---- C:\windows\SoftwareDistribution
2012-12-21 18:41:01 ----D---- C:\windows\system32\config
2012-12-21 16:58:58 ----D---- C:\windows\inf
2012-12-21 16:58:58 ----AD---- C:\windows\System32
2012-12-21 16:58:58 ----A---- C:\windows\system32\PerfStringBackup.INI
2012-12-21 16:58:37 ----RD---- C:\Program Files (x86)
2012-12-21 16:58:37 ----HD---- C:\ProgramData
2012-12-21 16:58:37 ----D---- C:\windows\system32\drivers
2012-12-21 16:58:34 ----D---- C:\windows\Prefetch
2012-12-21 16:48:27 ----D---- C:\windows\winsxs
2012-12-21 16:47:33 ----D---- C:\windows\SysWOW64
2012-12-21 15:53:56 ----D---- C:\windows\system32\catroot
2012-12-21 15:53:43 ----SHD---- C:\System Volume Information
2012-12-20 23:05:59 ----D---- C:\Users\Dadejs\AppData\Roaming\Media Player Classic
2012-12-20 23:05:47 ----D---- C:\windows\debug
2012-12-18 06:09:41 ----D---- C:\windows\system32\catroot2
2012-12-13 10:41:55 ----D---- C:\windows\rescache
2012-12-13 06:32:28 ----D---- C:\windows\SYSWOW64\cs-CZ
2012-12-13 06:32:28 ----D---- C:\windows\system32\cs-CZ
2012-12-13 06:32:25 ----D---- C:\windows\SYSWOW64\migration
2012-12-13 06:32:25 ----D---- C:\windows\system32\migration
2012-12-13 06:32:25 ----D---- C:\windows\AppPatch
2012-12-13 06:32:25 ----D---- C:\Program Files (x86)\Internet Explorer
2012-12-13 06:32:24 ----D---- C:\Program Files\Internet Explorer
2012-12-12 23:19:55 ----SHD---- C:\windows\Installer
2012-12-12 23:19:54 ----HD---- C:\Config.Msi
2012-12-12 23:19:51 ----A---- C:\windows\win.ini
2012-12-12 23:17:36 ----A---- C:\windows\system32\MRT.exe
2012-12-11 20:03:16 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2012-12-05 20:36:58 ----D---- C:\Users\Dadejs\AppData\Roaming\AIMP3
2012-12-05 20:36:53 ----D---- C:\windows\Minidump

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fbfmon;fbfmon; C:\windows\system32\drivers\fbfmon.sys [2011-08-26 57952]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver; C:\windows\system32\drivers\DDCDrv.sys [2008-04-08 20832]
R1 aswRdr;aswRdr; C:\windows\System32\Drivers\aswrdr2.sys [2012-10-15 54072]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2012-10-30 984144]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2012-10-30 370288]
R1 aswTdi;avast! Network Shield Support; C:\windows\system32\drivers\aswTdi.sys [2012-10-30 59728]
R1 BPntDrv;BPntDrv; C:\windows\system32\drivers\BPntDrv.sys [2011-08-26 13408]
R2 aswFsBlk;aswFsBlk; C:\windows\system32\drivers\aswFsBlk.sys [2012-10-30 25232]
R2 aswMonFlt;aswMonFlt; \??\C:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
R3 amdkmdag;amdkmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2011-06-11 9360896]
R3 amdkmdap;amdkmdap; C:\windows\system32\DRIVERS\atikmpag.sys [2011-06-11 309760]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\windows\system32\drivers\AtihdW76.sys [2011-06-06 231440]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\windows\system32\DRIVERS\e1c62x64.sys [2010-09-21 313520]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2010-10-26 2530152]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\windows\system32\DRIVERS\LHidFilt.Sys [2011-09-02 66840]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\windows\system32\DRIVERS\LMouFilt.Sys [2011-09-02 60696]
R3 MEIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUStor.sys [2010-07-20 247400]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\windows\system32\drivers\WmBEnum.sys [2009-01-13 22024]
R3 WmXlCore;Logitech Translation Layer Driver; C:\windows\system32\drivers\WmXlCore.sys [2009-01-13 57608]
S3 atikmdag;atikmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2011-06-11 9360896]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 Dot4;MS IEEE-1284.4 Driver; C:\windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\windows\system32\DRIVERS\Dot4Prt.sys [2010-11-21 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\windows\system32\DRIVERS\ssadbus.sys [2012-06-27 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\windows\system32\DRIVERS\ssadmdfl.sys [2012-06-27 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\windows\system32\DRIVERS\ssadmdm.sys [2012-06-27 177640]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver; C:\windows\System32\Drivers\usbaapl64.sys [2012-07-09 52736]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 WinUsb;SAMSUNG Android USB Driver; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]
S3 WmFilter;Logitech Gaming HID Filter Driver; C:\windows\system32\drivers\WmFilter.sys [2009-01-13 34440]
S3 WmHidLo;Logitech Gaming USB Filter Driver; C:\windows\system32\drivers\WmHidLo.sys [2009-01-13 36360]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\windows\system32\drivers\WmVirHid.sys [2009-01-13 15752]
S3 wsvd;wsvd; C:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\windows\system32\atiesrxx.exe [2011-06-11 204288]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-08-11 55184]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-10-30 44808]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\windows\system32\svchost.exe [2009-07-14 27136]
R2 HPSLPSVC;HP Network Devices Support; C:\windows\system32\svchost.exe [2009-07-14 27136]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-03-16 32768]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-10-05 325656]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 hpqcxs08;hpqcxs08; C:\windows\system32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-11 250808]
S3 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-09-09 936848]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2011-09-27 359192]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-12-04 115168]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-11-23 419624]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2011-11-20 1255736]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------

#2 Příspěvek od **Rudy** » 21 pro 2012 19:09

Také zdravím!
V logu není nic nebezpečného vidět. Udělejte pro jistotu kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Dadejs · #3 Příspěvek od **Dadejs** » 21 pro 2012 19:53

Asi to mám smazat (?)

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.12.21.15

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Dadejs :: DADEJS-PC [administrátor]

21.12.2012 19:14:13
mbam-log-2012-12-21 (19-52-25).txt

Typ: Úplná kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 348608
Uplynulý čas: 31 minut, 39 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 3
C:\Users\Dadejs\wgsdgsdgdsgsd.dll (Trojan.FakeMS) -> Žádná instrukce nebyla provedena.
C:\Users\Dadejs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\1ede2ede-4866b0f0 (Trojan.FakeMS) -> Žádná instrukce nebyla provedena.
C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Žádná instrukce nebyla provedena.

(konec)

#4 Příspěvek od **Rudy** » 21 pro 2012 20:17

Nalezené položky smažte a restartujte PC. Vyzkoušejte, zda se něco změnilo.

Dadejs · #5 Příspěvek od **Dadejs** » 21 pro 2012 20:25

Všechno se to tváří v pořádku. Jen při startu na mne vyskakuje tato hláška

#6 Příspěvek od **Rudy** » 21 pro 2012 21:26

Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Dadejs · #7 Příspěvek od **Dadejs** » 21 pro 2012 21:38

ComboFix 12-12-20.02 - Dadejs 21.12.2012 21:32:01.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4078.2742 [GMT 1:00]
Spuštěný z: c:\users\Dadejs\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Burn4Free Toolbar\tbHElper.dll
c:\users\Dadejs\AppData\Local\Minibar
c:\users\Dadejs\AppData\Local\Minibar\common.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\background.html
c:\users\Dadejs\AppData\Local\Minibar\chrome\cached_http_request.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\extension_info.json
c:\users\Dadejs\AppData\Local\Minibar\chrome\icons\icon128.png
c:\users\Dadejs\AppData\Local\Minibar\chrome\icons\icon19.png
c:\users\Dadejs\AppData\Local\Minibar\chrome\icons\icon32.png
c:\users\Dadejs\AppData\Local\Minibar\chrome\icons\icon48.png
c:\users\Dadejs\AppData\Local\Minibar\chrome\includes\content.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\includes\content_kango.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\includes\content_messaging.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\includes\content_userscript.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango-ui\button.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango-ui\ui.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\browser.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\console.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\event_listener.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\initialize.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\io.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\jsonstorage.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\kango.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\lang.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\messaging.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\userscript_engine.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\kango\xhr.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\main.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\manifest.json
c:\users\Dadejs\AppData\Local\Minibar\chrome\minibar\actions.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\minibar\cachedxhr.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\minibar\config.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\minibar\macros.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\minibar\minibar.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\popup.html
c:\users\Dadejs\AppData\Local\Minibar\chrome\popup.js
c:\users\Dadejs\AppData\Local\Minibar\chrome\tab.html
c:\users\Dadejs\AppData\Local\Minibar\chrome\tab.js
c:\users\Dadejs\AppData\Local\Minibar\chrome_installer.js
c:\users\Dadejs\AppData\Local\Minibar\install.json
c:\users\Dadejs\AppData\Local\Minibar\minibar.crx
c:\users\Dadejs\AppData\Local\Minibar\sqlite3.exe
c:\users\Dadejs\AppData\Local\Minibar\Uninstall.exe
c:\users\Dadejs\AppData\Local\TempDIR
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-21 do 2012-12-21 )))))))))))))))))))))))))))))))
.
.
2012-12-21 20:36 . 2012-12-21 20:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-21 17:42 . 2012-12-21 17:42 -------- d-----w- c:\program files\trend micro
2012-12-21 17:42 . 2012-12-21 17:42 -------- d-----w- C:\rsit
2012-12-21 15:58 . 2012-12-21 15:58 -------- d-----w- c:\users\Dadejs\AppData\Roaming\Malwarebytes
2012-12-21 15:58 . 2012-12-21 18:13 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-12-21 15:58 . 2012-12-21 15:58 -------- d-----w- c:\programdata\Malwarebytes
2012-12-21 15:58 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-21 14:53 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 14:53 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 14:53 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 14:53 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 07:32 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{228C52FC-3172-49FD-99FA-C50D8ED1B83E}\mpengine.dll
2012-12-12 05:28 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-23 21:48 . 2012-12-06 05:08 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 22:17 . 2011-11-20 07:02 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-11 19:03 . 2012-03-31 05:46 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-11 19:03 . 2011-11-19 15:07 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-30 22:51 . 2011-11-19 15:29 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2011-11-19 15:29 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2011-11-19 15:29 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2011-11-19 15:28 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2011-11-19 15:29 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2011-11-19 15:28 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2011-11-19 15:28 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-10-30 22:50 . 2011-11-19 15:28 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-16 08:38 . 2012-11-28 05:33 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 05:33 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 05:33 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-15 16:59 . 2012-03-24 05:49 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-10-09 18:17 . 2012-11-14 05:53 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-14 05:53 226816 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-14 05:53 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-14 05:53 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:40 . 2012-12-12 05:28 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-14 05:53 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-14 05:53 303104 ----a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-14 05:53 70656 ----a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-14 05:53 246272 ----a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-14 05:53 18944 ----a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-14 05:53 216576 ----a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-14 05:53 569344 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-14 05:53 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-14 05:53 18944 ----a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-14 05:53 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-14 05:53 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-09-25 22:47 . 2012-11-14 05:53 78336 ----a-w- c:\windows\SysWow64\synceng.dll
2012-09-25 22:46 . 2012-11-14 05:53 95744 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 21:16 . 2012-10-19 05:35 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{338B4DFE-2E2C-4338-9E41-E176D497299E}"= "c:\program files (x86)\Burn4Free Toolbar\tbcore3.dll" [2011-06-22 2398720]
.
[HKEY_CLASSES_ROOT\clsid\{338b4dfe-2e2c-4338-9e41-e176d497299e}]
[HKEY_CLASSES_ROOT\SMTTB2009.SMTTB2009.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\SMTTB2009.SMTTB2009]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"="c:\windows\jmesoft\hotkey.exe" [2011-03-21 118784]
"jmesoft"="c:\windows\jmesoft\ServiceLoader.exe" [2011-03-16 28672]
"Lenovo Eye Distance System"="c:\program files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe" [2010-09-09 265216]
"Lenovo Dynamic Brightness System"="c:\program files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe" [2010-10-08 285696]
"CLMLServer"="c:\program files (x86)\Lenovo\Power2Go\CLMLSvc.exe" [2009-12-04 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"4-Day Forecast"="c:\program files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe" [2008-11-10 1060864]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"QuickTime Plugin Install"="c:\program files (x86)\QuickTime\Plugins\DeleteMe1.exe" [2012-11-15 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 JME Keyboard;JME Keyboard Driver;c:\windows\jmesoft\Service.exe [2011-03-16 32768]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2012-06-27 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2012-06-27 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2012-06-27 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-20 1255736]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-08-26 57952]
S0 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\DDCDrv.sys [2008-04-08 20832]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-08-26 13408]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-06-11 204288]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-06-06 231440]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-07-20 247400]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 19:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-26 11543656]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-08-26 114688]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 123400]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mystart.incredibar.com/mb139?a=6OyOwz1bsm&i=26
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.bigseekpro.com/burn4free/{A8250AA1- ... 4AF85B560F}
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files (x86)\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files (x86)\Verdict Free\etnxp.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/?utm_source=ch-toolbar&u ... paign=home
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/?charset=UTF-8&channel_id=ch-toolbar-ff,ch-toolbar-ff-searchbox,tb-undefined&utm_source=ch-toolbar&utm_medium=ff-centrum-cz&utm_content=toolbar-searchbox&utm_campaign=undefined&q=
FF - ExtSQL: 2012-11-23 22:49; toolbar@centrumholdings.com; c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\extensions\toolbar@centrumholdings.com
FF - ExtSQL: !HIDDEN! 2011-11-19 20:37; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyOwz1bsm&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 766efe1e000000000000c89cdc58b2d1
FF - user.js: extensions.incredibar_i.instlDay - 15601
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:56
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyOwz1bsm
FF - user.js: extensions.incredibar_i.upn2n - 92262129298921138
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10650
FF - user.js: extensions.incredibar_i.ppd - 95%5F4
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& !*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& %*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& '*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& (*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& +*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& .*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& /*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 7*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 9*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\p* 4*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* &*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* (*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* )*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* ,*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* =*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\Ŕ*: 0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *$*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ***]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *-*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *5*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *7*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *8*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *9*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *<*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *#*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *%*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ >*"*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ z*)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ˝*?*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ î*.*]
@Allowed: (Read) (RestrictedCode)
DUMPHIVE0.003 (REGF)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-12-21 21:37:41
ComboFix-quarantined-files.txt 2012-12-21 20:37
.
Před spuštěním: Volných bajtů: 373 251 964 928
Po spuštění: Volných bajtů: 373 102 866 432
.
- - End Of File - - 5AB63A85646D0F00356CA6C52CC16998

#8 Příspěvek od **Rudy** » 21 pro 2012 22:14

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files (x86)\Burn4Free Toolbar

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{338B4DFE-2E2C-4338-9E41-E176D497299E}"=-
[-HKEY_CLASSES_ROOT\clsid\{338b4dfe-2e2c-4338-9e41-e176d497299e}]
[-HKEY_CLASSES_ROOT\SMTTB2009.SMTTB2009.3]
[-HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[-HKEY_CLASSES_ROOT\SMTTB2009.SMTTB2009]

Firefox::
FF - ProfilePath - c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\
FF - ExtSQL: 2012-11-23 22:49; toolbar@centrumholdings.com; c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\extensions\toolbar@centrumholdings.com
FF - ExtSQL: !HIDDEN! 2011-11-19 20:37; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyOwz ... 26&search=
FF - user.js: extensions.incredibar_i.id - 766efe1e000000000000c89cdc58b2d1
FF - user.js: extensions.incredibar_i.instlDay - 15601
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:56
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyOwz1bsm
FF - user.js: extensions.incredibar_i.upn2n - 92262129298921138
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10650
FF - user.js: extensions.incredibar_i.ppd - 95%5F4

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Regnull::
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& !*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& %*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& '*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& (*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& +*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& .*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& /*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 0*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 1*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 2*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 7*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 9*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\p* 4*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* &*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* (*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* )*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* ,*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 2*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 3*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* =*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\Ŕ*: 0*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *$*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ***]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *-*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *2*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *5*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *7*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *8*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *9*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *<*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *#*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *%*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ >*"*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*)*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*6*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ z*)*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ˝*?*]
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ î*.*]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Dadejs · #9 Příspěvek od **Dadejs** » 21 pro 2012 23:36

hláška už nevyskočila, takže asi v poho

ComboFix 12-12-20.02 - Dadejs 21.12.2012 23:24:09.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4078.2503 [GMT 1:00]
Spuštěný z: c:\users\Dadejs\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Dadejs\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Burn4Free Toolbar
c:\program files (x86)\Burn4Free Toolbar\affid.dat
c:\program files (x86)\Burn4Free Toolbar\alert_plugin.dll
c:\program files (x86)\Burn4Free Toolbar\basis.xml
c:\program files (x86)\Burn4Free Toolbar\CustomTabPage.dll
c:\program files (x86)\Burn4Free Toolbar\icons.bmp
c:\program files (x86)\Burn4Free Toolbar\info.txt
c:\program files (x86)\Burn4Free Toolbar\install.ico
c:\program files (x86)\Burn4Free Toolbar\MacroParserPlugin.dll
c:\program files (x86)\Burn4Free Toolbar\mbback.bmp
c:\program files (x86)\Burn4Free Toolbar\mbbigopen.bmp
c:\program files (x86)\Burn4Free Toolbar\mbclose.bmp
c:\program files (x86)\Burn4Free Toolbar\mbfwd.bmp
c:\program files (x86)\Burn4Free Toolbar\mbsep.bmp
c:\program files (x86)\Burn4Free Toolbar\nav1c.bmp
c:\program files (x86)\Burn4Free Toolbar\somoto.dll
c:\program files (x86)\Burn4Free Toolbar\TbCommonUtils.dll
c:\program files (x86)\Burn4Free Toolbar\tbcore3.dll
c:\program files (x86)\Burn4Free Toolbar\tbcore3.inf
c:\program files (x86)\Burn4Free Toolbar\TbHelper2.exe
c:\program files (x86)\Burn4Free Toolbar\uninstall.exe
c:\program files (x86)\Burn4Free Toolbar\UninstallToolbar.exe
c:\program files (x86)\Burn4Free Toolbar\update.exe
c:\program files (x86)\Burn4Free Toolbar\version.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-21 do 2012-12-21 )))))))))))))))))))))))))))))))
.
.
2012-12-21 17:42 . 2012-12-21 17:42 -------- d-----w- c:\program files\trend micro
2012-12-21 17:42 . 2012-12-21 17:42 -------- d-----w- C:\rsit
2012-12-21 15:58 . 2012-12-21 15:58 -------- d-----w- c:\users\Dadejs\AppData\Roaming\Malwarebytes
2012-12-21 15:58 . 2012-12-21 18:13 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-12-21 15:58 . 2012-12-21 15:58 -------- d-----w- c:\programdata\Malwarebytes
2012-12-21 15:58 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-21 14:53 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 14:53 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 14:53 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 14:53 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 07:32 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{228C52FC-3172-49FD-99FA-C50D8ED1B83E}\mpengine.dll
2012-12-12 05:28 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-23 21:48 . 2012-12-06 05:08 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 22:17 . 2011-11-20 07:02 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-11 19:03 . 2012-03-31 05:46 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-11 19:03 . 2011-11-19 15:07 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-30 22:51 . 2011-11-19 15:29 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2011-11-19 15:29 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2011-11-19 15:29 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2011-11-19 15:28 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2011-11-19 15:29 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2011-11-19 15:28 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2011-11-19 15:28 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-10-30 22:50 . 2011-11-19 15:28 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-16 08:38 . 2012-11-28 05:33 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 05:33 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 05:33 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-15 16:59 . 2012-03-24 05:49 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-10-09 18:17 . 2012-11-14 05:53 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-14 05:53 226816 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-14 05:53 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-14 05:53 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:40 . 2012-12-12 05:28 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-14 05:53 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-14 05:53 303104 ----a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-14 05:53 70656 ----a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-14 05:53 246272 ----a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-14 05:53 18944 ----a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-14 05:53 216576 ----a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-14 05:53 569344 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-14 05:53 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-14 05:53 18944 ----a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-14 05:53 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-14 05:53 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-09-25 22:47 . 2012-11-14 05:53 78336 ----a-w- c:\windows\SysWow64\synceng.dll
2012-09-25 22:46 . 2012-11-14 05:53 95744 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 21:16 . 2012-10-19 05:35 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"="c:\windows\jmesoft\hotkey.exe" [2011-03-21 118784]
"jmesoft"="c:\windows\jmesoft\ServiceLoader.exe" [2011-03-16 28672]
"Lenovo Eye Distance System"="c:\program files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe" [2010-09-09 265216]
"Lenovo Dynamic Brightness System"="c:\program files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe" [2010-10-08 285696]
"CLMLServer"="c:\program files (x86)\Lenovo\Power2Go\CLMLSvc.exe" [2009-12-04 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"4-Day Forecast"="c:\program files (x86)\4-Day Forecast\4-Day Forecast\4-Day Forecast.exe" [2008-11-10 1060864]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"QuickTime Plugin Install"="c:\program files (x86)\QuickTime\Plugins\DeleteMe1.exe" [2012-11-15 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2012-06-27 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2012-06-27 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2012-06-27 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-20 1255736]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-08-26 57952]
S0 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\DDCDrv.sys [2008-04-08 20832]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-08-26 13408]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-06-11 204288]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 JME Keyboard;JME Keyboard Driver;c:\windows\jmesoft\Service.exe [2011-03-16 32768]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-06-06 231440]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-07-20 247400]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 19:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-26 11543656]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-08-26 114688]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 123400]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mystart.incredibar.com/mb139?a=6OyOwz1bsm&i=26
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.bigseekpro.com/burn4free/{A8250AA1- ... 4AF85B560F}
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files (x86)\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files (x86)\Verdict Free\etnxp.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.centrum.cz/?utm_source=ch-toolbar&u ... paign=home
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/?charset=UTF-8&channel_id=ch-toolbar-ff,ch-toolbar-ff-searchbox,tb-undefined&utm_source=ch-toolbar&utm_medium=ff-centrum-cz&utm_content=toolbar-searchbox&utm_campaign=undefined&q=
FF - ExtSQL: 2012-11-23 22:49; toolbar@centrumholdings.com; c:\users\Dadejs\AppData\Roaming\Mozilla\Firefox\Profiles\veb7dtvm.default\extensions\toolbar@centrumholdings.com
FF - ExtSQL: !HIDDEN! 2011-11-19 20:37; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyOwz1bsm&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 766efe1e000000000000c89cdc58b2d1
FF - user.js: extensions.incredibar_i.instlDay - 15601
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:56
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyOwz1bsm
FF - user.js: extensions.incredibar_i.upn2n - 92262129298921138
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10650
FF - user.js: extensions.incredibar_i.ppd - 95%5F4
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
AddRemove-Burn4Free Toolbar - c:\program files (x86)\Burn4Free Toolbar\UninstallToolbar.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& !*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& %*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& '*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& (*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& +*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& .*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& /*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 7*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\*& 9*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\p* 4*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* &*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* (*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* )*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* ,*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* 3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\`* =*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\Ŕ*: 0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ **]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *$*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ***]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *-*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *2*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *5*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *7*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *8*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *9*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *<*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ * *]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *#*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *%*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *&*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *0*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *1*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *:*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *;*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ */*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ *3*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ >*"*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ l*6*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ z*)*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ ˝*?*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2026504303-3394863346-1200617100-1001\¬ î*.*]
@Allowed: (Read) (RestrictedCode)
DUMPHIVE0.003 (REGF)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2012-12-21 23:32:05 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-21 22:32
ComboFix2.txt 2012-12-21 20:37
.
Před spuštěním: Volných bajtů: 372 960 067 584
Po spuštění: Volných bajtů: 372 786 397 184
.
- - End Of File - - 8FA8B6927E238889FF71A8C4F1E4DD71

Dadejs · #10 Příspěvek od **Dadejs** » 22 pro 2012 08:54

Pokud už to bude všechno, tak moc díky

#11 Příspěvek od **Rudy** » 22 pro 2012 11:26

Pokud PC funguje, jak má, je to vše.

VIRY.CZ

zablokované pc

zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc

Re: zablokované pc