Dobrý den, mám opět problém který už jste mi jednou pomohli vyřešit. Jde o to že počítač nejde vypnou restartovat ani přepnut do úsporného režimu, pokaždé se při pokusu o jednu z těch věcí sekne a nejde nic než natvrdo vypnout a následně jde spustit pouze přez microsoft windows recovery consol. Stím související věc je mizení zvukové karty, prostě si zmizí a nejde zvuk, to se dělo i minule, když jste mi pomáhali. Prto bych Vás znovu rád poprosil o pomoc.
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jarda at 2013-02-25 17:33:45
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 52 GB (34%) free of 153 GB
Total RAM: 3001 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:33:55, on 25.2.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dmwu.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Data Transfer Accelerator\Data Transfer Accelerator.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Jarda\Plocha\RSIT.exe
C:\Program Files\trend micro\Jarda.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT3072253
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PLFSetL] C:\WINDOWS\PLFSetL.exe
O4 - HKLM\..\Run: [Data Transfer Accelerator] C:\Program Files\Data Transfer Accelerator\Data Transfer Accelerator.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/a ... oader6.cab
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.co ... .3.1.0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Konfigurační služba Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: WebOptimizer - Unknown owner - C:\WINDOWS\system32\dmwu.exe
--
End of file - 9880 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
=========Mozilla firefox=========
ProfilePath - C:\Documents and Settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5, ffxtlbr@incredibar.com:1.5.0, OneClickDownload@OneClickDownload.com:1.0, {687578b9-7132-4a7a-80e4-30ee31099e03}:3.13.0.6, ffxtlbr@babylon.com:1.5.0, wrc@avast.com:7.0.1474, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... ource=2&q="
"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@canon.com/EPPEX]
"Description"=Canon Easy-PhotoPrint EX
"Path"=C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.4.1]
"Description"=
"Path"=C:\WINDOWS\system32\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1]
"Description"=Yahoo! activeX Plug-in Bridge
"Path"=C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js
C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npnul32.dll
nppdf32.dll
npyaxmpb.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt
C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml
C:\Documents and Settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\extensions\
ffxtlbr@babylon.com
ffxtlbr@incredibar.com
OneClickDownload@OneClickDownload.com
{687578b9-7132-4a7a-80e4-30ee31099e03}
{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
C:\Documents and Settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\searchplugins\
askcom.xml
conduit.xml
MyStart Search.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll [2010-09-28 798771]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-11-08 202144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-04-04 453504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-31 1227736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-04-04 157576]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-31 1227736]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-11-08 1619352]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-05-08 173592]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-01-03 37296]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-05-08 142872]
"PLFSetL"=C:\WINDOWS\PLFSetL.exe [2008-07-03 94208]
"Data Transfer Accelerator"=C:\Program Files\Data Transfer Accelerator\Data Transfer Accelerator.exe [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-10-31 4297136]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-11-02 2508104]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-09-04 767312]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
""= []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ooVoo.exe]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
[]
C:\Documents and Settings\Jarda\Nabídka Start\Programy\Po spuštění
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-05-01 206848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-04-27 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Wolfram Research\Mathematica\7.0\Mathematica.exe"="C:\Program Files\Wolfram Research\Mathematica\7.0\Mathematica.exe:*:Enabled:Wolfram Mathematica 7"
"C:\Program Files\Wolfram Research\Mathematica\7.0\MathKernel.exe"="C:\Program Files\Wolfram Research\Mathematica\7.0\MathKernel.exe:*:Enabled:Wolfram Mathematica 7 Kernel"
"C:\Program Files\Wolfram Research\Mathematica\7.0\math.exe"="C:\Program Files\Wolfram Research\Mathematica\7.0\math.exe:*:Enabled:math.exe"
"C:\Program Files\proeWildfire 4.0\i486_nt\nms\nmsd.exe"="C:\Program Files\proeWildfire 4.0\i486_nt\nms\nmsd.exe:*:Enabled:Pro/ENGINEER Wildfire from PTC"
"C:\Program Files\proeWildfire 4.0\i486_nt\obj\pro_comm_msg.exe"="C:\Program Files\proeWildfire 4.0\i486_nt\obj\pro_comm_msg.exe:*:Enabled:Pro/ENGINEER Wildfire from PTC"
"C:\Program Files\proeWildfire 4.0\i486_nt\obj\xtop.exe"="C:\Program Files\proeWildfire 4.0\i486_nt\obj\xtop.exe:*:Enabled:Pro/ENGINEER Wildfire from PTC"
"C:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\proeWildfire 4.0\bin\proe.exe"="C:\Program Files\proeWildfire 4.0\bin\proe.exe:*:Enabled:Pro/ENGINEER"
"C:\WINDOWS\system32\LEXPPS.EXE"="C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS"
"F:\Program Files\StrongDC++\StrongDC.exe"="F:\Program Files\StrongDC++\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\ooVoo\ooVoo.exe"="C:\Program Files\ooVoo\ooVoo.exe:*:Enabled:ooVoo"
"C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe"="C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe:*:Enabled:FIFA 11"
"C:\Program Files\ICQ7.6\ICQ.exe"="C:\Program Files\ICQ7.6\ICQ.exe:*:Enabled:ICQ7.6"
"C:\Program Files\Dassault Systemes\B19\intel_a\code\bin\CNEXT.exe"="C:\Program Files\Dassault Systemes\B19\intel_a\code\bin\CNEXT.exe:*:Enabled:CATIA"
"C:\Program Files\1ClickDownload\1ClickDownload.exe"="C:\Program Files\1ClickDownload\1ClickDownload.exe:*:Enabled:1ClickDownload"
"C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe"="C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe:*:Enabled:Opera Internet Browser - Plugin wrapper"
"C:\WINDOWS\system32\dmwu.exe"="C:\WINDOWS\system32\dmwu.exe:*:Enabled:dmwu"
"C:\WINDOWS\system32\ARFC\wrtc.exe"="C:\WINDOWS\system32\ARFC\wrtc.exe:*:Enabled:wrtc"
"C:\Program Files\HF Designer\Loader.exe"="C:\Program Files\HF Designer\Loader.exe:*:Enabled:HF Designer"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.6\ICQ.exe"="C:\Program Files\ICQ7.6\ICQ.exe:*:Enabled:ICQ7.6"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"VIDC.FFDS"=ff_vfw.dll
"vidc.tscc"=tsccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.YVU9"=tsbyuv.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux4"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======List of files/folders created in the last 1 month======
2013-02-25 17:27:47 ----ASH---- C:\pagefile.sys
2013-02-24 17:55:11 ----A---- C:\WINDOWS\system32\drivers\CHDAU32.sys
2013-02-14 21:00:30 ----D---- C:\Program Files\Common Files\Skype
2013-02-14 21:00:28 ----RD---- C:\Program Files\Skype
2013-02-02 12:14:59 ----N---- C:\WINDOWS\Setup1.exe
2013-02-02 12:14:59 ----A---- C:\WINDOWS\ST6UNST.EXE
2013-02-02 12:11:35 ----D---- C:\Documents and Settings\Jarda\Data aplikací\u-turn
2013-02-02 12:09:19 ----D---- C:\Program Files\Zpevnikator
2013-02-02 12:09:19 ----D---- C:\Documents and Settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 12:00:12 ----D---- C:\Program Files\Scan to PDF
2013-02-02 12:00:12 ----A---- C:\WINDOWS\Scan to PDF Uninstaller.exe
======List of files/folders modified in the last 1 month======
2013-02-25 17:33:53 ----D---- C:\WINDOWS\Prefetch
2013-02-25 17:33:50 ----D---- C:\WINDOWS\Temp
2013-02-25 17:33:47 ----D---- C:\Program Files\trend micro
2013-02-25 17:32:30 ----D---- C:\WINDOWS\system32
2013-02-25 17:32:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-02-25 17:30:58 ----SD---- C:\WINDOWS\Tasks
2013-02-25 17:28:32 ----D---- C:\WINDOWS
2013-02-25 17:25:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-02-25 17:25:18 ----D---- C:\WINDOWS\system32\CatRoot2
2013-02-25 17:22:00 ----RD---- C:\Program Files
2013-02-25 17:21:41 ----RD---- C:\WINDOWS\Web
2013-02-25 17:20:54 ----D---- C:\WINDOWS\system32\CatRoot
2013-02-25 17:20:34 ----A---- C:\WINDOWS\ODBCINST.INI
2013-02-25 17:17:58 ----D---- C:\WINDOWS\system32\ias
2013-02-25 17:17:50 ----ASH---- C:\WINDOWS\fonts\desktop.ini
2013-02-24 21:03:15 ----D---- C:\Documents and Settings\Jarda\Data aplikací\Skype
2013-02-24 17:56:27 ----D---- C:\Program Files\CONEXANT
2013-02-24 17:55:57 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-02-24 17:55:52 ----D---- C:\WINDOWS\system32\drivers
2013-02-24 17:55:48 ----HD---- C:\WINDOWS\inf
2013-02-24 17:18:51 ----SHD---- C:\WINDOWS\Installer
2013-02-24 17:18:51 ----D---- C:\Config.Msi
2013-02-24 17:17:10 ----D---- C:\Documents and Settings\Jarda\Data aplikací\uTorrent
2013-02-24 17:11:42 ----A---- C:\WINDOWS\NeroDigital.ini
2013-02-24 16:52:10 ----D---- C:\Documents and Settings\Jarda\Data aplikací\Adobe
2013-02-20 23:17:18 ----D---- C:\Documents and Settings\Jarda\Data aplikací\Ancestry
2013-02-17 18:10:42 ----D---- C:\Documents and Settings\Jarda\Data aplikací\vlc
2013-02-17 18:06:06 ----D---- C:\Documents and Settings\Jarda\Data aplikací\MyPhoneExplorer
2013-02-14 21:00:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2013-02-14 21:00:30 ----D---- C:\Program Files\Common Files
2013-02-10 01:59:05 ----D---- C:\Program Files\Opera
2013-01-29 19:43:16 ----D---- C:\Documents and Settings\Jarda\Data aplikací\ICQ
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2011-01-18 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-04-27 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-10-31 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-10-31 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-10-31 738504]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-10-31 361032]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-10-31 54232]
R1 FNETURPX;FNETURPX; C:\WINDOWS\System32\drivers\FNETURPX.SYS [2012-08-18 14656]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 LUMDriver;LUMDriver; \??\C:\WINDOWS\system32\drivers\LUMDriver.sys []
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2011-05-04 217664]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-10-31 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-10-31 97608]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-10-24 271360]
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys []
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2010-10-24 18048]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2001-10-25 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2001-10-25 55936]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2009-03-26 1503840]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAU32.sys [2009-03-09 805888]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-05-01 6315008]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-04-08 39424]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2008-09-11 1754368]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-27 12288]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2004-05-14 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2004-05-14 44384]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2008-02-08 57408]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 a83q61kl;a83q61kl; C:\WINDOWS\system32\drivers\a83q61kl.sys []
S3 bpenum;Intel(R) WiMAX Link Enumerator; C:\WINDOWS\system32\DRIVERS\bpenum.sys [2009-02-01 163840]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 cpuz132;cpuz132; \??\C:\DOCUME~1\Jarda\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys []
S3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys []
S3 FNETTBOH_305;FNETTBOH_305; C:\WINDOWS\System32\drivers\FNETTBOH_305.SYS [2012-08-18 29760]
S3 hexmagic;hexmagic; \??\C:\WINDOWS\system32\drivers\hexmagic.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\WINDOWS\system32\DRIVERS\ewdcsc.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\WINDOWS\system32\DRIVERS\ewusbdev.sys []
S3 K320bus;Sony Ericsson K320 driver (WDM); C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\K320mdfl.sys [2006-08-18 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\K320mdm.sys [2006-08-18 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\K320obex.sys [2006-08-18 86368]
S3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2012-06-11 18560]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2012-06-11 23168]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2012-06-11 137600]
S3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2008-04-14 163584]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-27 19072]
S3 PRISM;Intersil PRISM Wireless LAN Driver; C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys []
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RtsUStor.sys [2009-04-08 164864]
S3 RtsUIR;Realtek IR Driver; C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys []
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1039bus.sys [2010-03-15 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1039mdfl.sys [2010-03-15 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1039mdm.sys [2010-03-15 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1039mgmt.sys [2010-03-15 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1039nd5.sys [2010-03-15 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1039obex.sys [2010-03-15 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1039unic.sys [2010-03-15 123504]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE27bus.sys [2006-09-18 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys [2006-09-18 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE27mdm.sys [2006-09-18 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys [2006-09-18 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:\WINDOWS\system32\DRIVERS\se27nd5.sys [2006-09-18 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE27obex.sys [2006-09-18 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:\WINDOWS\system32\DRIVERS\se27unic.sys [2006-09-18 90800]
S3 se45bus;Sony Ericsson Device 069 driver (WDM); C:\WINDOWS\system32\DRIVERS\se45bus.sys [2006-11-30 61536]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2012-06-11 8192]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBCCID;Realtek Smartcard Reader Driver; C:\WINDOWS\system32\DRIVERS\RtsUCcid.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2012-06-11 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2009-07-14 444136]
S3 WmFilter;Logitech WingMan HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2004-05-14 21440]
S3 WmHidLo;Logitech WingMan USB Filter Driver; C:\WINDOWS\system32\drivers\WmHidLo.sys [2004-05-14 14720]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2004-05-14 5600]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2008-04-27 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-04-27 82944]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 6to4;Pomocná služba protokolu IPv6; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 ACS;Konfigurační služba Atheros; C:\WINDOWS\system32\acs.exe [2009-01-05 475220]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-10-31 44808]
R2 WebOptimizer;WebOptimizer; C:\WINDOWS\system32\dmwu.exe [2012-09-13 1006448]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 jrllh;Helper Config; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 NWCWorkstation;Klient systému NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 zsokuduez;Universal Helper; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2011-05-05 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-07 116648]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-07 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe [2012-04-04 161664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-10-03 725400]
S3 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-01-08 161536]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2012-01-18 155320]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
problém s vypínáním+mizení zvukovky
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Zdravím!
Zkuste nejprve obnovu systému k datu, kdy korektně fungoval.
Zkuste nejprve obnovu systému k datu, kdy korektně fungoval.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
obnova nezabírá, to byla první věc kterou jsem vždy dělal.
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se
jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine
aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,
pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k
nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
ComboFix 13-02-24.01 - Jarda 25.02.2013 19:30:15.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2217 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\progra~1\STAENO~1\THEBER~1\BERGma~1.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-25 do 2013-02-25 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9665:TCP"= 9665:TCP:rwrkczzv
"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S2 zsokuduez;Universal Helper;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zsokuduez
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-ooVoo - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 19:39
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1252)
c:\windows\system32\msacm32.drv
.
Celkový čas: 2013-02-25 19:41:15
ComboFix-quarantined-files.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 978 553 344
Po spuštění: Volných bajtů: 55 930 884 096
.
- - End Of File - - CD173EFB7726A6DA6D52F44096FE0EB4
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2217 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\progra~1\STAENO~1\THEBER~1\BERGma~1.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-25 do 2013-02-25 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9665:TCP"= 9665:TCP:rwrkczzv
"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S2 zsokuduez;Universal Helper;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zsokuduez
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-ooVoo - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 19:39
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1252)
c:\windows\system32\msacm32.drv
.
Celkový čas: 2013-02-25 19:41:15
ComboFix-quarantined-files.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 978 553 344
Po spuštění: Volných bajtů: 55 930 884 096
.
- - End Of File - - CD173EFB7726A6DA6D52F44096FE0EB4
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.KillAll::
File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9665:TCP"=-
"443:TCP"=-
"443:UDP"=-
"37674:TCP"=-
"37674:UDP"=-
"37675:UDP"=-
Firefox::
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FFF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... ource=2&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0g ... 26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
Reboot::
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
ComboFix 13-02-24.01 - Jarda 25.02.2013 20:16:39.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2264 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jarda\Plocha\CFScript.txt..txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AVAST Software\Avast\WebRep\FF\content\about.xul
c:\program files\AVAST Software\Avast\WebRep\FF\content\dateFormat.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\jquery.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\avastwrc.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\dateFormat.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery-1.5.2.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery.1.8.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\pbj.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\protobuf.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\query.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\wrc_gpb.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\log.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js.old
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js.sum
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.xul
c:\program files\AVAST Software\Avast\WebRep\FF\content\pbj.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\protobuf.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\query.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\ratings.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\rules.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\wrc_gpb.js
c:\program files\AVAST Software\Avast\WebRep\FF\defaults\preferences\pref.js
c:\program files\AVAST Software\Avast\WebRep\FF\chrome.manifest
c:\program files\AVAST Software\Avast\WebRep\FF\install.rdf
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ar-SA\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ar-SA\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\be-BY\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\be-BY\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\bg-BG\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\bg-BG\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ca-ES\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ca-ES\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\cs-CZ\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\cs-CZ\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\da-DK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\da-DK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\de-DE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\de-DE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\el-GR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\el-GR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-GB\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-GB\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-US\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-US\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\es-ES\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\es-ES\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\et-EE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\et-EE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fi-FI\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fi-FI\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fr-FR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fr-FR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\he-IL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\he-IL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hr-HR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hr-HR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hu-HU\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hu-HU\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\id-ID\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\id-ID\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\it-IT\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\it-IT\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ja-JP\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ja-JP\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ko-KR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ko-KR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nb-NO\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nb-NO\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nl-NL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nl-NL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pl-PL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pl-PL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-BR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-BR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-PT\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-PT\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ro-RO\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ro-RO\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ru-RU\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ru-RU\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sk-SK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sk-SK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sl-SI\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sl-SI\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sv-SE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sv-SE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\th-TH\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\th-TH\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\tr-TR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\tr-TR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\uk-UA\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\uk-UA\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ur-PK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ur-PK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\vi-VN\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\vi-VN\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-CN\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-CN\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-TW\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-TW\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\skin\avast_logo.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\background-body.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\background-sitecorrect.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\grey0-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\grey3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\grey0-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\grey3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\grey.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\check-priority.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\check-priority.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-big.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-big.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-small.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-small.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\logo.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\overlay.css
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-body.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-body.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-header.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\bg-window.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\Button-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\button-middle.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\close-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-left-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-left-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-right-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-right-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-0.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey0-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey0-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\horizontal-line-white.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\horizontal-line.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\icon_incorrect.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\kenny.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\line-dark-horizontal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\line-light-horizontal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\logo.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-1-108.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\vertical-line.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\Warning.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\window-wrc.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\wrc ico 16x16px a 24x24px.zip
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png
c:\program files\AVAST Software\Avast\WebRep\FF . . . . nemohl být smazán
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-25 do 2013-02-25 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S2 zsokuduez;Universal Helper;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zsokuduez
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 20:36
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2240)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\acs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2013-02-25 20:40:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-25 18:40
ComboFix2.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 931 604 992
Po spuštění: Volných bajtů: 55 895 699 456
.
- - End Of File - - 8BFD32C0A826C782428E419CB6E3F73F
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2264 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jarda\Plocha\CFScript.txt..txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AVAST Software\Avast\WebRep\FF\content\about.xul
c:\program files\AVAST Software\Avast\WebRep\FF\content\dateFormat.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\jquery.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\avastwrc.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\dateFormat.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery-1.5.2.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery.1.8.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\jquery.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\pbj.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\protobuf.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\query.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\libs\wrc_gpb.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\log.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js.old
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.js.sum
c:\program files\AVAST Software\Avast\WebRep\FF\content\overlay.xul
c:\program files\AVAST Software\Avast\WebRep\FF\content\pbj.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\protobuf.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\query.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\ratings.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\rules.js
c:\program files\AVAST Software\Avast\WebRep\FF\content\wrc_gpb.js
c:\program files\AVAST Software\Avast\WebRep\FF\defaults\preferences\pref.js
c:\program files\AVAST Software\Avast\WebRep\FF\chrome.manifest
c:\program files\AVAST Software\Avast\WebRep\FF\install.rdf
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ar-SA\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ar-SA\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\be-BY\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\be-BY\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\bg-BG\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\bg-BG\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ca-ES\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ca-ES\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\cs-CZ\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\cs-CZ\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\da-DK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\da-DK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\de-DE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\de-DE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\el-GR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\el-GR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-GB\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-GB\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-US\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\en-US\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\es-ES\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\es-ES\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\et-EE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\et-EE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fi-FI\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fi-FI\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fr-FR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\fr-FR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\he-IL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\he-IL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hr-HR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hr-HR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hu-HU\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\hu-HU\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\id-ID\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\id-ID\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\it-IT\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\it-IT\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ja-JP\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ja-JP\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ko-KR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ko-KR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nb-NO\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nb-NO\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nl-NL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\nl-NL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pl-PL\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pl-PL\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-BR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-BR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-PT\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\pt-PT\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ro-RO\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ro-RO\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ru-RU\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ru-RU\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sk-SK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sk-SK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sl-SI\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sl-SI\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sv-SE\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\sv-SE\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\th-TH\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\th-TH\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\tr-TR\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\tr-TR\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\uk-UA\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\uk-UA\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ur-PK\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\ur-PK\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\vi-VN\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\vi-VN\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-CN\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-CN\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-TW\wrc.dtd
c:\program files\AVAST Software\Avast\WebRep\FF\locale\zh-TW\wrc.properties
c:\program files\AVAST Software\Avast\WebRep\FF\skin\avast_logo.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\background-body.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\background-sitecorrect.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\green3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\grey0-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\grey3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\orange3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\red3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 16x16px\yellow3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\green3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\grey0-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\grey3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\orange3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\red3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\ico 24x24px\yellow3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\green3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\grey.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\check-priority.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\check-priority.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\orange3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\red3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-big.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-big.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-small.jp
c:\program files\AVAST Software\Avast\WebRep\FF\skin\icons\shop-icon-small.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\logo.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\overlay.css
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-body.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-body.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-header.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\background-right.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\bg-window.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\Button-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\button-middle.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\close-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\close.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-left-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-left-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-right-bottom.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corner-right-top.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\corporate.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\drugs.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\gambling.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\green3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-0.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey0-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey0-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\grey3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\horizontal-line-white.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\horizontal-line.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\icon_incorrect.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\illegal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\it.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\kenny.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\limet.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\line-dark-horizontal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\line-light-horizontal.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\logo.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\news.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\orange.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\pornography.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-1-108.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\red3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\shopping.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\social.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\vertical-line.jpg
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence-small-disable.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence-small-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\violence.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\Warning.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\window-wrc.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-1.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-2.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-3.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-hover.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow-selected.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow1-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow2-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-16.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-24.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\png\yellow3-small.png
c:\program files\AVAST Software\Avast\WebRep\FF\skin\wrc ico 16x16px a 24x24px.zip
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png
c:\program files\AVAST Software\Avast\WebRep\FF . . . . nemohl být smazán
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-25 do 2013-02-25 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S2 zsokuduez;Universal Helper;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zsokuduez
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 20:36
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2240)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\acs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2013-02-25 20:40:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-25 18:40
ComboFix2.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 931 604 992
Po spuštění: Volných bajtů: 55 895 699 456
.
- - End Of File - - 8BFD32C0A826C782428E419CB6E3F73F
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Ještě jednou spusťte CF tímto skriptem:
KillAll::
Driver::
zsokuduez
Reboot::
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
ComboFix 13-02-24.01 - Jarda 26.02.2013 15:51:21.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2194 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jarda\Plocha\CFScript.txt..txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ZSOKUDUEZ
-------\Service_zsokuduez
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-26 do 2013-02-26 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-26 16:06
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2500)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\acs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2013-02-26 16:10:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-26 14:10
ComboFix2.txt 2013-02-25 18:40
ComboFix3.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 853 576 192
Po spuštění: Volných bajtů: 55 748 734 976
.
- - End Of File - - E1F0910EDAE5980BB0F877AC1E3919AA
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3001.2194 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jarda\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jarda\Plocha\CFScript.txt..txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ZSOKUDUEZ
-------\Service_zsokuduez
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-26 do 2013-02-26 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:55 . 2009-03-09 11:32 805888 ----a-w- c:\windows\system32\drivers\CHDAU32.sys
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----w- c:\program files\Common Files\Skype
2013-02-14 19:00 . 2013-02-14 19:00 -------- d-----r- c:\program files\Skype
2013-02-02 10:14 . 2013-02-02 10:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2013-02-02 10:14 . 2013-02-02 10:15 286720 ------w- c:\windows\Setup1.exe
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Local Settings\Data aplikací\u-turn
2013-02-02 10:11 . 2013-02-02 10:11 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\u-turn
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\program files\Zpevnikator
2013-02-02 10:09 . 2013-02-02 10:09 -------- d-----w- c:\documents and settings\Jarda\Data aplikací\Zpevnikator
2013-02-02 10:00 . 2013-02-02 10:00 92911 ----a-w- c:\windows\Scan to PDF Uninstaller.exe
2013-02-02 10:00 . 2013-02-02 10:00 -------- d-----w- c:\program files\Scan to PDF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 03:22 . 2010-06-02 03:22 537432 ----a-w- c:\program files\DXSETUP.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-05-08 173592]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-05-08 142872]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"Data Transfer Accelerator"="c:\program files\Data Transfer Accelerator\Data Transfer Accelerator.exe" [2012-08-18 5165280]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Jarda\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Skype"="c:\program files\Skype\Phone\Skype.exe" /minimized /regrun
"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ACU"="c:\program files\Atheros\ACU.exe" -nogui
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\7.0\\math.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 4.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\proeWildfire 4.0\\bin\\proe.exe"=
"f:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\EA Sports\\FIFA 11\\Game\\fifa.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\Dassault Systemes\\B19\\intel_a\\code\\bin\\CNEXT.exe"=
"c:\\WINDOWS\\system32\\dmwu.exe"=
"c:\\WINDOWS\\system32\\ARFC\\wrtc.exe"=
"c:\\Program Files\\HF Designer\\Loader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.1.2011 19:43 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1.11.2012 19:59 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2012 20:00 361032]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [18.8.2012 19:01 14656]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [24.4.2007 17:52 16688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2012 20:00 21256]
R2 WebOptimizer;WebOptimizer;c:\windows\system32\dmwu.exe [19.9.2012 20:02 1006448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [15.6.2012 16:44 39424]
S2 jrllh;Helper Config;c:\windows\system32\svchost.exe -k netsvcs [14.4.2008 10:52 14336]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14.6.2012 13:14 654408]
S3 bpenum;Intel(R) WiMAX Link Enumerator;c:\windows\system32\drivers\bpenum.sys [1.2.2009 18:39 163840]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [18.8.2012 19:01 29760]
S3 hexmagic;hexmagic;\??\c:\windows\system32\drivers\hexmagic.sys --> c:\windows\system32\drivers\hexmagic.sys [?]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys --> c:\windows\system32\DRIVERS\ewdcsc.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [26.11.2012 21:54 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [26.11.2012 21:54 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [26.11.2012 21:54 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [26.11.2012 21:55 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [26.11.2012 21:55 86368]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [3.12.2012 17:44 137600]
S3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\DRIVERS\PRISMNDS.sys --> c:\windows\system32\DRIVERS\PRISMNDS.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [20.9.2010 19:23 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\drivers\s1039bus.sys [18.8.2011 15:25 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\drivers\s1039mdfl.sys [18.8.2011 15:25 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\drivers\s1039mdm.sys [18.8.2011 15:25 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1039mgmt.sys [18.8.2011 15:25 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1039nd5.sys [18.8.2011 15:25 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\drivers\s1039obex.sys [18.8.2011 15:25 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1039unic.sys [18.8.2011 15:25 123504]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8.1.2013 12:55 161536]
S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [18.8.2011 15:24 155320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jrllh
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-25 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-01 22:50]
.
2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-07 10:19]
.
2013-02-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253
mStart Page =
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: Interfaces\{F666CF3E-7522-4619-AA96-3092EEE76841}: NameServer = 10.120.0.250,10.120.0.251
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Jarda\Data aplikací\Mozilla\Firefox\Profiles\uog193fh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: incredibar.com: ffxtlbr@incredibar.com - %profile%\extensions\ffxtlbr@incredibar.com
FF - Ext: OneClickDownloader: OneClickDownload@OneClickDownload.com - %profile%\extensions\OneClickDownload@OneClickDownload.com
FF - Ext: uTorrentControl2 Community Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - %profile%\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8y0gmLb1&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.incredibar_i.instlDay - 15525
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1423:20
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8y0gmLb1
FF - user.js: extensions.incredibar_i.upn2n - 92824649240286263
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - c892e92c000000000000c80aa9a3fbfa
FF - user.js: extensions.BabylonToolbar.instlDay - 15576
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.612:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3412_7
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-26 16:06
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2500)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\acs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2013-02-26 16:10:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-26 14:10
ComboFix2.txt 2013-02-25 18:40
ComboFix3.txt 2013-02-25 17:41
.
Před spuštěním: Volných bajtů: 55 853 576 192
Po spuštění: Volných bajtů: 55 748 734 976
.
- - End Of File - - E1F0910EDAE5980BB0F877AC1E3919AA
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Log je již OK. Nastala někjaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
Počítač se celkově velice zrychlil, ale opět se dnes vyskytl ten problém, zmizela zvukovka a pc něšel vypnout.
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Zkuste reinstalovat ovladač zv. karty.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
zvuková karta 2x přeinstalována, stav zůstává stejný.
-
Rudy
- Site Admin
- Příspěvky: 119524
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: problém s vypínáním+mizení zvukovky
Podívejte se do správce zařízení, zda systém ZK detekuje?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
jardakykolka
- Návštěvník
- Příspěvky: 61
- Registrován: 10 led 2012 15:30
Re: problém s vypínáním+mizení zvukovky
jo, i když zmízí, jako že jedne zvuk a upravovat hlasitost tak ve správci zařízení pořát je a dokonce hlásí že zařízení pracuje správně. Stává se to často když prohlížím něco v opeře, otevřu odkaz, sekne se opera že ji musim vypnout přez správce úloh a pak právě jakoby zmizí zvukovka.
Přispějete na provoz fóra?