antivir mi hlásí Trojáka

[Thomas]

občas se mi vypne celý prohlížeč

Logfile of random's system information tool 1.09 (written by random/random)
Run by Dell at 2014-01-01 12:26:18
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 43 GB (57%) free of 76 GB
Total RAM: 2038 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:26:21, on 1.1.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAMain.exe
C:\Program Files\trend micro\Dell.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: EnJoyCoUpoon - {5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2} - C:\ProgramData\EnJoyCoUpoon\8rkyk4kDi0.dll
O2 - BHO: DigIICouupona - {6503A0C9-7130-EA7E-4355-FA14FFC01EBA} - C:\ProgramData\DigIICouupona\fk.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PSUAMain] "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAMain.exe" /LaunchSysTray
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Users\Dell\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MyPC Backup.lnk = C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O20 - AppInit_DLLs: c:\progra~2\sshelp~1\sprote~1.dll c:\progra~3\accele~1\accele~1.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files (x86)\MyPC Backup\BackupStack.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Panda Cloud Antivirus Service (NanoServiceMain) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Novatel Wireless Verizon Device Helper (NWVZHelper) - Novatel Wireless Inc. - C:\Program Files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Panda Product Service (PSUAService) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7046 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\nvHotkey.dll,Start
"C:\Windows\system32\rundll32.exe" "c:\progra~3\accele~1\AccelewinSvc.dll",service
"C:\Windows\system32\rundll32.exe" "c:\progra~3\accele~1\AccelewinSvc.dll",service
"C:\Windows\System32\igfxtray.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
C:\Windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAMain.exe" /LaunchSysTray
"C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE"
"C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe"
"C:\Program Files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe"
"C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
{0638B3E7-9E6F-4BF9-91F6-B74A3CAC51F4}
{A9273A79-B200-46D6-AA6D-73F0690CC998}
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-cff9cbca-b9cd-4685-9a56-25bc18ef5a95 -SystemEventPortName:HostProcess-9d888d11-80ab-458b-a1cc-7b46884b4c40 -IoCancelEventPortName:HostProcess-49d74f9e-7f37-4210-98c0-b3ce12d4c297 -NonStateChangingEventPortName:HostProcess-4656dfb1-8511-4179-935b-b85615807209 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c15d323c-6694-45e7-abc3-bc177c44a9fc -DeviceGroupId:
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"c:\users\dell\appdata\local\google\chrome\application\chrome.exe" --restore-last-session
"c:\users\dell\appdata\local\google\chrome\application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=BrowserPreReadExperiment/100-pct-default/DeferBackgroundExtensionCreation/RateLimited/ForceCompositingMode/thread/InfiniteCache/No/Prerender/PrerenderEnabled/UMA-New-Install-Uniformity-Trial/Control/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_79/UMA-Uniformity-Trial-10-Percent/group_09/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/ --enable-threaded-compositing --renderer-print-preview --disable-html-notifications --disable-accelerated-2d-canvas --channel="3696.1.1652013734\1315889834" /prefetch:673131151
"c:\users\dell\appdata\local\google\chrome\application\chrome.exe" --type=utility --channel="3696.15.904318447\922884314" --lang=cs --ignored=" --type=renderer " /prefetch:-645351001
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Dell\Downloads\RSITx64 (2).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@canon.com/EPPEX]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.21.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\
staged

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
EnJoyCoUpoon - C:\ProgramData\EnJoyCoUpoon\8rkyk4kDi0.x64.dll [2014-01-01 475136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]
DigIICouupona - C:\ProgramData\DigIICouupona\fk.x64.dll [2014-01-01 473088]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
EnJoyCoUpoon - C:\ProgramData\EnJoyCoUpoon\8rkyk4kDi0.dll [2014-01-01 425984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]
DigIICouupona - C:\ProgramData\DigIICouupona\fk.dll [2014-01-01 423936]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-03-11 15960096]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-03-11 82464]
"NVHotkey"=C:\Windows\system32\nvHotkey.dll [2009-03-11 89632]
"nwiz"=nwiz.exe /install []
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 385560]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 363544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"=C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe [2012-06-26 1516632]
"Google Update"=C:\Users\Dell\AppData\Local\Google\Update\GoogleUpdate.exe [2013-10-29 116648]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"PSUAMain"=C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAMain.exe [2013-10-19 32736]

C:\Users\Dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MyPC Backup.lnk - C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\PROGRA~3\ACCELE~1\ACCELE~2.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 261120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NanoServiceMain]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSUAService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-01-01 12:05:45 ----D---- C:\FRST
2014-01-01 11:24:47 ----D---- C:\ProgramData\DigIICouupona
2014-01-01 11:24:39 ----D---- C:\ProgramData\kpgbibhjpganhhcjenekmdjmmhjhgngd
2014-01-01 11:24:23 ----D---- C:\ProgramData\443c26e95a1f9500
2014-01-01 11:24:08 ----D---- C:\ProgramData\EnJoyCoUpoon
2013-12-31 12:51:54 ----A---- C:\Windows\SpeedItup Free Uninstall Log.txt
2013-12-30 13:20:00 ----D---- C:\ProgramData\Accelewin
2013-12-15 18:55:05 ----A---- C:\Windows\system32\wmploc.DLL
2013-12-15 18:55:04 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2013-12-15 18:55:04 ----A---- C:\Windows\SYSWOW64\wmp.dll
2013-12-15 18:55:02 ----A---- C:\Windows\system32\wmp.dll
2013-12-15 18:53:20 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 18:53:19 ----A---- C:\Windows\system32\ieui.dll
2013-12-15 18:53:18 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-12-15 18:53:18 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-12-15 18:53:18 ----A---- C:\Windows\system32\jsproxy.dll
2013-12-15 18:53:18 ----A---- C:\Windows\system32\ieUnatt.exe
2013-12-15 18:53:18 ----A---- C:\Windows\system32\iernonce.dll
2013-12-15 18:53:18 ----A---- C:\Windows\system32\ie4uinit.exe
2013-12-15 18:53:17 ----A---- C:\Windows\system32\iesetup.dll
2013-12-15 18:53:17 ----A---- C:\Windows\system32\ieetwproxystub.dll
2013-12-15 18:53:17 ----A---- C:\Windows\system32\ieetwcollector.exe
2013-12-15 18:53:16 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2013-12-15 18:53:16 ----A---- C:\Windows\system32\mshtml.dll
2013-12-15 18:53:16 ----A---- C:\Windows\system32\jscript9diag.dll
2013-12-15 18:53:16 ----A---- C:\Windows\system32\ieapfltr.dll
2013-12-15 18:53:15 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2013-12-15 18:53:15 ----A---- C:\Windows\system32\iertutil.dll
2013-12-15 18:53:14 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-12-15 18:53:14 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-12-15 18:53:13 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-12-15 18:53:13 ----A---- C:\Windows\system32\wininet.dll
2013-12-15 18:53:13 ----A---- C:\Windows\system32\urlmon.dll
2013-12-15 18:53:12 ----A---- C:\Windows\system32\ieframe.dll
2013-12-15 18:53:11 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-12-15 18:53:10 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-12-15 18:53:09 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-12-15 18:53:09 ----A---- C:\Windows\system32\jscript9.dll
2013-12-15 16:44:32 ----D---- C:\ProgramData\PC Optimizer Pro
2013-12-15 16:16:10 ----D---- C:\Program Files (x86)\MyPC Backup
2013-12-15 16:12:55 ----A---- C:\ProgramData\spds90.txt
2013-12-15 16:12:36 ----D---- C:\Program Files (x86)\SpeedItup Free
2013-12-15 16:12:36 ----D---- C:\FFOutput
2013-12-15 16:11:20 ----D---- C:\Program Files (x86)\FreeTime
2013-12-15 15:55:46 ----D---- C:\Program Files (x86)\DVDVideoSoft
2013-12-15 15:51:06 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-12-15 15:51:06 ----A---- C:\Windows\system32\WMPhoto.dll
2013-12-15 15:51:00 ----A---- C:\Windows\system32\win32k.sys
2013-12-15 15:50:57 ----A---- C:\Windows\system32\msieftp.dll
2013-12-15 15:50:56 ----A---- C:\Windows\SYSWOW64\msieftp.dll
2013-12-15 15:50:50 ----A---- C:\Windows\SYSWOW64\imagehlp.dll
2013-12-15 15:50:50 ----A---- C:\Windows\system32\imagehlp.dll
2013-12-15 15:50:41 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-12-15 15:50:41 ----A---- C:\Windows\system32\tzres.dll
2013-12-15 15:50:26 ----A---- C:\Windows\system32\drivers\portcls.sys
2013-12-15 15:50:26 ----A---- C:\Windows\system32\drivers\drmk.sys
2013-12-15 15:50:24 ----A---- C:\Windows\SYSWOW64\wscript.exe
2013-12-15 15:50:24 ----A---- C:\Windows\system32\scrrun.dll
2013-12-15 15:50:24 ----A---- C:\Windows\system32\cscript.exe
2013-12-15 15:50:23 ----A---- C:\Windows\SYSWOW64\scrrun.dll
2013-12-15 15:50:23 ----A---- C:\Windows\SYSWOW64\cscript.exe
2013-12-15 15:50:23 ----A---- C:\Windows\system32\wscript.exe
2013-12-02 15:36:51 ----A---- C:\Windows\system32\drivers\PSKMAD.sys

======List of files/folders modified in the last 1 month======

2014-01-01 12:26:21 ----D---- C:\Windows\Temp
2014-01-01 12:26:21 ----D---- C:\Program Files\trend micro
2014-01-01 12:08:03 ----D---- C:\Windows
2014-01-01 11:30:57 ----D---- C:\Windows\system32\config
2014-01-01 11:24:55 ----D---- C:\Windows\system32\Tasks
2014-01-01 11:24:47 ----HD---- C:\ProgramData
2014-01-01 11:24:42 ----D---- C:\Windows\Tasks
2014-01-01 11:17:14 ----D---- C:\Windows\system32\drivers
2013-12-31 08:11:16 ----D---- C:\Windows\inf
2013-12-30 16:15:46 ----RD---- C:\Program Files
2013-12-30 13:29:34 ----D---- C:\Windows\Panther
2013-12-30 13:29:34 ----D---- C:\Windows\Logs
2013-12-30 13:29:34 ----D---- C:\Windows\debug
2013-12-30 13:20:18 ----RD---- C:\Program Files (x86)
2013-12-30 13:19:58 ----A---- C:\Users\Dell\AppData\Roaming\regsvr32.exe_log.txt
2013-12-30 13:19:15 ----A---- C:\Users\Dell\AppData\Roaming\LiveSupport.exe_log.txt
2013-12-16 16:10:31 ----D---- C:\Windows\System32
2013-12-16 16:10:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-12-16 16:05:29 ----D---- C:\Windows\winsxs
2013-12-16 16:02:46 ----D---- C:\Windows\SysWOW64
2013-12-16 16:02:46 ----D---- C:\Program Files\Windows Media Player
2013-12-16 16:02:46 ----D---- C:\Program Files (x86)\Windows Media Player
2013-12-16 16:02:45 ----D---- C:\Program Files\Internet Explorer
2013-12-16 16:02:45 ----D---- C:\Program Files (x86)\Internet Explorer
2013-12-16 16:02:44 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-12-16 16:02:44 ----D---- C:\Windows\system32\cs-CZ
2013-12-16 16:02:41 ----D---- C:\Windows\system32\DriverStore
2013-12-15 18:55:19 ----D---- C:\Windows\system32\catroot
2013-12-15 18:53:37 ----D---- C:\Windows\system32\catroot2
2013-12-15 18:52:47 ----D---- C:\Windows\system32\MRT
2013-12-15 18:50:17 ----A---- C:\Windows\system32\MRT.exe
2013-12-15 16:16:05 ----SHD---- C:\Windows\Installer
2013-12-15 15:55:47 ----D---- C:\Program Files (x86)\Common Files
2013-12-12 15:34:26 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hpdskflt;HP Filter; C:\Windows\system32\drivers\hpdskflt.sys [2009-07-08 30008]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 NNSALPC;NNSAlpc; C:\Windows\system32\DRIVERS\NNSAlpc.sys [2013-05-29 91368]
R1 NNSHTTP;NNSHttp; C:\Windows\system32\DRIVERS\NNSHttp.sys [2013-05-29 122088]
R1 NNSHTTPS;NNSHttps; C:\Windows\system32\DRIVERS\NNSHttps.sys [2013-05-29 109288]
R1 NNSIDS;NNSids; C:\Windows\system32\DRIVERS\NNSIds.sys [2013-05-29 114920]
R1 NNSPICC;NNSPicc; C:\Windows\system32\DRIVERS\NNSPicc.sys [2013-05-29 95464]
R1 NNSPOP3;NNSPop3; C:\Windows\system32\DRIVERS\NNSPop3.sys [2013-05-29 119016]
R1 NNSPROT;NNSProt; C:\Windows\system32\DRIVERS\NNSProt.sys [2013-05-29 305896]
R1 NNSPRV;NNSPrv; C:\Windows\system32\DRIVERS\NNSPrv.sys [2013-05-29 118504]
R1 NNSSMTP;NNSSmtp; C:\Windows\system32\DRIVERS\NNSSmtp.sys [2013-05-29 114920]
R1 NNSSTRM;NNSStrm; C:\Windows\system32\DRIVERS\NNSStrm.sys [2013-05-29 246504]
R1 NNSTLSC;NNSTlsc; C:\Windows\system32\DRIVERS\NNSTlsc.sys [2013-05-29 106216]
R1 NvtSp50;Novatel Wireless NDIS 5 Single-Packet Read Protocol Driver; C:\Windows\system32\DRIVERS\NvtSp50.sys [2008-06-10 27648]
R1 PSINKNC;PSINKNC; C:\Windows\system32\DRIVERS\psinknc.sys [2013-10-11 206056]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 PSINAflt;PSINAflt; C:\Windows\system32\DRIVERS\PSINAflt.sys [2013-10-17 169192]
R2 PSINFile;PSINFile; C:\Windows\system32\DRIVERS\PSINFile.sys [2013-10-11 122600]
R2 PSINProc;PSINProc; C:\Windows\system32\DRIVERS\PSINProc.sys [2013-10-11 124648]
R2 PSINProt;PSINProt; C:\Windows\system32\DRIVERS\PSINProt.sys [2013-10-11 137960]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-23 6180832]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
R3 PSKMAD;PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [2013-04-29 58808]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 WinUsb;Ovladač WinUSB; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-21 41984]
S3 Accelerometer;HP Accelerometer; C:\Windows\system32\drivers\Accelerometer.sys [2009-07-08 41272]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-06-10 1146880]
S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-08-05 716800]
S3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2009-07-07 2769400]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2012-01-09 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2012-01-09 27136]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN); C:\Windows\system32\DRIVERS\nwusbmdm_000.sys [2010-07-08 217728]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN); C:\Windows\system32\DRIVERS\nwusbser_000.sys [2010-07-08 217728]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-06-11 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 PSINReg;PSINReg; C:\Windows\system32\DRIVERS\PSINReg.sys [2013-10-11 105704]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 rimmptsk;rimmptsk; C:\Windows\system32\drivers\rimmpx64.sys [2009-06-25 67584]
S3 rismcx64;RICOH Smart Card Reader; C:\Windows\system32\DRIVERS\rismcx64.sys [2009-07-20 59008]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2012-01-09 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 42496]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2012-01-09 9216]
S4 NNSPIHSW;NNSPihsw; C:\Windows\system32\DRIVERS\NNSPihsw.sys [2013-05-29 69864]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a5a53867;Accelewin; C:\Windows\syswow64\rundll32.exe [2009-07-14 44544]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 IJPLMSVC;PIXMA Extended Survey Program; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 99936]
R2 NanoServiceMain;Panda Cloud Antivirus Service; C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2013-10-03 140768]
R2 NWVZHelper;Novatel Wireless Verizon Device Helper; C:\Program Files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe [2010-06-14 270848]
R2 PSUAService;Panda Product Service; C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUAService.exe [2013-10-19 37344]
R3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S2 BackupStack;Computer Backup (MyPC Backup); C:\Program Files (x86)\MyPC Backup\BackupStack.exe [2013-09-19 38440]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-03-11 364064]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-12 257416]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2013-11-26 111616]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-10-01 118680]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-06-08 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Zdravím!
Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[Thomas]

ComboFix 13-12-31.01 - Dell 01.01.2014 12:44:32.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2038.1204 [GMT 1:00]
Spuštěný z: c:\users\Dell\Downloads\ComboFix.exe
AV: Panda Cloud Antivirus *Enabled/Updated* {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
FW: Cloud Antivirus Firewall *Disabled* {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}
SP: Panda Cloud Antivirus *Enabled/Updated* {8F3797EF-DB90-F073-3C72-40C753554CD1}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\o.1rbjg@iysljsvs.co.uk\bootstrap.js
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\o.1rbjg@iysljsvs.co.uk\content\bg.js
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\o.1rbjg@iysljsvs.co.uk\chrome.manifest
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\o.1rbjg@iysljsvs.co.uk\install.rdf
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\uoiuwrcr@auoyo.com\bootstrap.js
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\uoiuwrcr@auoyo.com\content\bg.js
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\uoiuwrcr@auoyo.com\chrome.manifest
c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\extensions\staged\uoiuwrcr@auoyo.com\install.rdf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-01 do 2014-01-01 )))))))))))))))))))))))))))))))
.
.
2014-01-01 11:53 . 2014-01-01 11:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-01 11:42 . 2014-01-01 11:42 70 ----a-w- c:\windows\RAVTC.TMP
2014-01-01 11:05 . 2014-01-01 11:05 -------- d-----w- C:\FRST
2014-01-01 10:24 . 2014-01-01 10:24 -------- d-----w- c:\programdata\DigIICouupona
2014-01-01 10:24 . 2014-01-01 10:24 -------- d-----w- c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd
2014-01-01 10:24 . 2014-01-01 10:24 -------- d-----w- c:\programdata\443c26e95a1f9500
2014-01-01 10:24 . 2014-01-01 10:24 -------- d-----w- c:\programdata\EnJoyCoUpoon
2013-12-31 09:52 . 2014-01-01 10:29 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE0A134A-7279-429B-B870-CD706D54519B}\offreg.dll
2013-12-31 07:15 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE0A134A-7279-429B-B870-CD706D54519B}\mpengine.dll
2013-12-30 12:20 . 2013-12-30 12:20 -------- d-----w- c:\programdata\Accelewin
2013-12-15 17:55 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-15 17:55 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-15 17:55 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-15 17:55 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-15 17:55 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-15 15:44 . 2013-12-15 15:44 -------- d-----w- c:\programdata\PC Optimizer Pro
2013-12-15 15:16 . 2013-12-31 07:11 -------- d-----w- c:\program files (x86)\MyPC Backup
2013-12-15 15:12 . 2013-12-31 11:52 -------- d-----w- c:\program files (x86)\SpeedItup Free
2013-12-15 15:12 . 2013-12-15 15:38 -------- d-----w- C:\FFOutput
2013-12-15 15:11 . 2014-01-01 11:39 -------- d-----w- c:\program files (x86)\FreeTime
2013-12-15 14:55 . 2013-12-15 14:55 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-12-15 14:55 . 2013-12-15 14:55 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2013-12-15 14:51 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-12-15 14:51 . 2013-11-23 17:47 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-12-15 14:51 . 2013-10-30 01:24 3155968 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-15 17:50 . 2013-06-10 16:18 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-12 14:34 . 2013-06-10 14:56 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-12 14:34 . 2012-05-04 13:58 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-26 11:25 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-19 17:22 . 2013-11-19 17:22 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 17:22 . 2013-11-19 17:22 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-19 17:22 . 2013-11-19 17:22 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-19 17:22 . 2013-11-19 17:22 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-19 17:22 . 2013-11-19 17:22 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-19 17:22 . 2013-11-19 17:22 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-19 17:22 . 2013-11-19 17:22 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-19 17:22 . 2013-11-19 17:22 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-19 17:22 . 2013-11-19 17:22 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-19 17:22 . 2013-11-19 17:22 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-19 17:22 . 2013-11-19 17:22 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-19 17:22 . 2013-11-19 17:22 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-19 17:22 . 2013-11-19 17:22 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-19 17:22 . 2013-11-19 17:22 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-19 17:22 . 2013-11-19 17:22 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-19 17:22 . 2013-11-19 17:22 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-19 17:22 . 2013-11-19 17:22 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-19 17:22 . 2013-11-19 17:22 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-19 17:22 . 2013-11-19 17:22 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-19 17:22 . 2013-11-19 17:22 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-19 17:22 . 2013-11-19 17:22 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-19 17:22 . 2013-11-19 17:22 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-19 17:22 . 2013-11-19 17:22 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-19 17:22 . 2013-11-19 17:22 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-19 17:22 . 2013-11-19 17:22 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-19 17:22 . 2013-11-19 17:22 413696 ----a-w- c:\windows\system32\html.iec
2013-11-19 17:22 . 2013-11-19 17:22 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-19 17:22 . 2013-11-19 17:22 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-19 17:22 . 2013-11-19 17:22 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-19 17:22 . 2013-11-19 17:22 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-19 17:22 . 2013-11-19 17:22 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-19 17:22 . 2013-11-19 17:22 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-19 17:22 . 2013-11-19 17:22 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-19 17:22 . 2013-11-19 17:22 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-19 17:22 . 2013-11-19 17:22 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-19 17:22 . 2013-11-19 17:22 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-19 17:22 . 2013-11-19 17:22 235520 ----a-w- c:\windows\system32\url.dll
2013-11-19 17:22 . 2013-11-19 17:22 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-19 17:22 . 2013-11-19 17:22 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-19 17:22 . 2013-11-19 17:22 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-19 17:22 . 2013-11-19 17:22 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-19 17:22 . 2013-11-19 17:22 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-19 17:22 . 2013-11-19 17:22 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-19 17:22 . 2013-11-19 17:22 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-19 17:22 . 2013-11-19 17:22 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-19 17:22 . 2013-11-19 17:22 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-19 17:22 . 2013-11-19 17:22 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 17:22 . 2013-11-19 17:22 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-19 17:22 . 2013-11-19 17:22 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-19 17:22 . 2013-11-19 17:22 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-19 17:22 . 2013-11-19 17:22 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-19 17:22 . 2013-11-19 17:22 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-19 17:22 . 2013-11-19 17:22 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-19 17:22 . 2013-11-19 17:22 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-19 17:22 . 2013-11-19 17:22 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-19 17:22 . 2013-11-19 17:22 101376 ----a-w- c:\windows\system32\inseng.dll
2013-10-14 17:00 . 2013-11-19 17:27 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-14 14:53 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-14 14:53 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-14 14:53 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-14 14:53 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-14 14:53 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-30 15:24 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-10-05 20:25 . 2013-11-14 14:53 1474048 ----a-w- c:\windows\system32\crypt32.dll
2013-10-05 19:57 . 2013-11-14 14:53 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-10-04 02:28 . 2013-11-14 14:53 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 02:25 . 2013-11-14 14:53 197120 ----a-w- c:\windows\system32\credui.dll
2013-10-04 02:24 . 2013-11-14 14:53 1930752 ----a-w- c:\windows\system32\authui.dll
2013-10-04 01:58 . 2013-11-14 14:53 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-14 14:53 168960 ----a-w- c:\windows\SysWow64\credui.dll
2013-10-04 01:56 . 2013-11-14 14:53 1796096 ----a-w- c:\windows\SysWow64\authui.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
2014-01-01 10:24 425984 ----a-w- c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]
2014-01-01 10:24 423936 ----a-w- c:\programdata\DigIICouupona\fk.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2012-06-26 1516632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\Dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files (x86)\MyPC Backup\MyPC Backup.exe [2013-9-19 1953320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 a5a53867;Accelewin;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 BackupStack;Computer Backup (MyPC Backup);c:\program files (x86)\MyPC Backup\BackupStack.exe;c:\program files (x86)\MyPC Backup\BackupStack.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys;c:\windows\SYSNATIVE\Drivers\ATSwpWDF.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\DRIVERS\nwusbmdm_000.sys;c:\windows\SYSNATIVE\DRIVERS\nwusbmdm_000.sys [x]
R3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\DRIVERS\nwusbser_000.sys;c:\windows\SYSNATIVE\DRIVERS\nwusbser_000.sys [x]
S1 NvtSp50;Novatel Wireless NDIS 5 Single-Packet Read Protocol Driver;c:\windows\system32\DRIVERS\NvtSp50.sys;c:\windows\SYSNATIVE\DRIVERS\NvtSp50.sys [x]
S2 NWVZHelper;Novatel Wireless Verizon Device Helper;c:\program files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe;c:\program files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - NNSALPC
*Deregistered* - NNSHTTP
*Deregistered* - NNSHTTPS
*Deregistered* - NNSIDS
*Deregistered* - NNSPICC
*Deregistered* - NNSPOP3
*Deregistered* - NNSPROT
*Deregistered* - NNSPRV
*Deregistered* - NNSSMTP
*Deregistered* - NNSSTRM
*Deregistered* - NNSTLSC
*Deregistered* - PSINAflt
*Deregistered* - PSINKNC
*Deregistered* - PSINProt
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-10 14:34]
.
2013-12-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000Core.job
- c:\users\Dell\AppData\Local\Google\Update\GoogleUpdate.exe [2013-10-29 16:17]
.
2014-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000UA.job
- c:\users\Dell\AppData\Local\Google\Update\GoogleUpdate.exe [2013-10-29 16:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
2014-01-01 10:24 475136 ----a-w- c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.x64.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]
2014-01-01 10:24 473088 ----a-w- c:\programdata\DigIICouupona\fk.x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-11 15960096]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-11 82464]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-03-11 89632]
"nwiz"="nwiz.exe" [2009-03-11 1712672]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 77.236.192.130 88.86.107.235
FF - ProfilePath - c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{62D82EC1-0D3A-DF54-8E3E-07E1337A5311} - c:\programdata\savensHHaree\Ia9iUwFscM.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-01 13:03:17
ComboFix-quarantined-files.txt 2014-01-01 12:03
.
Před spuštěním: Volných bajtů: 45 910 364 160
Po spuštění: Volných bajtů: 45 760 274 432
.
- - End Of File - - 127E89B8A8DE452FDA7DF720B4670C75
A36C5E4F47E84449FF07ED3517B43A31

[Rudy]

Ještě dočistíme. Přesuňte Combofix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd
c:\programdata\443c26e95a1f9500
c:\programdata\EnJoyCoUpoon
c:\programdata\DigIICouupona

Collect::
c:\windows\RAVTC.TMP

File::
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000UA.job

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6503A0C9-7130-EA7E-4355-FA14FFC01EBA}]

Driver::
a5a53867

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[Thomas]

ComboFix 13-12-31.01 - Dell 02.01.2014 10:25:24.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2038.1090 [GMT 1:00]
Spuštěný z: c:\users\Dell\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Dell\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\443c26e95a1f9500
c:\programdata\443c26e95a1f9500\22c3997ee7059bcbdad12bf8fad1b6dd.ini
c:\programdata\443c26e95a1f9500\91edd5c0e4a2c4a4dad12bf8fad1b6dd.ini
c:\programdata\DigIICouupona
c:\programdata\DigIICouupona\fk.dat
c:\programdata\DigIICouupona\fk.dll
c:\programdata\DigIICouupona\fk.tlb
c:\programdata\DigIICouupona\fk.x64.dll
c:\programdata\EnJoyCoUpoon
c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.dat
c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.dll
c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.tlb
c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.x64.dll
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd\background.html
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd\content.js
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd\lsdb.js
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd\LxFc.js
c:\programdata\kpgbibhjpganhhcjenekmdjmmhjhgngd\manifest.json
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3081082431-2408847478-2788677581-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_a5a53867
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-02 do 2014-01-02 )))))))))))))))))))))))))))))))
.
.
2014-01-02 09:33 . 2014-01-02 09:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-01 11:05 . 2014-01-01 11:05 -------- d-----w- C:\FRST
2013-12-31 07:15 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE0A134A-7279-429B-B870-CD706D54519B}\mpengine.dll
2013-12-30 12:20 . 2013-12-30 12:20 -------- d-----w- c:\programdata\Accelewin
2013-12-15 17:55 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-15 17:55 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-15 17:55 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-15 17:55 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-15 17:55 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-15 15:44 . 2013-12-15 15:44 -------- d-----w- c:\programdata\PC Optimizer Pro
2013-12-15 15:16 . 2013-12-31 07:11 -------- d-----w- c:\program files (x86)\MyPC Backup
2013-12-15 15:12 . 2013-12-31 11:52 -------- d-----w- c:\program files (x86)\SpeedItup Free
2013-12-15 15:12 . 2013-12-15 15:38 -------- d-----w- C:\FFOutput
2013-12-15 15:11 . 2014-01-01 11:39 -------- d-----w- c:\program files (x86)\FreeTime
2013-12-15 14:55 . 2013-12-15 14:55 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-12-15 14:55 . 2013-12-15 14:55 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2013-12-15 14:51 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-12-15 14:51 . 2013-11-23 17:47 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-12-15 14:51 . 2013-10-30 01:24 3155968 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-15 17:50 . 2013-06-10 16:18 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-12 14:34 . 2013-06-10 14:56 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-12 14:34 . 2012-05-04 13:58 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-26 11:25 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-19 17:22 . 2013-11-19 17:22 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 17:22 . 2013-11-19 17:22 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-19 17:22 . 2013-11-19 17:22 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-19 17:22 . 2013-11-19 17:22 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-19 17:22 . 2013-11-19 17:22 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-19 17:22 . 2013-11-19 17:22 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-19 17:22 . 2013-11-19 17:22 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-19 17:22 . 2013-11-19 17:22 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-19 17:22 . 2013-11-19 17:22 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-19 17:22 . 2013-11-19 17:22 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-19 17:22 . 2013-11-19 17:22 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-19 17:22 . 2013-11-19 17:22 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-19 17:22 . 2013-11-19 17:22 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-19 17:22 . 2013-11-19 17:22 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-19 17:22 . 2013-11-19 17:22 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-19 17:22 . 2013-11-19 17:22 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-19 17:22 . 2013-11-19 17:22 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-19 17:22 . 2013-11-19 17:22 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-19 17:22 . 2013-11-19 17:22 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-19 17:22 . 2013-11-19 17:22 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-19 17:22 . 2013-11-19 17:22 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-19 17:22 . 2013-11-19 17:22 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-19 17:22 . 2013-11-19 17:22 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-19 17:22 . 2013-11-19 17:22 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-19 17:22 . 2013-11-19 17:22 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-19 17:22 . 2013-11-19 17:22 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-19 17:22 . 2013-11-19 17:22 413696 ----a-w- c:\windows\system32\html.iec
2013-11-19 17:22 . 2013-11-19 17:22 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-19 17:22 . 2013-11-19 17:22 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-19 17:22 . 2013-11-19 17:22 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-19 17:22 . 2013-11-19 17:22 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-19 17:22 . 2013-11-19 17:22 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-19 17:22 . 2013-11-19 17:22 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-19 17:22 . 2013-11-19 17:22 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-19 17:22 . 2013-11-19 17:22 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-19 17:22 . 2013-11-19 17:22 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-19 17:22 . 2013-11-19 17:22 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-19 17:22 . 2013-11-19 17:22 235520 ----a-w- c:\windows\system32\url.dll
2013-11-19 17:22 . 2013-11-19 17:22 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-19 17:22 . 2013-11-19 17:22 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-19 17:22 . 2013-11-19 17:22 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-19 17:22 . 2013-11-19 17:22 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-19 17:22 . 2013-11-19 17:22 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-19 17:22 . 2013-11-19 17:22 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-19 17:22 . 2013-11-19 17:22 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-19 17:22 . 2013-11-19 17:22 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-19 17:22 . 2013-11-19 17:22 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-19 17:22 . 2013-11-19 17:22 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 17:22 . 2013-11-19 17:22 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-19 17:22 . 2013-11-19 17:22 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-19 17:22 . 2013-11-19 17:22 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-19 17:22 . 2013-11-19 17:22 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-19 17:22 . 2013-11-19 17:22 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-19 17:22 . 2013-11-19 17:22 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-19 17:22 . 2013-11-19 17:22 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-19 17:22 . 2013-11-19 17:22 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-19 17:22 . 2013-11-19 17:22 101376 ----a-w- c:\windows\system32\inseng.dll
2013-10-14 17:00 . 2013-11-19 17:27 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-14 14:53 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-14 14:53 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-14 14:53 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-14 14:53 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-14 14:53 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-30 15:24 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-10-05 20:25 . 2013-11-14 14:53 1474048 ----a-w- c:\windows\system32\crypt32.dll
2013-10-05 19:57 . 2013-11-14 14:53 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2012-06-26 1516632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
c:\users\Dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files (x86)\MyPC Backup\MyPC Backup.exe [2013-9-19 1953320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys;c:\windows\SYSNATIVE\Drivers\ATSwpWDF.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\DRIVERS\nwusbmdm_000.sys;c:\windows\SYSNATIVE\DRIVERS\nwusbmdm_000.sys [x]
R3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\DRIVERS\nwusbser_000.sys;c:\windows\SYSNATIVE\DRIVERS\nwusbser_000.sys [x]
R3 rismcx64;RICOH Smart Card Reader;c:\windows\system32\DRIVERS\rismcx64.sys;c:\windows\SYSNATIVE\DRIVERS\rismcx64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 NvtSp50;Novatel Wireless NDIS 5 Single-Packet Read Protocol Driver;c:\windows\system32\DRIVERS\NvtSp50.sys;c:\windows\SYSNATIVE\DRIVERS\NvtSp50.sys [x]
S2 BackupStack;Computer Backup (MyPC Backup);c:\program files (x86)\MyPC Backup\BackupStack.exe;c:\program files (x86)\MyPC Backup\BackupStack.exe [x]
S2 NWVZHelper;Novatel Wireless Verizon Device Helper;c:\program files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe;c:\program files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-10 14:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-11 15960096]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-11 82464]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-03-11 89632]
"nwiz"="nwiz.exe" [2009-03-11 1712672]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 77.236.192.130 88.86.107.235
FF - ProfilePath - c:\users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\bfl0cfme.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{5972B97E-44EC-4F9E-E81A-7E0EE1BD80A2} - c:\programdata\EnJoyCoUpoon\8rkyk4kDi0.dll
BHO-{6503A0C9-7130-EA7E-4355-FA14FFC01EBA} - c:\programdata\DigIICouupona\fk.dll
AddRemove-{62D82EC1-0D3A-DF54-8E3E-07E1337A5311} - c:\programdata\savensHHaree\Ia9iUwFscM.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
.
**************************************************************************
.
Celkový čas: 2014-01-02 10:44:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-01-02 09:44
ComboFix2.txt 2014-01-01 12:03
.
Před spuštěním: Volných bajtů: 45 829 947 392
Po spuštění: Volných bajtů: 45 612 294 144
.
- - End Of File - - A34664731F55FD18806F4E7542357895
A36C5E4F47E84449FF07ED3517B43A31

[Rudy]

Smazáno. Nastala nějaká změna?

[Thomas]

Po provedení jsem byl u laptopu asi hodinku a byl o dost rychlejší, ale pak jsem musel odjet a zpět se vracím až v neděli tak poté budu pokračovat v testování. Zatím veliceré díky.

[Rudy]

Zatím není zač!