Pomalý PC, falešné bezpečnostní hlášení ve Firefoxu, ...

[VaVa-CZ]

Zdravím, poslední dobou, při přechodu do spánku, hibernace, se objeví BSOD, dvakrát se mně zobrazilo falešné bezpečnostní hlášení ve Firefoxu viz přiložený screenshot, ESET Smart Security nic moc nenašel, Windows Defender smazal nějaké 2 věci.
PC je posledních pár dní také dosti pomalé, seká se i obyčejné 360p přehrávání videa na youtube a to v flashi i html5, HDD často chvilkama swapuje (do RAM nic neukládá, indexování vyplé, zaplé jen body obnovení), také se mně moc nelíbí svchost.exe spuštěný 11x(to také dříve nebylo), také procesor je nadměrně využit přitom mám spuštěné věci(Firefox, Skype atd.) jako obvykle, více než 60% je zkrátka moc. Také mně při prohlížení webu občas vyskočí upozornění "Adobe Flash Player zablokoval potencionálně nebezpečnou aplikaci"

LOG
Logfile of random's system information tool 1.08 (written by random/random)
Run by VaVa at 2011-05-01 14:48:06
Microsoft Windows 7 Ultimate
System drive C: has 19 GB (10%) free of 200 GB
Total RAM: 2047 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:48:22, on 1.5.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Sidebar\sidebar.exe
C:\Programy\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\ASUS\SmartDoctor\SmartDoctor.exe
C:\Programy\RealTemp_358_2\RealTemp.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe
C:\Program Files (x86)\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\ASUS\AASP\1.01.05\aaCenter.exe
C:\Users\VaVa\Desktop\IM\Miranda IM\miranda32.exe
C:\Programy\Evernote\Evernote\Evernote.exe
C:\Programy\Evernote\Evernote\EvernoteTray.exe
C:\Programy\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\TuneUp Utilities 2011\TURatingSynch.exe
C:\Programy\Skype\Phone\Skype.exe
C:\Programy\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\ASUS\AI Suite\AiSuite.exe
C:\Programy\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\ASUS\AI Suite\EnergySaving\PwSave.exe
C:\Programy\AID64 Extreme Edition 1.60.1300\AIDA64 Extreme Edition 1.60.1300 Final\aida64.exe
C:\Programy\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\VaVa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://shop.thefreevpn.com/home.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RealTemp] C:\Programy\RealTemp_358_2\RealTemp.exe
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files (x86)\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] "C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3083627159-592905301-1505791323-1005\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3083627159-592905301-1505791323-1005\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: EvernoteClipper.lnk = C:\Programy\Evernote\Evernote\EvernoteClipper.exe
O8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Programy\Evernote\Evernote\EvernoteIE.dll/204
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Programy\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Programy\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Programy\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Programy\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ProgramData\Skype\Plugins\Plugins\D32D9ABFBE354AC8A84F07C309C1E3AF\Skype4COM.dll
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files (x86)\Common Files\EzTools\hsppp.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\SysWow64\DreamScene.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASDR - Unknown owner - C:\Windows\SysWOW64\ASDR.exe
O23 - Service: ASUS HM Com Service (asHmComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\Windows\system32\astsrv.exe
O23 - Service: ATK Fast User Switch Service (ATKFUSService) - Unknown owner - C:\Windows\system32\ATKFUSService.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systemes SolidWorks Corp. - C:\Programy\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: I-O DATA Device Management Service (IoDevMgrService) - I-O DATA DEVICE, INC. - C:\Program Files (x86)\I-O DATA\IoDevMgrService\IoDevMgrService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\Windows\PSSDNSVC.EXE
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14633 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ATKFUSService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\ASDR.exe
"C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe"
C:\Windows\SysWOW64\astsrv.exe
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
"C:\Program Files (x86)\I-O DATA\IoDevMgrService\IoDevMgrService.exe"
"C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe" /StartService
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe"
"C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe" /StartService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SysWOW64\DllHost.exe /Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
C:\Windows\System32\svchost.exe -k secsvcs
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
atieclxx
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
"C:\Program Files (x86)\Windows Sidebar\sidebar.exe" /autoRun
"C:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Program Files (x86)\ASUS\SmartDoctor\SmartDoctor.exe" /start
"C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe"
"C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe" /TUStart /pid:1128
"C:\Programy\RealTemp_358_2\RealTemp.exe"
"C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe"
"C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe"
"C:\Program Files (x86)\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
"C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe" -Embedding
"C:\Program Files (x86)\ASUS\AASP\1.01.05\aaCenter.exe"
"C:\Users\VaVa\Desktop\IM\Miranda IM\miranda32.exe"
\??\C:\Windows\system32\conhost.exe
C:\Programy\Evernote\Evernote\Evernote.exe
"C:\Programy\Evernote\Evernote\EvernoteTray.exe"
"C:\Programy\Evernote\Evernote\EvernoteClipper.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe"
C:\Windows\splwow64.exe 1
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Acrobat /VERSION:9.0 /MODE:2
"C:\Program Files (x86)\TuneUp Utilities 2011\TURatingSynch.exe"
C:\Programy\Skype\Phone\Skype.exe /notray /nosplash /minimized
"C:\Programy\Skype\Plugin Manager\skypePM.exe" /SILENT
"C:\Program Files (x86)\ASUS\AI Suite\AiSuite.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Bonjour\mDNSResponder.exe"
"C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" gpureading
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Programy\Mozilla Firefox\firefox.exe"
taskeng.exe {9FEFF898-DBB2-45ED-B8F6-AE4C5620183A}
"C:\Program Files (x86)\ASUS\AI Suite\EnergySaving\PwSave.exe"
"C:\Programy\AID64 Extreme Edition 1.60.1300\AIDA64 Extreme Edition 1.60.1300 Final\aida64.exe"
"C:\Programy\Mozilla Firefox\plugin-container.exe" --channel=2636.22e119e0.975582943 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" "Mozilla.Firefox.4.0.1" -omnijar C:\Programy\Mozilla Firefox\omni.jar 2636 \\.\pipe\gecko-crash-server-pipe.2636 plugin
taskeng.exe {70597F11-89D5-48CF-A0B0-DD8C90BAA866}
"C:\Users\VaVa\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
Hotspot Shield Class

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-02-06 2680696]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-05-23 7833120]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-05-23 1833504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [2010-04-16 3872080]
"Sidebar"=C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"DAEMON Tools Lite"=C:\Programy\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-05-16 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livestream Procaster]
C:\Program Files (x86)\Livestream Procaster\Procaster.exe [2009-12-17 6477088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files (x86)\Steam\Steam.exe [2010-12-03 1242448]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"RealTemp"=C:\Programy\RealTemp_358_2\RealTemp.exe [2010-04-13 184320]
"ASUSGamerOSD"=C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe [2009-07-30 380928]
""= []
"Ai Nap"=C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe [2010-03-10 1439360]
"CPU Power Monitor"=C:\Program Files (x86)\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe [2009-12-28 633984]
"Cpu Level Up help"=C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe [2009-12-28 887936]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

C:\Users\VaVa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
EvernoteClipper.lnk - C:\Programy\Evernote\Evernote\EvernoteClipper.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2008-03-18 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MSIServer]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0x01000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"Debugger=""C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe"

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-05-01 14:33:01 ----D---- C:\rsit
2011-05-01 14:33:01 ----D---- C:\Program Files\trend micro
2011-04-29 23:04:50 ----AD---- C:\Windows\VDLL.DLL
2011-04-29 23:04:50 ----AD---- C:\Windows\SYSWOW64\runouce.exe
2011-04-29 23:04:50 ----AD---- C:\Windows\rundll16.exe
2011-04-29 23:04:50 ----AD---- C:\Windows\RUNDL132.EXE
2011-04-29 23:04:50 ----AD---- C:\Windows\logo1_.exe
2011-04-29 23:04:50 ----AD---- C:\Windows\logo_1.exe
2011-04-29 23:00:29 ----A---- C:\Windows\SYSWOW64\msvcr80.dll
2011-04-29 23:00:28 ----A---- C:\Windows\SYSWOW64\msvcp80.dll
2011-04-29 23:00:27 ----A---- C:\Windows\SYSWOW64\eEmpty.exe
2011-04-29 22:59:55 ----D---- C:\ProgramData\MicroWorld
2011-04-26 20:25:56 ----D---- C:\ProgramData\CCP
2011-04-26 17:50:06 ----D---- C:\Program Files (x86)\Evernote
2011-04-24 15:49:04 ----D---- C:\Windows\SYSWOW64\viewers
2011-04-24 15:48:46 ----D---- C:\Program Files (x86)\EzTools
2011-04-23 23:29:11 ----A---- C:\Windows\system32\nvhdap64.dll
2011-04-23 23:29:11 ----A---- C:\Windows\system32\drivers\nvhda64v.sys
2011-04-23 23:29:10 ----A---- C:\Windows\system32\nvhdagenco642040.dll
2011-04-23 23:29:04 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2011-04-23 23:29:04 ----A---- C:\Windows\system32\OpenCL.dll
2011-04-23 23:29:04 ----A---- C:\Windows\system32\nvoglv64.dll
2011-04-23 23:29:03 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2011-04-23 23:29:02 ----A---- C:\Windows\system32\nvgenco642060.dll
2011-04-23 23:29:00 ----A---- C:\Windows\system32\nvdispco6420140.dll
2011-04-23 23:28:59 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2011-04-23 23:28:59 ----A---- C:\Windows\system32\nvd3dumx.dll
2011-04-23 23:28:59 ----A---- C:\Windows\system32\nvcuvid.dll
2011-04-23 23:28:58 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2011-04-23 23:28:58 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2011-04-23 23:28:58 ----A---- C:\Windows\system32\nvcuvenc.dll
2011-04-23 23:28:58 ----A---- C:\Windows\system32\nvcuda.dll
2011-04-23 23:28:55 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2011-04-23 23:28:55 ----A---- C:\Windows\system32\nvcompiler.dll
2011-04-11 23:23:29 ----A---- C:\Windows\War3Unin.pif
2011-04-11 23:23:29 ----A---- C:\Windows\War3Unin.exe
2011-04-11 01:13:20 ----D---- C:\Users\VaVa\AppData\Roaming\DesktopWebAnalytics.FB5198EFD7978A66B6BD7109FD84E1C1DE681503.1
2011-04-10 17:02:41 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2011-04-10 16:49:36 ----D---- C:\Program Files (x86)\Adobe Media Player
2011-04-08 18:35:08 ----ASH---- C:\pagefile.sys
2011-04-08 18:09:43 ----A---- C:\Windows\AsTaskSched.dll
2011-04-08 14:10:47 ----A---- C:\Windows\SYSWOW64\uxtuneup.dll
2011-04-08 14:10:45 ----A---- C:\Windows\system32\uxtuneup.dll
2011-04-08 12:48:39 ----SHD---- C:\Config.Msi
2011-04-08 09:51:31 ----A---- C:\Windows\system32\TURegOpt.exe
2011-04-08 09:51:25 ----A---- C:\Windows\system32\uxtB58A.tmp
2011-04-08 09:51:25 ----A---- C:\Windows\system32\authuitu.dll
2011-04-08 09:51:24 ----A---- C:\Windows\SYSWOW64\authuitu.dll
2011-04-08 09:51:08 ----D---- C:\Program Files (x86)\TuneUp Utilities 2011
2011-04-08 09:45:31 ----SHD---- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-08 09:26:24 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-04-07 23:19:16 ----A---- C:\Windows\system32\nvvsvc.exe
2011-04-07 23:19:16 ----A---- C:\Windows\system32\nvsvcr.dll
2011-04-07 23:19:16 ----A---- C:\Windows\system32\nvmctray.dll
2011-04-07 23:19:14 ----A---- C:\Windows\system32\easyUpdatusAPIU64.dll
2011-04-07 23:19:06 ----A---- C:\Windows\system32\nvcpl.dll
2011-04-07 23:18:42 ----A---- C:\Windows\system32\nvsvc64.dll
2011-04-07 12:17:20 ----RA---- C:\Windows\system32\AdobePDFUI.dll
2011-04-03 11:44:33 ----A---- C:\Windows\system32\AdobePDF.dll
2011-04-02 21:10:05 ----D---- C:\Program Files (x86)\Traffic Simulator Configuration Tool
2011-04-02 20:36:51 ----A---- C:\Windows\Čestina do SimCity 4 Rush Hour a Delux BETA Uninstaller.exe

======List of files/folders modified in the last 1 months======

2011-05-01 14:48:19 ----D---- C:\Windows\Temp
2011-05-01 14:48:00 ----A---- C:\Windows\SYSWOW64\RealTempLog.txt
2011-05-01 14:43:04 ----D---- C:\Users\VaVa\AppData\Roaming\Skype
2011-05-01 14:33:01 ----RD---- C:\Program Files
2011-05-01 12:31:54 ----D---- C:\Users\VaVa\AppData\Roaming\skypePM
2011-05-01 00:41:59 ----SHD---- C:\Windows\Installer
2011-04-30 19:34:02 ----A---- C:\Windows\SYSWOW64\everest_cpl.ini
2011-04-30 19:33:14 ----D---- C:\Windows\Prefetch
2011-04-30 19:05:20 ----D---- C:\Windows\system32\config
2011-04-30 17:00:00 ----D---- C:\Windows\system32\Tasks
2011-04-30 11:20:38 ----AD---- C:\Windows
2011-04-29 23:04:50 ----D---- C:\Windows\SysWOW64
2011-04-29 23:00:08 ----D---- C:\Program Files (x86)\Common Files
2011-04-29 22:59:55 ----HD---- C:\ProgramData
2011-04-29 20:35:01 ----SHD---- C:\System Volume Information
2011-04-26 20:25:56 ----D---- C:\Programy
2011-04-26 17:50:06 ----RD---- C:\Program Files (x86)
2011-04-26 16:28:38 ----D---- C:\ProgramData\NVIDIA
2011-04-26 01:14:37 ----D---- C:\Windows\Minidump
2011-04-26 01:14:25 ----D---- C:\Windows\System32
2011-04-25 10:58:57 ----SHD---- C:\$Recycle.Bin
2011-04-25 02:24:03 ----D---- C:\Users\VaVa\AppData\Roaming\uTorrent
2011-04-23 23:37:27 ----D---- C:\Windows\inf
2011-04-23 23:36:55 ----D---- C:\Program Files\NVIDIA Corporation
2011-04-23 23:36:35 ----RD---- C:\Users
2011-04-23 23:36:30 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2011-04-23 23:36:17 ----D---- C:\Windows\system32\drivers
2011-04-23 23:36:15 ----D---- C:\Windows\system32\catroot2
2011-04-23 23:36:15 ----D---- C:\Windows\system32\catroot
2011-04-23 23:36:14 ----D---- C:\Windows\system32\DriverStore
2011-04-23 23:35:59 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-04-23 22:01:01 ----RSD---- C:\Windows\assembly
2011-04-23 21:31:00 ----D---- C:\Hry
2011-04-20 09:24:32 ----D---- C:\Windows\SYSWOW64\drivers
2011-04-20 09:24:32 ----D---- C:\Program Files (x86)\ASUS
2011-04-14 23:53:53 ----D---- C:\Users\VaVa\AppData\Roaming\vlc
2011-04-12 06:40:44 ----RSD---- C:\Windows\Fonts
2011-04-11 02:00:07 ----D---- C:\ProgramData\Adobe
2011-04-11 01:12:41 ----D---- C:\Program Files (x86)\Adobe
2011-04-10 16:58:36 ----D---- C:\Program Files\Common Files\Adobe
2011-04-10 16:57:04 ----D---- C:\Users\VaVa\AppData\Roaming\Adobe
2011-04-10 16:50:39 ----D---- C:\Users\VaVa\AppData\Roaming\SolidWorks
2011-04-10 16:48:58 ----D---- C:\Windows\winsxs
2011-04-08 19:22:29 ----D---- C:\Fraps
2011-04-08 18:32:03 ----A---- C:\Windows\Language_trs.ini
2011-04-08 14:43:44 ----SHD---- C:\Boot
2011-04-08 14:10:20 ----D---- C:\Users\VaVa\AppData\Roaming\TuneUp Software
2011-04-08 13:20:06 ----D---- C:\Program Files (x86)\VodBurner
2011-04-08 13:19:39 ----D---- C:\Program Files (x86)\VentSrv
2011-04-08 13:17:16 ----D---- C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
2011-04-08 13:15:36 ----SD---- C:\Users\VaVa\AppData\Roaming\Microsoft
2011-04-08 13:09:35 ----D---- C:\Program Files (x86)\DivX
2011-04-08 12:52:51 ----D---- C:\Program Files (x86)\Wippien
2011-04-08 12:52:49 ----D---- C:\Users\VaVa\AppData\Roaming\Wippien
2011-04-08 12:51:43 ----D---- C:\Program Files (x86)\TuneUp Utilities 2009
2011-04-08 12:21:55 ----D---- C:\Users\VaVa\AppData\Roaming\AIWI
2011-04-08 12:19:16 ----D---- C:\Program Files (x86)\Disk Investigator
2011-04-08 09:53:03 ----D---- C:\ProgramData\TuneUp Software
2011-04-08 07:14:00 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2011-04-08 07:14:00 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2011-04-08 07:14:00 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2011-04-08 07:14:00 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2011-04-08 07:14:00 ----A---- C:\Windows\system32\nvwgf2umx.dll
2011-04-08 07:14:00 ----A---- C:\Windows\system32\nvapi64.dll
2011-04-05 16:23:28 ----D---- C:\Temp
2011-04-03 17:09:22 ----D---- C:\ProgramData\FLEXnet
2011-04-02 19:06:14 ----D---- C:\Windows\system32\appmgmt
2011-04-02 19:02:39 ----D---- C:\Program Files (x86)\Steam

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DSFKSVCS;Kernel Services for DSF; C:\Windows\system32\DRIVERS\dsfksvcs.sys [2010-02-08 676232]
R0 dsfroot;root enumerated bus driver; C:\Windows\system32\DRIVERS\dsfroot.sys [2010-02-08 35832]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2007-02-07 14104]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-12-23 834544]
R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2010-08-24 13440]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-02-06 132464]
R1 EIO64;EIO Driver; C:\Windows\system32\DRIVERS\EIO64.sys [2010-12-03 16384]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-02-06 141728]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-02-06 163400]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 44944]
R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver; \??\C:\Programy\AID64 Extreme Edition 1.60.1300\AIDA64 Extreme Edition 1.60.1300 Final\kerneld.x64 [2011-02-17 27296]
R3 atkdisplf;ASUS Kernel Mode Enhanced Driver; C:\Windows\system32\drivers\ATKDispLowFilter.sys [2009-02-17 39424]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-02-06 33608]
R3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Programy\PortableAppZ\EverestPortable\App\EverestUltimate\kerneld.amd64 [2009-05-25 25216]
R3 GGSAFERDriver;GGSAFER Driver; \??\C:\Programy\Garena\safedrv.sys []
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-09-23 33856]
R3 HRMCFGSPC;DSF General Configuration Space Redirection Module; C:\Windows\SYSTEM32\DRIVERS\HRMCFGSPC.SYS [2010-02-08 133512]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-05-23 1762080]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 15416]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-03-03 174184]
R3 nvoclk64;NVIDIA Enthusiasts Platform KDM; C:\Windows\system32\DRIVERS\nvoclk64.sys [2009-09-15 42088]
R3 softehci;Microsoft USB 2.0 Enhanced Host Controller Interface (EHCI) Simulator Driver"; C:\Windows\system32\DRIVERS\softehci.sys [2010-02-08 366592]
R3 teamviewervpn;TeamViewer VPN Adapter; C:\Windows\system32\DRIVERS\teamviewervpn.sys [2008-01-25 35112]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856]
R3 usbehci_dsf;Microsoft DSF-enabled USB 2.0 Enhanced Host Controller Interface (EHCI) Miniport Driver; C:\Windows\system32\DRIVERS\usbehci_dsf.sys [2010-02-08 52736]
R3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\Programy\RealTemp_358_2\WinRing0x64.sys [2008-07-26 14544]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys [2009-01-13 22024]
R3 WmXlCore;Logitech Translation Layer Driver; C:\Windows\system32\drivers\WmXlCore.sys [2009-01-13 57608]
R4 IOMap;IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [2010-02-22 23680]
S2 Vcs;Vcs support; \??\C:\Windows\system32\Drivers\Vcs.sys []
S3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-08-26 7767040]
S3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-08-26 279040]
S3 asusgsb;ASUS Virtual Video Capture Device Driver; C:\Windows\system32\drivers\asusgsb.sys [2009-02-17 17792]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-08-26 7767040]
S3 cpuz130;cpuz130; \??\C:\Users\VaVa\AppData\Local\Temp\cpuz130\cpuz_x64.sys []
S3 HRMACPI;DSF ACPI Redirection Module; C:\Windows\SYSTEM32\DRIVERS\HRMACPI.SYS []
S3 HRMINTS;DSF Interrupt Redirection Module; C:\Windows\SYSTEM32\DRIVERS\HRMINTS.SYS [2010-02-08 128504]
S3 HRMPORTS;DSF IO Port Redirection Module; C:\Windows\SYSTEM32\DRIVERS\HRMPORTS.SYS [2010-02-08 148360]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 ScreamBAudioSvc;ScreamBee Audio; C:\Windows\system32\drivers\ScreamingBAudio64.sys [2009-03-27 27160]
S3 SOFTHIDUSBK;USB HID Layer; C:\Windows\SYSTEM32\DRIVERS\SOFTHIDUSBK.SYS [2010-02-08 206848]
S3 SOFTUSBK;Generic USB device; C:\Windows\SYSTEM32\DRIVERS\SOFTUSBK.SYS [2010-02-08 675328]
S3 SOFTUSBTESTHUB;Generic USB Test Hub; C:\Windows\SYSTEM32\DRIVERS\SOFTUSBTESTHUB.SYS []
S3 SOFTWADP;Wireless adapter devices; C:\Windows\SYSTEM32\DRIVERS\SOFTWADP.SYS []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM); C:\Windows\system32\DRIVERS\vcsvad.sys [2008-12-10 21504]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]
S3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys [2009-01-13 34440]
S3 WmHidLo;Logitech Gaming USB Filter Driver; C:\Windows\system32\drivers\WmHidLo.sys [2009-01-13 36360]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys [2009-01-13 15752]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-08-26 203264]
R2 ASDR;ASDR; C:\Windows\SysWOW64\ASDR.exe [2009-07-27 61440]
R2 asHmComSvc;ASUS HM Com Service; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
R2 astcc;AST Service; C:\Windows\syswow64\astsrv.exe [2010-05-14 57344]
R2 ATKFUSService;ATK Fast User Switch Service; C:\Windows\system32\ATKFUSService.exe [2009-12-01 63488]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2009-02-06 727720]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 2111368]
R2 IoDevMgrService;I-O DATA Device Management Service; C:\Program Files (x86)\I-O DATA\IoDevMgrService\IoDevMgrService.exe [2008-08-08 140744]
R2 nTuneService;Performance Service; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [2010-03-22 276584]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-04-07 1012328]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-10-27 1974080]
R2 UpdateCenterService;Update Center Service; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-11-06 282728]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service; C:\Programy\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2010-06-15 87336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-02-06 23296]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-12-05 1315592]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-09 655624]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 PsShutdownSvc;PsShutdown; C:\Windows\PSSDNSVC.EXE [2010-05-08 87616]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [2010-12-05 79360]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2010-12-03 403240]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-05-16 271920]
S4 TeamViewer4;TeamViewer 4; C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-10-07 185640]
S4 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[VaVa-CZ]

ComboFix 11-05-01.02 - VaVa 02.05.2011 11:32:47.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2047.819 [GMT 2:00]
Spuštěný z: c:\users\VaVa\Downloads\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Outdated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Enabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Enabled/Outdated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\VaVa\AppData\Roaming\Desktopicon
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-02 do 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-05-02 09:40 . 2011-05-02 09:40 -------- d-----w- c:\users\Jirka\AppData\Local\temp
2011-05-02 09:40 . 2011-05-02 09:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-02 09:27 . 2011-05-02 09:28 -------- d-----w- C:\32788R22FWJFW
2011-05-01 12:33 . 2011-05-01 12:48 -------- d-----w- C:\rsit
2011-05-01 12:33 . 2011-05-01 12:48 -------- d-----w- c:\program files\trend micro
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\VDLL.DLL
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\SysWow64\runouce.exe
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\rundll16.exe
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\RUNDL132.EXE
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\logo1_.exe
2011-04-29 21:04 . 2011-04-29 21:04 -------- d---a-w- c:\windows\logo_1.exe
2011-04-29 21:00 . 2011-04-29 21:00 632064 ----a-w- c:\windows\SysWow64\msvcr80.dll
2011-04-29 21:00 . 2011-04-29 21:00 554240 ----a-w- c:\windows\SysWow64\msvcp80.dll
2011-04-29 21:00 . 2011-04-29 21:00 34048 ----a-w- c:\windows\SysWow64\eEmpty.exe
2011-04-29 21:00 . 2011-04-29 21:00 -------- d-----w- c:\program files (x86)\Common Files\MicroWorld
2011-04-29 20:59 . 2011-04-29 21:00 -------- d-----w- c:\programdata\MicroWorld
2011-04-29 06:47 . 2011-04-11 08:21 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E9848914-A425-4689-87AF-95D4642C9A37}\mpengine.dll
2011-04-26 19:44 . 2011-04-26 19:44 -------- d-----w- c:\users\VaVa\AppData\Local\CCP
2011-04-26 18:25 . 2011-04-26 18:25 -------- d-----w- c:\programdata\CCP
2011-04-26 15:50 . 2011-04-26 15:50 -------- d-----w- c:\users\VaVa\AppData\Local\Evernote
2011-04-26 15:50 . 2011-04-26 15:50 -------- d-----w- c:\program files (x86)\Evernote
2011-04-24 13:49 . 2011-04-24 13:49 -------- d-----w- c:\windows\SysWow64\viewers
2011-04-24 13:48 . 2011-04-24 13:49 -------- d-----w- c:\program files (x86)\Common Files\EzTools
2011-04-24 13:48 . 2011-04-24 13:48 -------- d-----w- c:\program files (x86)\EzTools
2011-04-23 21:36 . 2011-04-23 21:36 -------- d-----w- c:\users\UpdatusUser
2011-04-23 21:29 . 2011-03-03 15:59 29288 ----a-w- c:\windows\system32\nvhdap64.dll
2011-04-23 21:29 . 2011-03-03 15:59 174184 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2011-04-23 21:29 . 2011-03-03 15:59 1359976 ----a-w- c:\windows\system32\nvhdagenco642040.dll
2011-04-23 21:29 . 2011-04-08 05:14 67176 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-23 21:29 . 2011-04-08 05:14 57960 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-04-23 21:29 . 2011-04-08 05:14 20700264 ----a-w- c:\windows\system32\nvoglv64.dll
2011-04-23 21:29 . 2011-04-08 05:14 13262184 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-04-23 21:29 . 2011-04-08 05:14 1404008 ----a-w- c:\windows\system32\nvgenco642060.dll
2011-04-23 21:29 . 2011-04-08 05:14 1619048 ----a-w- c:\windows\system32\nvdispco6420140.dll
2011-04-23 21:28 . 2011-04-08 05:14 2893416 ----a-w- c:\windows\system32\nvcuvid.dll
2011-04-23 21:28 . 2011-04-08 05:14 2765928 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2011-04-23 21:28 . 2011-04-08 05:14 12934248 ----a-w- c:\windows\system32\nvd3dumx.dll
2011-04-23 21:28 . 2011-04-08 05:14 6974056 ----a-w- c:\windows\system32\nvcuda.dll
2011-04-23 21:28 . 2011-04-08 05:14 5183080 ----a-w- c:\windows\SysWow64\nvcuda.dll
2011-04-23 21:28 . 2011-04-08 05:14 2204264 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-04-23 21:28 . 2011-04-08 05:14 2074216 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2011-04-23 21:28 . 2011-04-08 05:14 18578536 ----a-w- c:\windows\system32\nvcompiler.dll
2011-04-23 21:28 . 2011-04-08 05:14 13007464 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2011-04-23 21:28 . 2011-04-08 05:14 11240 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-04-11 21:23 . 2011-04-11 21:34 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-11 21:23 . 2011-04-11 21:34 139264 ----a-w- c:\windows\War3Unin.exe
2011-04-10 23:13 . 2011-04-10 23:13 -------- d-----w- c:\users\VaVa\AppData\Roaming\DesktopWebAnalytics.FB5198EFD7978A66B6BD7109FD84E1C1DE681503.1
2011-04-10 15:02 . 2011-04-30 14:27 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2011-04-10 14:49 . 2011-04-10 14:49 -------- d-----w- c:\program files (x86)\Adobe Media Player
2011-04-10 14:46 . 2011-04-19 19:43 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2011-04-08 16:09 . 2011-04-08 16:09 16896 ----a-w- c:\windows\AsTaskSched.dll
2011-04-08 12:10 . 2010-10-27 16:21 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-04-08 12:10 . 2010-10-27 16:21 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-04-08 07:51 . 2010-10-27 16:25 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-04-08 07:51 . 2010-10-27 16:21 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-04-08 07:51 . 2010-10-27 16:21 36160 ----a-w- c:\windows\system32\uxtB58A.tmp
2011-04-08 07:51 . 2010-10-27 16:21 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-04-08 07:51 . 2011-04-18 11:42 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2011
2011-04-08 07:45 . 2011-04-08 07:45 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-08 07:26 . 2011-04-08 07:26 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-04-07 21:19 . 2011-04-07 21:19 2582120 ----a-w- c:\windows\system32\nvsvcr.dll
2011-04-07 21:19 . 2011-04-07 21:19 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-04-07 21:19 . 2011-04-07 21:19 1012328 ----a-w- c:\windows\system32\nvvsvc.exe
2011-04-07 21:19 . 2011-04-07 21:19 797288 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-04-07 21:19 . 2011-04-07 21:19 6338152 ----a-w- c:\windows\system32\nvcpl.dll
2011-04-07 21:18 . 2011-04-07 21:18 3041384 ----a-w- c:\windows\system32\nvsvc64.dll
2011-04-07 10:17 . 2009-08-19 21:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2011-04-03 09:44 . 2009-08-19 21:50 52568 ----a-w- c:\windows\system32\AdobePDF.dll
2011-04-02 19:10 . 2011-04-02 19:10 -------- d-----w- c:\program files (x86)\Traffic Simulator Configuration Tool
2011-04-02 18:36 . 2011-04-02 18:36 151774 ----a-w- c:\windows\Čestina do SimCity 4 Rush Hour a Delux BETA Uninstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-08 05:14 . 2010-12-03 13:16 8411752 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-04-08 05:14 . 2010-12-03 13:16 6299752 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2011-04-08 05:14 . 2010-12-03 13:16 10071656 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-04-08 05:14 . 2010-10-08 02:17 15227496 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2011-04-08 05:14 . 2010-05-25 12:04 2273896 ----a-w- c:\windows\system32\nvapi64.dll
2011-04-08 05:14 . 2010-05-25 12:04 2034280 ----a-w- c:\windows\SysWow64\nvapi.dll
2011-03-31 21:48 . 2011-03-31 21:48 86016 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-03-31 21:48 . 2011-03-31 21:48 84992 ----a-w- c:\windows\system32\frapsv64.dll
2011-02-02 19:40 . 2011-03-30 11:01 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-02-02 16:11 . 2009-10-06 06:11 270720 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\programy\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RealTemp"="c:\programy\RealTemp_358_2\RealTemp.exe" [2010-04-13 184320]
"ASUSGamerOSD"="c:\program files (x86)\ASUS\GamerOSD\GamerOSD.exe" [2009-07-30 380928]
"Ai Nap"="c:\program files (x86)\ASUS\AI Suite\AiNap\AiNap.exe" [2010-03-10 1439360]
"CPU Power Monitor"="c:\program files (x86)\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2009-12-28 633984]
"Cpu Level Up help"="c:\program files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
.
c:\users\VaVa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\programy\Evernote\Evernote\EvernoteClipper.exe [2011-4-12 973824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 136176]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\programy\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2010-06-15 87336]
R3 cpuz130;cpuz130;c:\users\VaVa\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-12-05 1315592]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 136176]
R3 HRMACPI;DSF ACPI Redirection Module;c:\windows\system32\DRIVERS\HRMACPI.SYS [x]
R3 HRMINTS;DSF Interrupt Redirection Module;c:\windows\system32\DRIVERS\HRMINTS.SYS [x]
R3 HRMPORTS;DSF IO Port Redirection Module;c:\windows\system32\DRIVERS\HRMPORTS.SYS [x]
R3 PsShutdownSvc;PsShutdown;c:\windows\PSSDNSVC.EXE [2010-05-08 87616]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [x]
R3 SOFTHIDUSBK;USB HID Layer;c:\windows\system32\DRIVERS\SOFTHIDUSBK.SYS [x]
R3 SOFTUSBK;Generic USB device;c:\windows\system32\DRIVERS\SOFTUSBK.SYS [x]
R3 SOFTUSBTESTHUB;Generic USB Test Hub;c:\windows\system32\DRIVERS\SOFTUSBTESTHUB.SYS [x]
R3 SOFTWADP;Wireless adapter devices;c:\windows\system32\DRIVERS\SOFTWADP.SYS [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [x]
R3 WSOFTUSBK;Generic wireless USB device;c:\windows\system32\DRIVERS\WSOFTUSBK.SYS [x]
R4 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-10-07 185640]
R4 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S0 DSFKSVCS;Kernel Services for DSF;c:\windows\system32\DRIVERS\dsfksvcs.sys [x]
S0 dsfroot;root enumerated bus driver;c:\windows\system32\DRIVERS\dsfroot.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2009-02-06 727720]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 2111368]
S2 IoDevMgrService;I-O DATA Device Management Service;c:\program files (x86)\I-O DATA\IoDevMgrService\IoDevMgrService.exe [2008-08-07 140744]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-10-27 1974080]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\programy\PortableAppZ\EverestPortable\App\EverestUltimate\kerneld.amd64 [2009-05-24 25216]
S3 GGSAFERDriver;GGSAFER Driver;c:\programy\Garena\safedrv.sys [x]
S3 HRMCFGSPC;DSF General Configuration Space Redirection Module;c:\windows\system32\DRIVERS\HRMCFGSPC.SYS [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 nvoclk64;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclk64.sys [x]
S3 softehci;Microsoft USB 2.0 Enhanced Host Controller Interface (EHCI) Simulator Driver;c:\windows\system32\DRIVERS\softehci.sys [x]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856]
S3 usbehci_dsf;Microsoft DSF-enabled USB 2.0 Enhanced Host Controller Interface (EHCI) Miniport Driver;c:\windows\system32\DRIVERS\usbehci_dsf.sys [x]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\programy\RealTemp_358_2\WinRing0x64.sys [2008-07-26 14544]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S4 IOMap;IOMap;c:\windows\system32\drivers\IOMap64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - EVERESTDRIVER
*NewlyCreated* - WINRING0_1_2_0
*Deregistered* - AIDA64Driver
.
Obsah adresáře 'Naplánované úlohy'
.
2011-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 05:30]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 05:30]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2680696]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-22 7833120]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-22 1833504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://shop.thefreevpn.com/home.php
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Evernote 4.0 - c:\programy\Evernote\Evernote\EvernoteIE.dll/204
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\programy\Evernote\Evernote\EvernoteIE.dll/204
FF - ProfilePath - c:\users\VaVa\AppData\Roaming\Mozilla\Firefox\Profiles\7dkcled3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.pipelining.ssl - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: browser.urlbar.autoFill - true
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Adobe Flash Player ActiveX - c:\windows\system32\Macromed\Flash\FlashUtil10e_plugin.exe
AddRemove-SpeedMeter - c:\windows\system32\javaws.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DSFKSVCS\MofImagePath]
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\programy\PortableAppZ\EverestPortable\App\EverestUltimate\kerneld.amd64"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3083627159-592905301-1505791323-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4628C56E-65E9-1984-CD2B-643118AE383B}*]
"hakhiiphghkbkblh"=hex:6a,61,69,6f,67,6b,6e,62,6e,63,67,62,67,6e,6d,6a,6c,61,
70,64,00,00
"iaiiginjlfngcjfjdp"=hex:63,61,69,6f,6a,6c,00,77
.
[HKEY_USERS\S-1-5-21-3083627159-592905301-1505791323-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:70,c9,85,7a,b0,d4,a0,00,27,43,d1,0b,85,dc,b0,3d,91,7a,b2,6f,02,04,22,
b7,f0,22,d2,dd,ad,d9,03,d4,1e,aa,38,24,57,c4,33,af,02,3e,da,25,93,68,29,d0,\
"??"=hex:76,a6,21,3b,40,6b,ac,51,17,d3,e3,98,bd,ae,2d,6c
.
[HKEY_USERS\S-1-5-21-3083627159-592905301-1505791323-1001\Software\SecuROM\License information*]
"datasecu"=hex:d3,70,11,8b,ba,f0,6b,1d,4e,5a,e9,04,02,fc,69,da,a1,b2,c0,4c,9c,
bd,8c,94,10,71,3d,5f,63,14,bb,10,56,7a,ad,18,bc,6f,2c,32,ce,7d,11,73,9a,4b,\
"rkeysecu"=hex:fa,f3,3a,45,34,25,4a,60,3c,3a,be,28,b6,9b,6a,f3
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-05-02 11:43:27
ComboFix-quarantined-files.txt 2011-05-02 09:43
.
Před spuštěním: Volných bajtů: 19 564 867 584
Po spuštění: Volných bajtů: 20 666 990 592
.
- - End Of File - - E0F616132007FEF617403BF5D4756801

[Rudy]

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files (x86)\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

Regnull::
[HKEY_USERS\S-1-5-21-3083627159-592905301-1505791323-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4628C56E-65E9-1984-CD2B-643118AE383B}*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.