VIRY.CZ

ComboFix 11-01-08.04 - DeaGle DouBle G 09.01.2011 19:02:10.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3070.2384 [GMT 1:00]
Spuštěný z: c:\users\DeaGle DouBle G\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\DeaGle DouBle G\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\ConduitAutoCompleteSearch.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\ConduitAutoCompleteSearch.xpt
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\ConduitToolbar.idl
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\ConduitToolbar.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\ConduitToolbar.xpt
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.xpt
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.xpt
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults\default_radio_skin.xml
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults\fbAlert.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\chrome.manifest
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\chrome\zynga.jar
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\install.rdf
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\lib\xpcom.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\manifest.mf
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\zigbert.rsa
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\zigbert.sf
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin\conduit.gif
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin\conduit.ico
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin\conduit.PNG
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin\conduit.src
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin\conduit.xml
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\version.txt
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome.manifest
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\accessible\dislike.png
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\dislike.png
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\dowebfbdislike.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\Preferences.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\Preferences.xul
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\prefman.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\script-compiler-overlay.xul
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\script-compiler.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\content\xmlhttprequester.js
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\chrome\locale\en\LocaleSwitch.dtd
c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\extensions\fbdislike@doweb.fr\install.rdf

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_X4HSEX_PR298
-------\Service_TunngleService
-------\Service_X4HSEx_Pr298


((((((((((((((((((((((((( Soubory vytvořené od 2010-12-09 do 2011-01-09 )))))))))))))))))))))))))))))))
.

2011-01-09 18:07 . 2011-01-09 18:21 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Local\temp
2011-01-09 18:07 . 2011-01-09 18:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-09 11:36 . 2011-01-09 11:36 -------- d-----w- C:\Beruska
2011-01-08 21:46 . 2011-01-08 21:46 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Local\Apple Computer
2011-01-08 20:30 . 2011-01-08 20:30 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Roaming\Apple Computer
2011-01-08 20:29 . 2011-01-08 20:29 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Roaming\MPEG Streamclip
2011-01-08 20:26 . 2011-01-08 20:26 -------- d-----w- c:\programdata\Apple Computer
2011-01-08 20:23 . 2011-01-08 20:23 -------- d-----w- c:\program files\Common Files\Apple
2011-01-08 20:22 . 2011-01-08 20:22 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Local\Apple
2011-01-08 20:22 . 2011-01-08 20:22 -------- d-----w- c:\program files\Apple Software Update
2011-01-08 20:22 . 2011-01-08 20:22 -------- d-----w- c:\programdata\Apple
2011-01-08 11:05 . 2011-01-08 11:05 -------- d-----w- C:\rsit
2011-01-08 10:40 . 2011-01-08 10:40 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Local\Secunia PSI
2011-01-08 10:39 . 2011-01-08 10:39 -------- d-----w- c:\program files\Secunia
2011-01-07 17:54 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{59FB82AD-1F3F-48A0-B098-008674A604FC}\mpengine.dll
2011-01-05 21:58 . 2011-01-05 21:58 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Local\TechSmith
2011-01-05 21:56 . 2010-03-04 16:27 411480 ----a-w- c:\windows\system32\tsccvid.dll
2011-01-05 21:56 . 2011-01-08 20:28 -------- d-----w- c:\program files\QuickTime
2011-01-05 21:56 . 2011-01-05 21:56 -------- d-----w- c:\program files\Common Files\TechSmith Shared
2011-01-05 21:56 . 2011-01-05 21:56 -------- d-----w- c:\programdata\TechSmith
2011-01-05 21:56 . 2011-01-05 21:56 -------- d-----w- c:\program files\TechSmith
2011-01-05 18:47 . 2011-01-05 18:48 -------- d-----w- c:\program files\Heroes of Newerth
2011-01-02 21:14 . 2011-01-02 21:14 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Roaming\Command & Conquer 3 Tiberium Wars
2011-01-01 03:11 . 2011-01-01 03:11 -------- d-----w- c:\programdata\Age of Empires 3
2011-01-01 02:37 . 2011-01-01 02:42 -------- d-----w- c:\program files\Common Files\Microsoft Games
2010-12-31 16:40 . 2010-12-31 16:40 -------- d-----w- C:\models
2010-12-31 16:40 . 2010-12-31 16:40 -------- d-----w- C:\materials
2010-12-31 09:38 . 2005-04-03 21:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2010-12-31 09:26 . 2010-12-31 09:26 -------- d-----w- c:\windows\TiMoC
2010-12-28 20:23 . 2010-12-31 17:06 -------- d-----w- c:\users\DeaGle DouBle G\AppData\Roaming\.minecraft
2010-12-27 21:29 . 2010-12-27 21:29 -------- d-----w- c:\programdata\EA Core
2010-12-27 21:25 . 2010-12-27 21:27 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-12-25 12:41 . 2011-01-08 16:08 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-12-25 09:20 . 2010-12-25 09:20 -------- d-----w- C:\found.001
2010-12-23 21:08 . 2011-01-08 14:43 -------- d-----w- c:\program files\Activision
2010-12-23 17:10 . 2010-12-23 17:10 -------- d-----w- c:\windows\system32\AGEIA
2010-12-23 17:10 . 2010-12-24 18:13 -------- d-----w- c:\program files\AGEIA Technologies
2010-12-21 22:15 . 2010-12-21 21:56 -------- d-----w- c:\users\DeaGle DouBle G\Part2
2010-12-21 22:15 . 2010-12-21 21:55 -------- d-----w- c:\users\DeaGle DouBle G\Part1
2010-12-17 20:35 . 2010-12-27 20:50 -------- d-----w- c:\programdata\Solidshield
2010-12-15 13:19 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2010-12-15 13:19 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2010-12-15 13:19 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-15 13:19 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 13:19 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 13:19 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-15 13:19 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 13:19 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-12-15 13:19 . 2010-10-18 13:31 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-12-15 13:19 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-01 13:50 . 2010-06-02 12:20 139080 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-01 13:49 . 2010-06-16 12:03 270240 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-01 13:49 . 2010-06-02 12:20 270240 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-01 13:25 . 2010-06-02 12:20 138056 ----a-w- c:\users\DeaGle DouBle G\AppData\Roaming\PnkBstrK.sys
2011-01-01 13:23 . 2010-06-02 12:20 189248 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-01-01 13:22 . 2010-06-02 12:20 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-20 17:09 . 2010-11-10 11:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-11-10 11:12 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-24 17:18 . 2010-06-02 12:20 2373712 ----a-w- c:\windows\system32\pbsvc.exe
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-10 11:03 . 2010-04-11 15:53 319456 ----a-w- c:\windows\DIFxAPI.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-06 13:48 . 2010-08-18 20:12 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-10-27 03:59 . 2010-10-27 03:59 6573568 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-10-27 03:08 . 2010-10-27 03:08 16281600 ----a-w- c:\windows\system32\atioglxx.dll
2010-10-27 02:55 . 2010-10-27 02:55 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-10-27 02:55 . 2010-10-27 02:55 547328 ----a-w- c:\windows\system32\aticfx32.dll
2010-10-27 02:52 . 2010-10-27 02:52 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-10-27 02:51 . 2010-10-27 02:51 393216 ----a-w- c:\windows\system32\atieclxx.exe
2010-10-27 02:51 . 2010-10-27 02:51 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-10-27 02:50 . 2010-10-27 02:50 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-10-27 02:50 . 2010-10-27 02:50 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-10-27 02:49 . 2010-10-27 02:49 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-10-27 02:49 . 2010-10-27 02:49 15872 ----a-w- c:\windows\system32\atimuixx.dll
2010-10-27 02:49 . 2010-10-27 02:49 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-10-27 02:46 . 2010-10-27 02:46 4020736 ----a-w- c:\windows\system32\atidxx32.dll
2010-10-27 02:35 . 2010-10-27 02:35 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-10-27 02:35 . 2010-10-27 02:35 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-10-27 02:33 . 2010-10-27 02:33 5441536 ----a-w- c:\windows\system32\aticaldd.dll
2010-10-27 02:28 . 2010-04-07 01:40 4094464 ----a-w- c:\windows\system32\atiumdag.dll
2010-10-27 02:14 . 2010-04-07 01:46 52736 ----a-w- c:\windows\system32\coinst.dll
2010-10-27 02:14 . 2010-10-27 02:14 249856 ----a-w- c:\windows\system32\atiadlxx.dll
2010-10-27 02:14 . 2010-10-27 02:14 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-10-27 02:14 . 2010-10-27 02:14 27136 ----a-w- c:\windows\system32\atigktxx.dll
2010-10-27 02:14 . 2010-10-27 02:14 229888 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-10-27 02:13 . 2010-10-27 02:13 30720 ----a-w- c:\windows\system32\atiuxpag.dll
2010-10-27 02:13 . 2010-04-07 01:22 28672 ----a-w- c:\windows\system32\atiu9pag.dll
2010-10-27 02:13 . 2010-04-07 01:22 23040 ----a-w- c:\windows\system32\atitmpxx.dll
2010-10-27 02:12 . 2010-10-27 02:12 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-10-27 01:50 . 2010-04-07 01:21 3460096 ----a-w- c:\windows\system32\atiumdva.dll
2010-10-27 01:37 . 2010-10-27 01:37 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-10-27 01:37 . 2010-10-27 01:37 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-10-26 13:52 . 2010-10-26 13:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-19 09:41 . 2010-04-15 05:59 222080 ------w- c:\windows\system32\MpSigStub.exe
2002-06-21 13:29 . 2010-12-09 19:26 2381312 ----a-r- c:\program files\Stronghold.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"RtHDVCpl"="RtHDVCpl.exe" [2007-12-12 4710400]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-5 291896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-12-11 16:06 8530464 ----a-w- c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2007-12-11 16:06 81920 ----a-w- c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
2007-12-11 16:06 86016 ----a-w- c:\windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetRefresh]
2003-11-20 18:01 525824 ----a-w- c:\program files\HP\SetRefresh\SetRefresh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 18:15 1826816 ----a-w- c:\windows\SkyTel.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
R3 GarenaPEngine;GarenaPEngine;c:\users\DEAGLE~1\AppData\Local\Temp\IFA4F48.tmp [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-06-05 691696]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-10-27 176128]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-04-07 576024]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-01-05 988216]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-01-05 399416]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-10-27 6573568]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-10-27 229888]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-09-24 99856]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2011-01-09 c:\windows\Tasks\User_Feed_Synchronization-{B46C21C8-00B7-4AC8-A82D-A608730462A9}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
TCP: {812622B4-B866-45DB-BBAA-0A60372EE8EC} = 217.117.216.76,217.117.216.7
FF - ProfilePath - c:\users\DeaGle DouBle G\AppData\Roaming\Mozilla\Firefox\Profiles\vle4rbuf.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Battlefield Heroes Updater: battlefieldheroespatcher@ea.com - %profile%\extensions\battlefieldheroespatcher@ea.com
FF - Ext: GameBox: gb@toolbar - %profile%\extensions\gb@toolbar
FF - Ext: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: BitTorrentBar Community Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - %profile%\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
FF - Ext: Battlefield Play4Free: battlefieldplay4free@ea.com - %profile%\extensions\battlefieldplay4free@ea.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\DEAGLE~1\AppData\Local\Temp\IFA4F48.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3209739466-3585837341-1438635011-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:9e,7f,5f,7f,5c,c7,80,bf,ef,cf,37,cb,f1,e9,87,4f,ad,e0,66,e8,0e,61,93,
f5,06,8c,9b,13,79,c7,7c,b5,c1,5e,29,f1,b2,7f,c4,f7,b3,05,c5,0f,80,42,e7,97,\
"??"=hex:e2,dc,cf,01,3d,43,6d,ee,63,48,3c,2c,e8,3c,15,c0

[HKEY_USERS\S-1-5-21-3209739466-3585837341-1438635011-1000\Software\SecuROM\License information*]
"datasecu"=hex:0e,aa,76,88,cc,fe,86,d8,e0,e9,38,29,12,d0,1d,e8,d7,80,7a,3c,49,
d8,d2,89,66,7e,b4,f3,4b,88,02,18,b2,26,9b,70,ce,08,ba,10,39,bd,e5,71,7b,ee,\
"rkeysecu"=hex:e9,45,1a,8d,4f,ed,d5,83,3a,00,59,03,d9,08,d6,0b
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\System32\lpksetup.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2011-01-09 19:24:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-09 18:24
ComboFix2.txt 2011-01-09 11:50
ComboFix3.txt 2011-01-08 12:35

Před spuštěním: Volných bajtů: 266 979 082 240
Po spuštění: Volných bajtů: 266 756 325 376

- - End Of File - - 0AEC16FB70FD9C3260F61F7964C44A8F

Jak se chova PC

Pořád se zapíná strašně dlouho.

Respektive nic se nezměnilo.

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Doporucuji provest defragmentaci disku

• Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
  • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
  • prepnete se do zalozky Nastroje
  • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
  • Toto provedte se vsemi disky
• Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
  • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
  • Kliknete na Analyzovat
  • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
  • Postup provedte se vsemi disky
• Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
  • Vyhodou programku je, ze se neinstaluje
  • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
  • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
  • Probehne analyza disku a nasledne i defragmentace

Napiste ci se neco zmenilo...budem pripadne patrat dale...

Nepomohlo,ale vyčistilo.

Co presneji trva dlouho, nez se ukaze samotne logo nebo nez se nacte plocha Nemate na plose nejake velke soubory

Trvá strašně dlouho než to naběhne..mam vista a můžu to popsat tak,že když se mi tam zobrazí Microsoft Corporationa nabíhá mi to,tak to trvá tak 15 min. a když počítač naběhne,tak jede 20 sekund rychle,ale pak jakoby se neuvěřitelně spomalil...žádné velke programy na ploše nemám...301 GB volných z 463.

Pouzivate Grub nebo nejaky jiny bootloader - vecicka, ktera Vam dava na vyber, pri startu PC, ktery system chcete spustit (napr. jestli Win ci Linux)

Stahnete Bootkit Remover http://www.esagelab.com/files/bootkit_remover.rar

• Rozbalte nejlepe na plochu a spustte
• Kliknete pravym mysidlem do okna a klik na Vybrat vše - text bude na bilem pozadi a pak stisknout Enter - text bude na cernem pozadi (pokud po enteru pozadi nezcerna, tak stisknete Ctrl+C)
• Stisknete libovolnou klavesu pro ukoceni utility
• Sem pak vlozte log pomoci tradicni zkratky Ctrl+V

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
002), 32-bit

System volume is \\.\C:
main(): CreateFile() ERROR 5
ERROR: Can't open volume device \\.\C:

Done;
Press any key to quit...

Spustte Bootkit Remover jako spravce - klik na jeho ikonu pravy a Spustit jako spravce

Nemam to tu,mam tu jenom bootkit_remover_debug_log.txt

Stahnete Bootkit Remover http://www.esagelab.com/files/bootkit_remover.rar

• Rozbalte nejlepe na plochu
• kliknete na remover pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete pravym mysidlem do okna a klik na Vybrat vše - text bude na bilem pozadi a pak stisknout Enter - text bude na cernem pozadi (pokud po enteru pozadi nezcerna, tak stisknete Ctrl+C)
• Stisknete libovolnou klavesu pro ukoceni utility
• Sem pak vlozte log pomoci tradicni zkratky Ctrl+V

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
002), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00100000
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: 0ec6b2481fc707d1e901dc2a875f2826

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe ale nespoustejte

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  "%userprofile%\Desktop\mbr" -t

• Kliknete na OK
• Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte

Mate instalacni CD Windows