VIRY.CZ

Kód: Vybrat vše

Logfile of random's system information tool 1.08 (written by random/random)
Run by Nikusa at 2011-02-10 13:56:36
Microsoft Windows 7 Professional  
System drive C: has 7 GB (23%) free of 30 GB
Total RAM: 3037 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:56:52 , on 2/10/2011
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Users\Nikusa\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nikusa\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nikusa\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nikusa\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nikusa\Downloads\RSIT.exe
C:\Program Files\trend micro\Nikusa.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchcanvas.com/?ot=6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchcanvas.com/?ot=6
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--
End of file - 4186 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3877430911-2477763145-3477534986-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3877430911-2477763145-3477534986-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-11-30 281768]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-08-25 136216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-08-25 170520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-08-25 228864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-02-10 13:56:37 ----D---- C:\Program Files\trend micro
2011-02-10 13:56:36 ----D---- C:\rsit
2011-02-09 08:18:34 ----A---- C:\Windows\system32\win32k.sys
2011-02-09 08:18:32 ----A---- C:\Windows\system32\kerberos.dll
2011-02-09 08:18:31 ----A---- C:\Windows\system32\vbscript.dll
2011-02-09 08:18:31 ----A---- C:\Windows\system32\jscript.dll
2011-02-09 08:18:30 ----A---- C:\Windows\system32\mshtml.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\mstime.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\mshtmled.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\msfeeds.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\licmgr10.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\iertutil.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\iepeers.dll
2011-02-09 08:18:26 ----A---- C:\Windows\system32\iedkcs32.dll
2011-02-09 08:18:25 ----A---- C:\Windows\system32\msfeedssync.exe
2011-02-09 08:18:24 ----A---- C:\Windows\system32\atmlib.dll
2011-02-09 08:18:24 ----A---- C:\Windows\system32\atmfd.dll
2011-02-09 08:18:22 ----A---- C:\Windows\system32\upnp.dll
2011-02-09 08:18:21 ----A---- C:\Windows\system32\wininet.dll
2011-02-09 08:18:21 ----A---- C:\Windows\system32\urlmon.dll
2011-02-09 08:18:21 ----A---- C:\Windows\system32\msxml6.dll
2011-02-09 08:18:21 ----A---- C:\Windows\system32\msxml3.dll
2011-02-09 08:18:19 ----A---- C:\Windows\system32\wscapi.dll
2011-02-09 08:18:19 ----A---- C:\Windows\system32\winhttp.dll
2011-02-09 08:18:19 ----A---- C:\Windows\system32\WebClnt.dll
2011-02-09 08:18:19 ----A---- C:\Windows\system32\ieframe.dll
2011-02-09 08:18:19 ----A---- C:\Windows\system32\davclnt.dll
2011-02-09 08:18:18 ----A---- C:\Windows\system32\wscsvc.dll
2011-02-09 08:18:18 ----A---- C:\Windows\system32\slwga.dll
2011-02-09 08:18:17 ----A---- C:\Windows\system32\d3d10warp.dll
2011-02-09 08:18:16 ----A---- C:\Windows\system32\XpsPrint.dll
2011-02-09 08:18:16 ----A---- C:\Windows\system32\mf.dll
2011-02-09 08:18:16 ----A---- C:\Windows\system32\FntCache.dll
2011-02-09 08:18:16 ----A---- C:\Windows\system32\DWrite.dll
2011-02-09 08:18:16 ----A---- C:\Windows\system32\d2d1.dll
2011-02-09 08:18:15 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-02-09 08:18:15 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-02-09 08:18:15 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-02-09 08:18:15 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-02-09 08:18:15 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-02-09 08:18:15 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-02-09 08:18:14 ----A---- C:\Windows\system32\d3d10_1.dll
2011-02-09 08:18:13 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-02-09 08:18:13 ----A---- C:\Windows\system32\ntdll.dll
2011-02-09 08:18:12 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-02-09 08:18:11 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-02-09 08:18:10 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-02-09 08:18:10 ----A---- C:\Windows\system32\cdd.dll
2011-01-28 17:57:16 ----A---- C:\Windows\system32\TURegOpt.exe
2011-01-28 17:57:13 ----A---- C:\Windows\system32\uxtuneup.dll
2011-01-28 17:57:13 ----A---- C:\Windows\system32\authuitu.dll
2011-01-28 17:56:59 ----D---- C:\Program Files\TuneUp Utilities 2011
2011-01-28 17:56:10 ----SHD---- C:\Config.Msi
2011-01-28 17:39:52 ----D---- C:\Windows\system32\directx
2011-01-28 17:24:35 ----D---- C:\Intel
2011-01-28 17:23:20 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2011-01-28 14:01:50 ----D---- C:\Windows\system32\Wat
2011-01-28 13:59:48 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2011-01-28 13:59:48 ----A---- C:\Windows\system32\PresentationHost.exe
2011-01-28 13:59:48 ----A---- C:\Windows\system32\mscoree.dll
2011-01-28 13:59:47 ----A---- C:\Windows\system32\netfxperf.dll
2011-01-28 13:59:47 ----A---- C:\Windows\system32\dfshim.dll
2011-01-28 13:54:46 ----A---- C:\Windows\system32\browserchoice.exe
2011-01-28 13:53:51 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2011-01-28 13:53:51 ----A---- C:\Windows\system32\drivers\ks.sys
2011-01-27 23:42:14 ----A---- C:\Windows\system32\psisdecd.dll
2011-01-27 23:42:14 ----A---- C:\Windows\system32\msdri.dll
2011-01-27 23:42:14 ----A---- C:\Windows\system32\CPFilters.dll
2011-01-27 23:42:08 ----A---- C:\Windows\system32\tzres.dll
2011-01-27 23:39:13 ----A---- C:\Windows\system32\lsasrv.dll
2011-01-27 23:39:13 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2011-01-27 23:38:33 ----A---- C:\Windows\system32\jsproxy.dll
2011-01-27 23:38:33 ----A---- C:\Windows\system32\ieui.dll
2011-01-27 23:25:16 ----A---- C:\Windows\system32\shell32.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\tsbyuv.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\quartz.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\msyuv.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\msvidc32.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\msrle32.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\mciavi32.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\iyuv_32.dll
2011-01-27 23:21:49 ----A---- C:\Windows\system32\avifil32.dll
2011-01-27 23:21:30 ----A---- C:\Windows\system32\inetcomm.dll
2011-01-27 23:21:29 ----A---- C:\Windows\system32\wmp.dll
2011-01-27 23:21:28 ----A---- C:\Windows\system32\wmploc.DLL
2011-01-27 23:20:41 ----A---- C:\Windows\system32\ir32_32.dll
2011-01-27 23:20:41 ----A---- C:\Windows\system32\iccvid.dll
2011-01-27 23:20:40 ----A---- C:\Windows\system32\wmicmiplugin.dll
2011-01-27 23:20:40 ----A---- C:\Windows\system32\taskschd.dll
2011-01-27 23:20:40 ----A---- C:\Windows\system32\taskeng.exe
2011-01-27 23:20:40 ----A---- C:\Windows\system32\schedsvc.dll
2011-01-27 23:20:39 ----A---- C:\Windows\system32\taskcomp.dll
2011-01-27 23:20:39 ----A---- C:\Windows\system32\schtasks.exe
2011-01-27 23:20:02 ----A---- C:\Windows\system32\odbc32.dll
2011-01-27 23:18:52 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-01-27 23:18:47 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2011-01-27 23:18:47 ----A---- C:\Windows\system32\secproc_ssp.dll
2011-01-27 23:18:47 ----A---- C:\Windows\system32\secproc_isv.dll
2011-01-27 23:18:47 ----A---- C:\Windows\system32\secproc.dll
2011-01-27 23:18:47 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2011-01-27 23:18:47 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2011-01-27 23:18:47 ----A---- C:\Windows\system32\RMActivate_isv.exe
2011-01-27 23:18:47 ----A---- C:\Windows\system32\RMActivate.exe
2011-01-27 23:18:11 ----A---- C:\Windows\system32\consent.exe
2011-01-27 23:17:47 ----A---- C:\Windows\system32\mfc40u.dll
2011-01-27 23:17:47 ----A---- C:\Windows\system32\mfc40.dll
2011-01-27 23:17:46 ----A---- C:\Windows\system32\rtutils.dll
2011-01-27 23:17:45 ----A---- C:\Windows\system32\kernel32.dll
2011-01-27 23:17:45 ----A---- C:\Windows\system32\apphelp.dll
2011-01-27 23:17:12 ----A---- C:\Windows\system32\winlogon.exe
2011-01-27 23:17:12 ----A---- C:\Windows\explorer.exe
2011-01-27 23:17:06 ----A---- C:\Windows\system32\ole32.dll
2011-01-27 23:16:45 ----A---- C:\Windows\system32\asycfilt.dll
2011-01-27 23:16:38 ----A---- C:\Windows\system32\drivers\fvevol.sys
2011-01-27 23:16:38 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-01-27 23:16:29 ----A---- C:\Windows\system32\spoolsv.exe
2011-01-27 23:16:28 ----A---- C:\Windows\system32\schannel.dll
2011-01-27 23:16:27 ----A---- C:\Windows\system32\t2embed.dll
2011-01-27 23:16:26 ----A---- C:\Windows\system32\wmpmde.dll
2011-01-27 23:16:26 ----A---- C:\Windows\system32\fontsub.dll
2011-01-27 23:16:14 ----A---- C:\Windows\system32\srvsvc.dll
2011-01-27 23:16:14 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-01-27 23:16:14 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-01-27 23:16:14 ----A---- C:\Windows\system32\drivers\srv.sys
2011-01-27 23:16:12 ----A---- C:\Windows\system32\comctl32.dll
2011-01-27 23:16:11 ----A---- C:\Windows\system32\oleaut32.dll
2011-01-27 23:15:45 ----A---- C:\Windows\system32\wintrust.dll
2011-01-27 23:15:44 ----A---- C:\Windows\system32\webio.dll
2011-01-27 23:14:38 ----A---- C:\Windows\system32\cabview.dll
2011-01-27 23:14:25 ----A---- C:\Windows\system32\StructuredQuery.dll
2011-01-27 23:14:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-01-27 23:14:20 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-01-27 23:14:20 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-01-23 14:56:29 ----D---- C:\Program Files\uTorrent
2011-01-23 14:56:12 ----D---- C:\Users\Nikusa\AppData\Roaming\uTorrent

======List of files/folders modified in the last 1 months======

2011-02-10 13:56:53 ----D---- C:\Windows\Temp
2011-02-10 13:56:37 ----D---- C:\Program Files
2011-02-10 13:41:38 ----D---- C:\Users\Nikusa\AppData\Roaming\Skype
2011-02-10 10:51:57 ----SHD---- C:\System Volume Information
2011-02-10 10:22:34 ----D---- C:\Windows\system32\config
2011-02-10 10:21:51 ----D---- C:\Users\Nikusa\AppData\Roaming\skypePM
2011-02-10 10:09:25 ----D---- C:\Windows\winsxs
2011-02-10 10:08:00 ----D---- C:\Windows\System32
2011-02-10 10:08:00 ----D---- C:\Program Files\Internet Explorer
2011-02-10 10:07:56 ----D---- C:\Windows\system32\drivers
2011-02-10 09:50:02 ----A---- C:\Windows\system32\MRT.exe
2011-02-09 18:42:34 ----D---- C:\Windows\inf
2011-02-09 18:42:34 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-02-09 18:41:29 ----D---- C:\Windows\system32\NDF
2011-02-09 18:34:14 ----D---- C:\Windows\Prefetch
2011-02-09 18:25:51 ----SD---- C:\ProgramData\Microsoft
2011-02-09 08:18:06 ----D---- C:\Windows\system32\catroot2
2011-02-09 08:18:06 ----D---- C:\Windows\system32\catroot
2011-02-04 21:54:01 ----SHD---- C:\Windows\Installer
2011-01-29 22:03:17 ----D---- C:\Users\Nikusa\AppData\Roaming\Zoner
2011-01-29 12:02:43 ----D---- C:\Windows\system32\Tasks
2011-01-29 10:49:51 ----D---- C:\Windows
2011-01-28 20:34:58 ----D---- C:\Windows\rescache
2011-01-28 18:57:24 ----D---- C:\Windows\Microsoft.NET
2011-01-28 18:57:14 ----RSD---- C:\Windows\assembly
2011-01-28 18:26:08 ----D---- C:\Windows\Minidump
2011-01-28 17:56:38 ----D---- C:\ProgramData\TuneUp Software
2011-01-28 17:56:11 ----HD---- C:\ProgramData
2011-01-28 17:43:06 ----D---- C:\Program Files\WinRAR
2011-01-28 17:39:53 ----D---- C:\temp
2011-01-28 17:30:41 ----D---- C:\Windows\system32\en-US
2011-01-28 17:30:41 ----D---- C:\Program Files\Microsoft.NET
2011-01-28 17:26:15 ----D---- C:\Windows\system32\DriverStore
2011-01-28 14:02:02 ----D---- C:\Windows\ehome
2011-01-28 14:02:02 ----D---- C:\Program Files\Windows Mail
2011-01-28 14:02:01 ----D---- C:\Windows\system32\migration
2011-01-28 14:01:57 ----D---- C:\Windows\AppPatch
2011-01-28 14:01:57 ----D---- C:\Program Files\Windows Media Player
2011-01-13 14:51:09 ----D---- C:\Program Files\ABBYY FineReader 9.0

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-12-24 135096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-11-30 61960]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-05 1221632]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2010-08-25 9024512]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2007-07-31 7680]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-11-29 10064]
R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2009-05-23 29696]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 102912]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
S3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E62x86.sys [2009-08-23 48640]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM); C:\Windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM); C:\Windows\system32\DRIVERS\s1039bus.sys [2010-03-01 98672]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1039mdfl.sys [2010-03-01 14960]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1039mdm.sys [2010-03-01 124016]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1039mgmt.sys [2010-03-01 117872]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1039nd5.sys [2010-03-01 25456]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1039obex.sys [2010-03-01 113904]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1039unic.sys [2010-03-01 123504]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2008-10-27 759072]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-11-30 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-11-30 267944]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-12-14 1517376]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 wmcmgc;Windows Management Configuration; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-01-28 1343400]

-----------------EOF-----------------

Kód: Vybrat vše

ComboFix 11-02-09.05 - fester 02/11/2011   0:30.1.2 - x86
Microsoft Windows 7 Professional   6.1.7600.0.1252.1.1033.18.3046.1970 [GMT 1:00]
Running from: c:\users\fester\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\html
c:\windows\system32\html\calendar.html
c:\windows\system32\html\calendarbottom.html
c:\windows\system32\html\calendartop.html
c:\windows\system32\html\crystalexportdialog.htm
c:\windows\system32\html\crystalprinthost.html
c:\windows\system32\images
c:\windows\system32\images\toolbar\calendar.gif
c:\windows\system32\images\toolbar\crlogo.gif
c:\windows\system32\images\toolbar\export.gif
c:\windows\system32\images\toolbar\export_over.gif
c:\windows\system32\images\toolbar\exportd.gif
c:\windows\system32\images\toolbar\First.gif
c:\windows\system32\images\toolbar\first_over.gif
c:\windows\system32\images\toolbar\Firstd.gif
c:\windows\system32\images\toolbar\gotopage.gif
c:\windows\system32\images\toolbar\gotopage_over.gif
c:\windows\system32\images\toolbar\gotopaged.gif
c:\windows\system32\images\toolbar\grouptree.gif
c:\windows\system32\images\toolbar\grouptree_over.gif
c:\windows\system32\images\toolbar\grouptreed.gif
c:\windows\system32\images\toolbar\grouptreepressed.gif
c:\windows\system32\images\toolbar\Last.gif
c:\windows\system32\images\toolbar\last_over.gif
c:\windows\system32\images\toolbar\Lastd.gif
c:\windows\system32\images\toolbar\Next.gif
c:\windows\system32\images\toolbar\next_over.gif
c:\windows\system32\images\toolbar\Nextd.gif
c:\windows\system32\images\toolbar\Prev.gif
c:\windows\system32\images\toolbar\prev_over.gif
c:\windows\system32\images\toolbar\Prevd.gif
c:\windows\system32\images\toolbar\print.gif
c:\windows\system32\images\toolbar\print_over.gif
c:\windows\system32\images\toolbar\printd.gif
c:\windows\system32\images\toolbar\Refresh.gif
c:\windows\system32\images\toolbar\refresh_over.gif
c:\windows\system32\images\toolbar\refreshd.gif
c:\windows\system32\images\toolbar\Search.gif
c:\windows\system32\images\toolbar\search_over.gif
c:\windows\system32\images\toolbar\searchd.gif
c:\windows\system32\images\toolbar\up.gif
c:\windows\system32\images\toolbar\up_over.gif
c:\windows\system32\images\toolbar\upd.gif
c:\windows\system32\images\tree\begindots.gif
c:\windows\system32\images\tree\beginminus.gif
c:\windows\system32\images\tree\beginplus.gif
c:\windows\system32\images\tree\blank.gif
c:\windows\system32\images\tree\blankdots.gif
c:\windows\system32\images\tree\dots.gif
c:\windows\system32\images\tree\lastdots.gif
c:\windows\system32\images\tree\lastminus.gif
c:\windows\system32\images\tree\lastplus.gif
c:\windows\system32\images\tree\Magnify.gif
c:\windows\system32\images\tree\minus.gif
c:\windows\system32\images\tree\minusbox.gif
c:\windows\system32\images\tree\plus.gif
c:\windows\system32\images\tree\plusbox.gif
c:\windows\system32\images\tree\singleminus.gif
c:\windows\system32\images\tree\singleplus.gif

.
(((((((((((((((((((((((((   Files Created from 2011-01-10 to 2011-02-10  )))))))))))))))))))))))))))))))
.

2011-02-10 23:37 . 2011-02-10 23:37	--------	d-----w-	c:\users\fester\AppData\Local\temp
2011-02-10 23:37 . 2011-02-10 23:37	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-02-10 16:43 . 2011-02-10 16:43	--------	d-----w-	c:\program files\Common Files\CA
2011-02-10 16:43 . 2011-02-10 16:43	--------	d-----w-	c:\program files\Common Files\Crystal Decisions
2011-02-10 16:43 . 2011-02-10 16:43	--------	d-----w-	c:\users\fester\AppData\Roaming\CA
2011-02-10 16:35 . 2011-02-10 16:35	--------	d-----w-	c:\users\fester\AppData\Local\Downloaded Installations
2011-02-10 16:35 . 2011-02-10 16:43	--------	d-----w-	c:\programdata\CA
2011-02-10 16:35 . 2011-02-10 16:43	--------	d-----w-	c:\program files\CA
2011-02-09 22:48 . 2011-01-13 09:41	5890896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{79F416E8-073D-4199-BCE3-1905ED410B92}\mpengine.dll
2011-02-05 23:05 . 2011-02-05 23:05	--------	d-----w-	c:\windows\system32\Adobe
2011-01-17 23:07 . 2011-01-17 23:07	--------	d--h--w-	c:\programdata\CanonBJ
2011-01-17 23:07 . 2008-05-26 19:00	69632	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\CNMPP9E.DLL
2011-01-17 23:07 . 2008-05-26 19:00	27136	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\CNMPD9E.DLL
2011-01-17 23:06 . 2008-05-26 19:00	230912	----a-w-	c:\windows\system32\CNMLM9E.DLL
2011-01-16 23:48 . 2011-01-16 23:48	--------	d-----w-	c:\program files\Microsoft IntelliPoint
2011-01-13 23:19 . 2011-01-13 23:30	--------	d-----r-	c:\users\fester\Virtual Machines
2011-01-13 23:15 . 2009-12-31 09:22	295936	----a-w-	c:\windows\system32\drivers\vpcvmm.sys
2011-01-13 23:15 . 2009-12-31 09:05	2171392	----a-w-	c:\windows\system32\VPCWizard.exe
2011-01-13 23:15 . 2009-12-31 09:05	3330560	----a-w-	c:\windows\system32\vpc.exe
2011-01-13 23:15 . 2009-12-31 06:48	1003008	----a-w-	c:\windows\system32\VMWindow.exe
2011-01-13 23:05 . 2009-09-23 01:18	14848	----a-w-	c:\windows\system32\vpchbuspipe.dll
2011-01-13 23:05 . 2009-09-23 01:18	78336	----a-w-	c:\windows\system32\drivers\vpcusb.sys
2011-01-13 23:05 . 2009-09-23 01:18	165376	----a-w-	c:\windows\system32\drivers\vpchbus.sys
2011-01-13 23:05 . 2009-09-23 01:19	55040	----a-w-	c:\windows\system32\drivers\vpcnfltr.sys
2011-01-13 23:05 . 2009-09-23 01:18	1260032	----a-w-	c:\windows\system32\VPCSettings.exe
2011-01-13 23:05 . 2009-09-23 01:18	793600	----a-w-	c:\windows\system32\vmsal.exe
2011-01-13 23:05 . 2009-09-23 01:18	559616	----a-w-	c:\windows\system32\VMCPropertyHandler.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 20:51 . 2010-12-01 13:37	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-12-14 13:43 . 2010-11-09 09:05	31552	----a-w-	c:\windows\system32\TURegOpt.exe
2010-12-14 13:39 . 2010-11-09 09:05	21312	----a-w-	c:\windows\system32\authuitu.dll
2010-12-14 13:39 . 2010-11-09 09:05	29504	----a-w-	c:\windows\system32\uxtuneup.dll
2010-12-01 13:55 . 2010-12-01 13:37	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sysinternals Desktops"="d:\downloads\Desktops\Desktops.exe" [2010-01-18 116088]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-11 395640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-19 1314816]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-07 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-07 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-07 150552]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 1797008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

R1 dilbdiyl;dilbdiyl;c:\windows\system32\drivers\dilbdiyl.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-09 1343400]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
S2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2007-12-15 75016]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-12-14 1517376]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]


--- Other Services/Drivers In Memory ---

*Deregistered* - avgntflt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://eu.ask.com?o=15788&l=dis
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath - c:\users\fester\AppData\Roaming\Mozilla\Firefox\Profiles\8yd5n1gk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe


.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-02-11  00:39:38
ComboFix-quarantined-files.txt  2011-02-10 23:39

Pre-Run: 1,207,848,960 bytes free
Post-Run: 1,160,540,160 bytes free

- - End Of File - - 419F62E4E280FA9566457010B3B02B46

Kód: Vybrat vše

ComboFix 11-02-09.05 - Fester . 02. 2011   0:45.1.2 - x64
Microsoft Windows 7 Professional   6.1.7600.0.1250.421.1029.18.4094.2839 [GMT 1:00]
Running from: c:\users\Fester\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Fester\AppData\Roaming\gidle.exe

.
(((((((((((((((((((((((((   Files Created from 2011-01-10 to 2011-02-10  )))))))))))))))))))))))))))))))
.

2011-02-10 23:49 . 2011-02-10 23:49	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-02-09 15:05 . 2010-12-18 06:11	714752	----a-w-	c:\windows\system32\kerberos.dll
2011-02-08 16:42 . 2011-01-13 10:20	7844688	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{00B5C458-1225-46E0-A156-B6BD171192B7}\mpengine.dll
2011-02-06 08:24 . 2011-02-06 08:24	--------	d-----w-	c:\users\Fester\AppData\Roaming\QipGuard
2011-02-06 08:23 . 2011-02-10 10:07	--------	d-----w-	c:\program files (x86)\QIP Infium
2011-01-31 21:35 . 2009-08-07 22:20	80896	----a-w-	c:\windows\system32\Spool\prtprocs\x64\LMACGC4C.DLL
2011-01-31 21:35 . 2009-08-07 22:20	88064	----a-w-	c:\windows\system32\Spool\prtprocs\x64\LMACG54C.DLL
2011-01-31 21:34 . 2009-08-07 22:20	81920	----a-w-	c:\windows\system32\Spool\prtprocs\x64\LMACGL4C.DLL
2011-01-31 21:30 . 2011-01-31 22:25	--------	d-----w-	C:\Lexmark
2011-01-31 21:24 . 2011-01-31 21:24	--------	d-----w-	c:\program files\Lexmark_MVE
2011-01-31 17:00 . 2011-02-10 07:40	--------	d-----w-	c:\program files\Lexmark_HostCD
2011-01-31 17:00 . 2009-08-07 22:20	796160	----a-w-	c:\windows\system32\gencoin.dll
2011-01-31 17:00 . 2009-08-07 22:20	1310720	----a-w-	c:\windows\system32\softcoin.dll
2011-01-31 16:54 . 2009-07-14 01:41	99840	----a-w-	c:\windows\system32\Spool\prtprocs\x64\LXKPTPRC.DLL
2011-01-23 22:46 . 2011-01-23 22:46	--------	d-----w-	c:\users\Fester\AppData\Roaming\Foxit Software
2011-01-23 22:46 . 2011-01-23 22:46	--------	d-----w-	c:\users\Fester\AppData\Roaming\Foxit
2011-01-23 22:46 . 2011-01-23 22:46	--------	d-----w-	c:\program files (x86)\Ask.com
2011-01-23 22:46 . 2011-01-23 22:46	--------	d-----w-	c:\program files (x86)\Foxit Software
2011-01-23 09:09 . 2011-01-23 09:09	--------	d-----w-	C:\Silent.Hill.720p.AC3.6Ch.CZ.x264-r0ss
2011-01-22 15:02 . 2011-01-22 18:55	--------	d-----w-	c:\program files (x86)\EA GAMES
2011-01-22 14:59 . 2004-10-22 01:17	69715	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-01-22 14:59 . 2004-10-22 01:17	274432	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-01-22 14:59 . 2004-10-22 01:16	180224	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-01-22 14:59 . 2004-10-22 01:16	5632	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-01-22 14:59 . 2004-10-22 01:18	749568	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-01-22 14:59 . 2011-01-22 14:59	323716	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-01-22 14:59 . 2011-01-22 14:59	192644	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-01-19 14:03 . 2011-01-19 14:03	--------	d-----w-	c:\users\Fester\AppData\Local\iZ3DStereoWallpaperCreato
2011-01-16 19:11 . 2011-01-17 07:55	--------	d--h--w-	c:\windows\Icons
2011-01-16 17:47 . 2011-01-20 21:30	--------	d-----w-	c:\program files (x86)\iZ3D Driver
2011-01-16 00:54 . 2011-01-16 01:56	--------	d-----w-	c:\program files (x86)\iZ3D Media Player Classic
2011-01-15 20:08 . 2011-01-15 20:08	--------	d-----w-	c:\program files (x86)\Haali
2011-01-13 11:08 . 2011-01-13 11:08	--------	d-----w-	c:\program files (x86)\PowerISO
2011-01-13 11:08 . 2009-11-09 03:28	91568	----a-w-	c:\windows\system32\drivers\scdemu.sys
2011-01-13 10:45 . 2002-07-17 09:03	45056	----a-w-	c:\windows\SysWow64\WNASPI32.DLL
2011-01-13 10:45 . 2002-07-17 07:53	16877	----a-w-	c:\windows\SysWow64\drivers\ASPI32.SYS
2011-01-13 09:46 . 2011-01-13 14:43	165232	---ha-w-	c:\users\Fester\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-15 19:52 . 2010-11-27 11:54	29480	----a-w-	c:\windows\SysWow64\msxml3a.dll
2011-01-15 19:52 . 2008-02-25 08:26	505128	----a-w-	c:\windows\SysWow64\msvcp71.dll
2011-01-15 19:52 . 2008-02-25 08:26	353576	----a-w-	c:\windows\SysWow64\msvcr71.dll
2011-01-09 21:24 . 2011-01-09 21:24	56899	----a-w-	c:\windows\SysWow64\x264-uninstall.exe
2010-12-21 18:32 . 2010-11-27 11:45	92672	----a-w-	c:\windows\system32\ff_vfw.dll
2010-12-21 18:32 . 2010-11-27 11:45	52224	----a-w-	c:\windows\system32\ff_acm.acm
2010-12-14 13:43 . 2011-01-06 20:50	34624	----a-w-	c:\windows\system32\TURegOpt.exe
2010-12-14 13:39 . 2011-01-06 20:50	25920	----a-w-	c:\windows\system32\authuitu.dll
2010-12-14 13:39 . 2011-01-06 20:50	21312	----a-w-	c:\windows\SysWow64\authuitu.dll
2010-12-14 13:39 . 2011-01-06 20:50	36160	----a-w-	c:\windows\system32\uxtuneup.dll
2010-12-14 13:39 . 2011-01-06 20:50	29504	----a-w-	c:\windows\SysWow64\uxtuneup.dll
2010-12-08 21:10 . 2010-12-08 21:10	15629088	----a-w-	c:\users\Fester\AppData\Roaming\winamp5601_pro_all.exe
2010-11-29 16:42 . 2010-12-02 19:10	24152	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-11-29 12:11 . 2010-11-29 12:11	48648	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-11-29 12:11 . 2010-11-29 12:11	458048	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-11-27 21:20 . 2010-09-15 20:34	83120	----a-w-	c:\windows\system32\drivers\avgntflt.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 21:44	1400712	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2010-12-11 395640]
"iTracker"="c:\program files (x86)\ASUS\iTracker\iTracker.exe" [2009-04-27 1707520]
"QIP Internet Guardian"="c:\users\Fester\AppData\Roaming\QipGuard\QipGuard.exe" [2011-02-03 191360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"NokiaMServer"=c:\program files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
"PWRISOVM.EXE"=c:\program files (x86)\PowerISO\PWRISOVM.EXE
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrxusb.sys [2007-11-22 1064448]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-09-16 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-09-16 79360]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [2010-02-26 25088]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2010-02-26 12288]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2010-02-26 173056]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [2010-02-26 19456]
R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2010-09-23 35112]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-15 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 archlp;archlp;c:\windows\system32\drivers\archlp.sys [2010-01-12 142848]
S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [2010-09-15 16384]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-05 135336]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-12-14 2019648]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-11-29 11856]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]

.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: kuaiche.com\software
FF - ProfilePath - c:\users\Fester\AppData\Roaming\Mozilla\Firefox\Profiles\s0a8oxyr.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - hxxp://qip.ru
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: PC Sync 2 Synchronisation Extension: bkmrksync@nokia.com - g:\program files (x86)\Nokia\Nokia PC Suite 7\bkmrksync
FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
FF - Ext: eBay Sidebar for Firefox: {62760FD6-B943-48C9-AB09-F99C6FE96088} - %profile%\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Foxit PDF Creator Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com
FF - Ext: QipAuthorizer: {32a1fd71-835e-4b11-8e54-886fda0b4c89} - %profile%\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -

Wow6432Node-HKLM-Run-P17RunE - P17RunE.dll
Wow6432Node-HKLM-Run-gidle - c:\users\Fester\AppData\Roaming\gidle.exe
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-x264 VFW - c:\windows\system32\x264-uninstall.exe


.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2701260577-2833626082-2814547817-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"

[HKEY_USERS\S-1-5-21-2701260577-2833626082-2814547817-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="DFB67D40854E2D2761A1AA2E9193E8FBC55C182B10F095A54E99B5B597EADB796F8BCFC5A5D6C8C0A2DB9CAB84BD99B4D277553B338FA1DE4E2CDBD4E8AB3EC24F177FB1203157CE12DDBD03B829F02BFA3D22E42373514F4EE2B09E9F102D6DF49E5CB08D34F22753DB1639C82B9499336C63A01B0EEFB134A9109DB649BDDAD55B5C83486918F0117BD2E290CB888BF4399F7898072D99EADFF7F3ED3868FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555FEBC9E127BECC74CA6171C11EC38DE3D6B721715C89DA0D08A5AAC09EBC7B114E91F2FC271BF490E1D0A9842086F47B200ECE5CF136F15B2C7CEF168ED46E4AAEEBDA7B5F8B34A6C6E9B73977E0F9C49448C9B455F3BAC7ACDE5546D141DC5916CBA2FFB02B288798470D9D992A9880CBE63A551AE1447B22721E96F7623F01811A92A07D6F47B6E51CC1A3466787E3C470861781A56F444B2083FEBC172B4F3DFA2736CDA76CDE81E787CF1B0F828810A9422624C207B00A0A45480B56A123C2FC1566403F7DE6A86423A06BA6ADFE408A42FD78452541877861E72A530416FA9A4144C57FD44D77A7801076454395617DBC3C995942EA590BE83A97BA7ABEB4E70622577CE437CBDF1742F9D7E75A7DD5F0ECAE750EA231BE6E031B27F7177F04DE912927858826705A8DAEEF6108EDBD7329075B31DEF9616873ADBA4633935E447DEEEC9337D6311A88D718DB3A5DF7345F5CE30114FDAEC39179B4A883D99E90D7665D73763F1F4F26CD2D7C0EC8F64557B16FCC2E8118E2FC1A8681CF5EB0DBD6AE3797B8BA6947840D7304D4463605EC2031465C736201654D1B90BB7CC07556F6ACCCC35695A9FF8D3B22174A820D59361335DDB9C4D0D8FF4BD7AB83514BD5E10312980F5B243A73340B7A67FE121588FDC43786A4528D50736BD96EE73DAB47C4AC4F35B8DAF02F2FEC3685CE69CA081D6E55419B8EEB1912DE1D11A687F126D7F8778FD6029E1A5D6A7AD88F5959D3E2CC68BF65FDE4DAE6AA44E283AF5BD34008CDA162263457277FCCC21D750A7E0AA9B1E2474E679100077565F37FA9DB638A24DAED10A4E124E8F7F17D984B899634CED9836EB29FA3F03135B2BBFBF6D5F4F64A8EEBAC254926164AECDDAF12A2DF8C39CE64575C5BF20188BECE9D6E6EBC69A367D868C1B3EA57D7F8A7413EA2371C94ECDBE985CDCDD5732521035C299F7CDE08675395C0E46B178E7648547A1BA901F351873C1367F2BE537415536E9813D829700FB21805E4B59C5AFD13E4D900A56EB070A88ADF94E117C7ED28C21B68F4CC015A80BDEBE78378253A9E2095E8F8BC43284586BF8E2F305BC7022461ECDC01615BB492F6B4C7A87BE5E5C02465B2E95B5AD6E5A5BEB9F"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\rundll32.exe
.
**************************************************************************
.
Completion time: 2011-02-11  00:55:23 - machine was rebooted
ComboFix-quarantined-files.txt  2011-02-10 23:55

Pre-Run: 1 503 350 784
Post-Run: 1 763 667 968

- - End Of File - - D37D963A7250F45C1AA384B5273091EB

Kód: Vybrat vše

ComboFix 11-02-12.02 - Nikusa 02/13/2011  17:49:01.1.2 - x86
Microsoft Windows 7 Professional   6.1.7600.0.1250.421.1033.18.3037.2163 [GMT 1:00]
Running from: c:\users\Nikusa\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\hl.exe
C:\readme.txt

.
(((((((((((((((((((((((((   Files Created from 2011-01-13 to 2011-02-13  )))))))))))))))))))))))))))))))
.

2011-02-13 16:53 . 2011-02-13 16:54	--------	d-----w-	c:\users\Nikusa\AppData\Local\temp
2011-02-13 16:53 . 2011-02-13 16:53	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-02-11 09:36 . 2011-01-13 09:41	5890896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F84D0B60-38BA-46CF-8B37-5BD5BB7ED24D}\mpengine.dll
2011-02-10 13:04 . 2011-02-10 13:04	--------	d-----w-	c:\users\Nikusa\AppData\Roaming\Malwarebytes
2011-02-10 13:04 . 2010-12-20 17:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-10 13:04 . 2011-02-10 13:04	--------	d-----w-	c:\programdata\Malwarebytes
2011-02-10 13:04 . 2011-02-10 13:04	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-02-10 13:04 . 2010-12-20 17:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-02-10 12:56 . 2011-02-10 12:56	--------	d-----w-	c:\program files\trend micro
2011-02-10 12:56 . 2011-02-10 12:56	--------	d-----w-	C:\rsit
2011-01-28 16:57 . 2010-12-14 13:43	31552	----a-w-	c:\windows\system32\TURegOpt.exe
2011-01-28 16:57 . 2010-12-14 13:39	21312	----a-w-	c:\windows\system32\authuitu.dll
2011-01-28 16:57 . 2010-12-14 13:39	29504	----a-w-	c:\windows\system32\uxtuneup.dll
2011-01-28 16:56 . 2011-01-28 16:57	--------	d-----w-	c:\program files\TuneUp Utilities 2011
2011-01-28 16:24 . 2011-01-28 16:24	--------	d-----w-	C:\Intel
2011-01-28 16:23 . 2009-10-10 02:57	12800	----a-w-	c:\windows\system32\drivers\sffp_sd.sys
2011-01-28 13:01 . 2011-01-28 13:01	--------	d-----w-	c:\windows\system32\Wat
2011-01-28 12:59 . 2009-11-25 11:47	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2011-01-28 12:59 . 2009-11-25 11:47	297808	----a-w-	c:\windows\system32\mscoree.dll
2011-01-28 12:59 . 2009-11-25 11:47	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2011-01-28 12:59 . 2009-11-25 11:47	49472	----a-w-	c:\windows\system32\netfxperf.dll
2011-01-28 12:59 . 2009-11-25 11:47	1130824	----a-w-	c:\windows\system32\dfshim.dll
2011-01-28 12:54 . 2010-02-11 07:10	293376	----a-w-	c:\windows\system32\browserchoice.exe
2011-01-28 12:53 . 2010-03-04 04:04	146304	----a-w-	c:\windows\system32\drivers\usbvideo.sys
2011-01-28 12:53 . 2010-03-04 03:57	190976	----a-w-	c:\windows\system32\drivers\ks.sys
2011-01-27 22:42 . 2010-08-04 06:18	641536	----a-w-	c:\windows\system32\CPFilters.dll
2011-01-27 22:42 . 2010-08-04 06:17	417792	----a-w-	c:\windows\system32\msdri.dll
2011-01-27 22:42 . 2010-08-04 06:15	204288	----a-w-	c:\windows\system32\MSNP.ax
2011-01-27 22:42 . 2010-08-04 06:15	199680	----a-w-	c:\windows\system32\mpg2splt.ax
2011-01-27 22:42 . 2009-12-13 09:30	465408	----a-w-	c:\windows\system32\psisdecd.dll
2011-01-27 22:42 . 2010-10-27 04:32	2048	----a-w-	c:\windows\system32\tzres.dll
2011-01-27 22:39 . 2009-12-11 07:44	133720	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2011-01-27 22:39 . 2009-12-11 07:38	1037312	----a-w-	c:\windows\system32\lsasrv.dll
2011-01-27 22:24 . 2010-10-12 04:25	516096	----a-w-	c:\program files\Windows Mail\wab.exe
2011-01-27 22:20 . 2010-07-29 06:30	197632	----a-w-	c:\windows\system32\ir32_32.dll
2011-01-27 22:20 . 2010-07-29 06:30	82944	----a-w-	c:\windows\system32\iccvid.dll
2011-01-27 22:20 . 2010-11-02 04:41	351232	----a-w-	c:\windows\system32\wmicmiplugin.dll
2011-01-27 22:20 . 2010-11-02 04:40	496128	----a-w-	c:\windows\system32\taskschd.dll
2011-01-27 22:20 . 2010-11-02 04:39	749056	----a-w-	c:\windows\system32\schedsvc.dll
2011-01-27 22:20 . 2010-11-02 04:34	192000	----a-w-	c:\windows\system32\taskeng.exe
2011-01-27 22:20 . 2010-11-02 04:40	305152	----a-w-	c:\windows\system32\taskcomp.dll
2011-01-27 22:20 . 2010-11-02 04:34	179712	----a-w-	c:\windows\system32\schtasks.exe
2011-01-27 22:20 . 2010-10-16 04:34	573440	----a-w-	c:\windows\system32\odbc32.dll
2011-01-27 22:20 . 2010-10-16 04:33	372736	----a-w-	c:\program files\Common Files\System\ado\msadox.dll
2011-01-27 22:20 . 2010-10-16 04:33	352256	----a-w-	c:\program files\Common Files\System\ado\msadomd.dll
2011-01-27 22:20 . 2010-10-16 04:33	987136	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2011-01-27 22:20 . 2010-10-16 04:33	208896	----a-w-	c:\program files\Common Files\System\msadc\msadco.dll
2011-01-27 22:18 . 2010-06-14 06:12	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-01-27 22:18 . 2010-01-18 23:29	85504	----a-w-	c:\windows\system32\secproc_ssp_isv.dll
2011-01-27 22:18 . 2010-01-18 23:29	85504	----a-w-	c:\windows\system32\secproc_ssp.dll
2011-01-27 22:18 . 2010-01-18 23:29	365568	----a-w-	c:\windows\system32\secproc_isv.dll
2011-01-27 22:18 . 2010-01-18 23:29	369152	----a-w-	c:\windows\system32\secproc.dll
2011-01-27 22:18 . 2010-01-18 23:28	324608	----a-w-	c:\windows\system32\RMActivate_isv.exe
2011-01-27 22:18 . 2010-01-18 23:28	277504	----a-w-	c:\windows\system32\RMActivate_ssp_isv.exe
2011-01-27 22:18 . 2010-01-18 23:28	320512	----a-w-	c:\windows\system32\RMActivate.exe
2011-01-27 22:18 . 2010-01-18 23:28	280064	----a-w-	c:\windows\system32\RMActivate_ssp.exe
2011-01-27 22:18 . 2010-10-16 04:41	101760	----a-w-	c:\windows\system32\consent.exe
2011-01-27 22:17 . 2010-08-31 04:32	954752	----a-w-	c:\windows\system32\mfc40.dll
2011-01-27 22:17 . 2010-08-31 04:32	954288	----a-w-	c:\windows\system32\mfc40u.dll
2011-01-27 22:17 . 2010-06-19 06:23	37376	----a-w-	c:\windows\system32\rtutils.dll
2011-01-27 22:17 . 2009-12-08 11:32	292864	----a-w-	c:\windows\system32\apphelp.dll
2011-01-27 22:17 . 2009-10-31 05:45	2614272	----a-w-	c:\windows\explorer.exe
2011-01-27 22:17 . 2009-10-28 06:17	285696	----a-w-	c:\windows\system32\winlogon.exe
2011-01-27 22:17 . 2010-06-29 05:02	1413632	----a-w-	c:\windows\system32\ole32.dll
2011-01-27 22:17 . 2010-06-29 04:57	4247040	----a-w-	c:\program files\Windows NT\Accessories\wordpad.exe
2011-01-27 22:15 . 2009-12-29 06:55	172032	----a-w-	c:\windows\system32\wintrust.dll
2011-01-27 22:15 . 2010-10-16 04:36	314368	----a-w-	c:\windows\system32\webio.dll
2011-01-27 22:14 . 2010-01-09 06:52	132608	----a-w-	c:\windows\system32\cabview.dll
2011-01-27 22:14 . 2010-05-05 06:46	363520	----a-w-	c:\windows\system32\StructuredQuery.dll
2011-01-27 22:14 . 2010-02-27 07:32	221696	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-01-27 22:14 . 2010-02-27 07:32	95744	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-01-27 22:14 . 2010-02-27 07:32	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-01-27 22:14 . 2010-10-19 08:10	7680	----a-w-	c:\program files\Internet Explorer\iecompat.dll
2011-01-23 13:56 . 2011-01-23 13:56	--------	d-----w-	c:\program files\uTorrent
2011-01-23 13:56 . 2011-02-10 13:31	--------	d-----w-	c:\users\Nikusa\AppData\Roaming\uTorrent

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-02 11:59 . 2010-05-02 10:31	2516	--sha-w-	c:\programdata\KGyGaAvL.sys
2010-12-24 09:39 . 2009-12-22 17:09	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-11-30 17:13 . 2009-12-22 17:09	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-30 281768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\Nikusa\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 wmcmgc;Windows Management Configuration;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\DRIVERS\s1039bus.sys [2010-03-01 98672]
R3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1039mdfl.sys [2010-03-01 14960]
R3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1039mdm.sys [2010-03-01 124016]
R3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1039mgmt.sys [2010-03-01 117872]
R3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1039nd5.sys [2010-03-01 25456]
R3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1039obex.sys [2010-03-01 113904]
R3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1039unic.sys [2010-03-01 123504]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-28 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2008-10-27 759072]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-30 135336]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-12-14 1517376]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-11-29 10064]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
wmcmgc
.
Contents of the 'Scheduled Tasks' folder

2011-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3877430911-2477763145-3477534986-1000Core.job
- c:\users\Nikusa\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-27 18:17]

2011-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3877430911-2477763145-3477534986-1000UA.job
- c:\users\Nikusa\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-27 18:17]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.searchcanvas.com/?ot=6
mStart Page = hxxp://www.searchcanvas.com/?ot=6
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)


.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.032"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.abr"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.ani"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.arw"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.bay"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.bmp"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.bw"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.cr2"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.crw"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.cs1"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.cur"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.dcr"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.dcx"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.dib"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.djv"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.djvu"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.dng"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.emf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.eps"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.erf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.fff"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.fpx"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.gif"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.hdr"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.icl"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.icn"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.iff"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.ilbm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.int"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.inta"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.iw4"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.j2c"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.j2k"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jbr"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jfif"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jif"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.jp2"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.jpc"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.jpe"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.jpeg"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jpg"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jpk"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.jpx"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.kdc"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.lbm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.mef"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.mos"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.mrw"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.nef"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.orf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pbm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pbr"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pcd"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pct"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pcx"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pef"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pgm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pic"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pict"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pix"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.png"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.ppm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.psd"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.psp"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.pspbrush"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.pspimage"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.raf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.ras"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.raw"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.rgb"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.rgba"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.rle"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.rsb"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.sgi"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.sr2"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.srf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.tga"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.thm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.tif"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.tiff"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.ttc"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.ttf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.v11o"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.v11p"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.v11pf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.wbm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.wbmp"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3877430911-2477763145-3477534986-1000)
"Progid"="ACDSee Photo Manager 2009.wmf"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.xbm"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.xif"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.xmp"

[HKEY_USERS\S-1-5-21-3877430911-2477763145-3477534986-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 2009.xpm"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-02-13  17:56:20
ComboFix-quarantined-files.txt  2011-02-13 16:56

Pre-Run: 6,414,802,944 bytes free
Post-Run: 6,452,793,344 bytes free

- - End Of File - - 80A43BEDE4542EA1B05F68962DFEE007

Kód: Vybrat vše

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5730

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/16/2011 11:29:57
mbam-log-2011-02-16 (11-29-57).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 268306
Time elapsed: 1 hour(s), 19 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)