VIRY.CZ

Zdravim mam problem s mozilou... nacitani stranek se nekdy sekne a musim restartovat mozilu jinak nenacte nekdy nacita strasne dlouho:( nejsem pod fupem dokladam test rychlosti vis obr. bude to asi v nastaveni prohlizece...
zde log z rsit:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Tomík at 2011-07-04 23:21:21
Microsoft Windows 7 Ultimate
System drive C: has 20 GB (37%) free of 54 GB
Total RAM: 8190 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:21:23, on 4.7.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Gigabyte\GHOST\Tilt.exe
C:\Fraps\fraps.exe
C:\Program Files (x86)\SpeedFan\speedfan.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Tomík.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
R3 - URLSearchHook: FroggyBoss Class - {539F76FD-084E-4858-86D5-62F02F54AE86} - C:\Program Files (x86)\Minibar\Froggy.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: MrFroggy - {856E12B5-22D7-4E22-9ACA-EA9A008DD65B} - C:\Program Files (x86)\Minibar\Froggy.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Minibar BHO - {AA74D58F-ACD0-450D-A85E-6C04B171C044} - C:\Program Files (x86)\Minibar\Kango.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Tilt] C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Fraps.lnk = C:\Fraps\fraps.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files (x86)\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Share Your Mood - {AAA38851-3CFF-475F-B5E0-720D3645E4A5} - C:\Program Files (x86)\Minibar\MinibarButton.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: Stavová služba ASP.NET (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JMB36X - Unknown owner - C:\Windows\SysWOW64\XSrvSetup.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8628 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe"
"C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE"
C:\Windows\SysWOW64\XSrvSetup.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
WLIDSvcM.exe 2024
atieclxx
"taskhost.exe"
taskeng.exe {5E0D3E87-6B67-4454-9623-73582EEB5A66}
"C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe" /TUStart /pid:1988
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\uTorrent\uTorrent.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files (x86)\Gigabyte\GHOST\Tilt.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Fraps\fraps.exe
"C:\Program Files (x86)\SpeedFan\speedfan.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe"
"C:\Fraps\fraps64.dat"
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url http://www.facebook.com/FaceSmooch
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=3752.99cb520.1938277395 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" 3752 plugin \\.\pipe\gecko-crash-server-pipe.3752
"C:\Windows\system32\mspaint.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe22_ Global\UsGthrCtrlFltPipeMssGthrPipe22 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 536 540 548 65536 544
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Tomík\Downloads\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B}]
MrFroggy Class - C:\Program Files (x86)\Minibar\Froggy.dll [2011-06-01 124416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}]
MinibarBHO - C:\Program Files (x86)\Minibar\Kango.dll [2011-05-26 338432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D5D47440-0750-463D-BAEF-A47D02414806}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-10-06 11474024]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-04-21 399736]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-06-15 15141768]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-15 375000]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-09-07 43608]
"NUSB3MON"=C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2009-11-20 106496]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-11-25 98304]
"Tilt"=C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe [2009-06-26 724992]

C:\Users\Tomík\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Fraps.lnk - C:\Fraps\fraps.exe
SpeedFan.lnk - C:\Program Files (x86)\SpeedFan\speedfan.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 290304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2011-06-03 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-07-04 23:21:21 ----D---- C:\rsit
2011-07-04 23:09:07 ----D---- C:\Program Files (x86)\Minibar
2011-07-04 23:09:06 ----D---- C:\Program Files (x86)\FaceSmooch Smileys
2011-07-03 21:41:21 ----D---- C:\Program Files (x86)\Free Disk Analyzer
2011-07-03 21:41:12 ----D---- C:\ProgramData\DiskAnalyzer
2011-07-02 17:39:01 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-07-02 17:38:36 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2011-07-02 14:54:40 ----D---- C:\Users\Tomík\AppData\Roaming\BlackBean
2011-07-02 11:00:01 ----SHD---- C:\$RECYCLE.BIN
2011-07-02 10:19:12 ----A---- C:\ComboFix.txt
2011-07-02 10:14:03 ----D---- C:\Windows\temp
2011-07-02 10:10:31 ----A---- C:\Windows\zip.exe
2011-07-02 10:10:31 ----A---- C:\Windows\SWSC.exe
2011-07-02 10:10:31 ----A---- C:\Windows\SWREG.exe
2011-07-02 10:10:31 ----A---- C:\Windows\sed.exe
2011-07-02 10:10:31 ----A---- C:\Windows\PEV.exe
2011-07-02 10:10:31 ----A---- C:\Windows\NIRCMD.exe
2011-07-02 10:10:31 ----A---- C:\Windows\MBR.exe
2011-07-02 10:10:31 ----A---- C:\Windows\grep.exe
2011-07-02 10:10:28 ----D---- C:\Windows\ERDNT
2011-07-01 22:40:34 ----D---- C:\Users\Tomík\AppData\Roaming\Malwarebytes
2011-07-01 22:40:29 ----D---- C:\ProgramData\Malwarebytes
2011-07-01 22:40:29 ----A---- C:\Windows\SYSWOW64\drivers\mbamswissarmy.sys
2011-07-01 22:40:26 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-07-01 22:40:26 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-07-01 11:45:09 ----D---- C:\Program Files\trend micro
2011-06-30 23:16:13 ----D---- C:\Fraps
2011-06-28 12:55:52 ----D---- C:\ProgramData\Electronic Arts
2011-06-28 12:55:52 ----D---- C:\ProgramData\EA Core
2011-06-26 01:16:23 ----D---- C:\Program Files\Yamicsoft
2011-06-26 00:50:51 ----RA---- C:\Windows\SYSWOW64\tmp6B17.tmp
2011-06-21 19:33:50 ----D---- C:\Users\Tomík\AppData\Roaming\AdobeUM
2011-06-21 19:31:22 ----D---- C:\ProgramData\McAfee
2011-06-14 20:50:07 ----A---- C:\Windows\SYSWOW64\CmdLineExt_x64.dll
2011-06-14 20:20:33 ----D---- C:\Users\Tomík\AppData\Roaming\gnupg

======List of files/folders modified in the last 1 months======

2011-07-04 23:21:23 ----D---- C:\Windows\Prefetch
2011-07-04 23:18:05 ----D---- C:\Users\Tomík\AppData\Roaming\uTorrent
2011-07-04 23:17:57 ----D---- C:\Users\Tomík\AppData\Roaming\Skype
2011-07-04 23:10:44 ----SHD---- C:\Windows\Installer
2011-07-04 23:10:43 ----RD---- C:\Program Files (x86)\Skype
2011-07-04 23:10:17 ----SHD---- C:\System Volume Information
2011-07-04 23:10:04 ----RD---- C:\Program Files (x86)
2011-07-04 23:09:47 ----D---- C:\Program Files (x86)\DAEMON Tools Toolbar
2011-07-04 22:39:05 ----D---- C:\Users\Tomík\AppData\Roaming\vlc
2011-07-04 21:19:20 ----D---- C:\Users\Tomík\AppData\Roaming\dvdcss
2011-07-04 16:37:40 ----D---- C:\Windows\system32\config
2011-07-04 14:22:54 ----D---- C:\Windows\System32
2011-07-04 14:22:54 ----D---- C:\Windows\inf
2011-07-04 14:22:54 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-04 14:18:01 ----D---- C:\Windows\system32\Tasks
2011-07-03 21:41:22 ----D---- C:\Windows\SysWOW64
2011-07-03 21:41:12 ----D---- C:\ProgramData
2011-07-03 11:33:22 ----D---- C:\Windows\system32\drivers
2011-07-03 10:15:48 ----D---- C:\Windows
2011-07-02 23:16:03 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2011-07-02 22:05:46 ----D---- C:\Program Files (x86)\Garena
2011-07-02 17:43:23 ----RSD---- C:\Windows\assembly
2011-07-02 17:39:04 ----D---- C:\Windows\system32\catroot
2011-07-02 17:39:03 ----D---- C:\Windows\system32\DriverStore
2011-07-02 17:27:29 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-07-02 14:53:20 ----D---- C:\Windows\winsxs
2011-07-02 10:15:24 ----A---- C:\Windows\system.ini
2011-07-02 10:15:12 ----D---- C:\Windows\system32\drivers\etc
2011-07-02 10:12:44 ----D---- C:\Windows\SYSWOW64\drivers
2011-07-02 10:12:44 ----D---- C:\Windows\AppPatch
2011-07-02 10:12:42 ----D---- C:\Program Files\Common Files
2011-07-02 10:12:42 ----D---- C:\Program Files (x86)\Common Files
2011-07-02 10:04:13 ----D---- C:\Program Files (x86)\Left 4 Dead 2
2011-07-01 11:45:09 ----RD---- C:\Program Files
2011-06-26 00:55:17 ----D---- C:\ProgramData\Codemasters
2011-06-26 00:50:54 ----D---- C:\Program Files (x86)\BRS
2011-06-26 00:50:52 ----A---- C:\Windows\system32\OpenAL32.dll
2011-06-26 00:50:51 ----A---- C:\Windows\SYSWOW64\OpenAL32.dll
2011-06-24 15:41:04 ----D---- C:\Windows\system32\catroot2
2011-06-23 15:59:53 ----D---- C:\Program Files (x86)\Adobe
2011-06-22 18:05:55 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-06-22 17:25:51 ----D---- C:\Windows\SYSWOW64\directx
2011-06-21 20:08:40 ----D---- C:\ProgramData\Adobe
2011-06-21 19:50:23 ----SD---- C:\Users\Tomík\AppData\Roaming\Microsoft
2011-06-21 19:50:23 ----D---- C:\Users\Tomík\AppData\Roaming\Adobe
2011-06-20 19:48:17 ----D---- C:\Windows\Minidump
2011-06-17 15:29:26 ----D---- C:\ProgramData\Skype
2011-06-17 15:29:05 ----D---- C:\ProgramData\Easybits GO
2011-06-17 15:29:04 ----D---- C:\Users\Tomík\AppData\Roaming\skypePM
2011-06-15 20:09:36 ----D---- C:\Windows\Logs
2011-06-15 14:37:40 ----D---- C:\ProgramData\Skype Extras
2011-06-13 19:19:16 ----D---- C:\Program Files (x86)\Gigabyte

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-09-07 121432]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2007-02-07 14104]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-04-21 834544]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-05-10 31064]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-05-10 600920]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-05-10 287576]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-05-10 53592]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-02 254528]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-05-10 22360]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-05-10 64344]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-11-26 8120320]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-11-26 289792]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-07-04 25640]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-10-06 2511464]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2009-11-20 75776]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2009-11-20 177152]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-05-25 253728]
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-09-03 349800]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-25 11856]
S3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-09-24 116752]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2011-05-18 25640]
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files (x86)\Garena\safedrv.sys []
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2011-05-20 30528]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2011-05-04 33344]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-11-26 203776]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-05-10 42184]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
R2 JMB36X;JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2009-11-30 75136]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2010-02-25 1398088]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 TuneUp.Defrag;@C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [2009-11-29 607048]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Log vypadá OK. Dělal jste 2.7. sken ComboFix. Rád bych viděl log (měl by být v C:\combofix.txt). problém máte pouze v mozille, nebo i v IE?

delalo mi to i v google chrom i v opere:( IE nepouzivam nemam ho rad:)

zde je ten log:

ComboFix 11-07-01.01 - Tomík 02.07.2011 10:11:29.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.8190.6623 [GMT 2:00]
Spuštěný z: c:\users\TomÝk\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-02 do 2011-07-02 )))))))))))))))))))))))))))))))
.
.
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\users\Tomík\AppData\Roaming\Malwarebytes
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\programdata\Malwarebytes
2011-07-01 20:40 . 2011-05-29 07:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-01 20:40 . 2011-05-29 07:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-01 09:45 . 2011-07-01 09:47 -------- d-----w- c:\program files\trend micro
2011-06-30 21:16 . 2011-07-02 08:15 -------- d-----w- C:\Fraps
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\Electronic Arts
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\EA Core
2011-06-25 23:16 . 2011-06-25 23:16 -------- d-----w- c:\program files\Yamicsoft
2011-06-25 22:50 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp6B17.tmp
2011-06-22 15:26 . 2011-06-22 15:26 -------- d-----w- c:\users\Tomík\AppData\Local\3DMGAME
2011-06-21 17:50 . 2011-06-21 17:50 -------- d-----w- c:\users\Tomík\AppData\Local\Adobe
2011-06-21 17:33 . 2011-06-21 17:33 -------- d-----w- c:\users\Tomík\AppData\Roaming\AdobeUM
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----w- c:\programdata\McAfee
2011-06-14 18:50 . 2011-06-14 18:50 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-06-14 18:20 . 2011-06-14 18:20 -------- d-----w- c:\users\Tomík\AppData\Roaming\gnupg
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2011-06-03 12:25 . 2011-06-03 12:25 8107 ----a-w- c:\windows\w7dsd.reg
2011-06-03 12:25 . 2011-06-03 12:25 8089 ----a-w- c:\windows\w7dse.reg
2011-06-03 12:25 . 2011-06-03 12:25 275360 ----a-w- c:\windows\system32\DreamScene.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-02 08:14 . 2011-04-21 13:36 25640 ----a-w- c:\windows\gdrv.sys
2011-06-28 22:19 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-28 22:19 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-06-28 21:09 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-25 22:50 . 2011-04-21 19:05 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-25 22:50 . 2011-04-21 13:19 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-22 12:18 . 2011-05-20 05:03 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-28 12:56 . 2011-05-28 12:56 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-05-20 05:03 . 2011-04-21 13:37 30528 ----a-w- c:\windows\GVTDrv64.sys
2011-05-18 09:31 . 2011-04-21 14:34 25640 ----a-w- c:\windows\etdrv.sys
2011-05-10 13:10 . 2009-11-30 12:18 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2009-11-30 12:18 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-10 13:04 . 2009-11-30 12:18 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 13:04 . 2009-11-30 12:18 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2009-11-30 12:18 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:59 . 2009-11-30 12:18 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2009-11-30 12:18 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 12:59 . 2009-11-30 12:19 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-10 12:10 . 2011-04-21 16:55 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-07 16:28 . 2011-05-07 16:28 3865704 ----a-w- c:\windows\system32\dffsetup_mss32.exe
2011-05-04 23:28 . 2011-05-04 23:28 59904 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-05-04 23:27 . 2011-05-04 23:27 51712 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-05-04 23:27 . 2011-05-04 23:27 12385280 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-05-04 17:18 . 2011-05-04 17:18 33344 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 19:05 . 2011-04-21 19:05 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-21 19:05 . 2011-04-21 13:19 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-04-21 15:39 . 2011-04-21 15:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-21 15:39 . 2011-04-21 15:39 126976 ----a-w- c:\windows\War3Unin.exe
2011-04-20 01:40 . 2011-04-20 01:40 1222656 ----a-w- c:\windows\system32\atiumd6v.dll
2011-04-20 01:40 . 2011-04-20 01:40 1923584 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-04-19 20:10 . 2011-04-19 20:10 61952 ----a-w- c:\windows\system32\OVDecode64.dll
2011-04-19 20:10 . 2011-04-19 20:10 53760 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-19 20:10 . 2011-04-19 20:10 16116224 ----a-w- c:\windows\system32\amdocl64.dll
2011-04-18 07:15 . 2011-04-21 13:26 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6468172E-1762-4CE5-AB0E-DE30C06F72A4}\mpengine.dll
2011-04-15 23:40 . 2011-05-25 16:30 809496 ----a-r- c:\windows\SysWow64\tmpB3F3.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmpB3F2.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp6B16.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp4384.tmp
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\SysWow64\xlivefnt.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-04-21 399736]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Tilt"="c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe" [2009-06-26 724992]
.
c:\users\Tomˇk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fraps.lnk - c:\fraps\fraps.exe [2011-5-28 2363568]
SpeedFan.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2009-8-9 3986552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2011-05-18 25640]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena Messenger\Room\safedrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-20 30528]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2010-02-25 1398088]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-25 11856]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-06 11474024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://eu.ask.com/?l=dis&o=14672
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Tomík\AppData\Roaming\Mozilla\Firefox\Profiles\0y10mge4.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU2&o=14670&locale=en_EU&apn_uid=e047d7f2-8165-41af-b20a-6e3434b08607&apn_ptnrs=T8&apn_sauid=FDE4B606-3A62-4FAB-A878-8219D4B9D791&apn_dtid=YYYYYYYYCZ&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2b,cb,42,fd,10,0a,8d,58,87,96,61,dc,a8,46,5a,a7,e3,64,d1,69,75,1a,67,
7c,ba,74,02,65,8b,86,0d,c0,b1,a1,7b,ff,7f,53,0b,a0,a2,fc,90,56,81,37,42,d2,\
"??"=hex:8f,6d,54,cf,bc,07,61,54,63,b0,c9,31,d2,8e,ec,cf
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,ce,e6,2f,f7,a0,bb,59,6d,7a,3e,59,5c,5f,ce,1c,1c,24,ed,35,79,
db,8a,63,55,2d,67,eb,88,65,19,ad,90,72,d6,f3,f3,3c,80,51,61,01,69,d8,49,3a,\
"rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2011-07-02 10:19:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-02 08:19
.
Před spuštěním: Volných bajtů: 20 713 984 000
Po spuštění: Volných bajtů: 20 586 778 624
.
- - End Of File - - 131746E936CA63874D3C20FF4132BC70

Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\SysWow64\tmp6B17.tmp

Uložte na ploochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkaz ze skriptu.

mam uz sledovat zmeny co jsme to vlastne udelali?:)
zde je log:


ComboFix 11-07-05.03 - Tomík 06.07.2011 1:18.2.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.8190.6503 [GMT 2:00]
Spuštěný z: c:\users\Tomík\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Tomík\Desktop\CFScript.txt.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\TOMK~1\AppData\Local\Temp\sfamcc00001.dll
c:\users\TOMK~1\AppData\Local\Temp\sfareca00001.dll
c:\users\Tomík\AppData\Local\Temp\sfamcc00001.dll
c:\users\Tomík\AppData\Local\Temp\sfareca00001.dll
c:\windows\SysWow64\tmp6B17.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-05 do 2011-07-05 )))))))))))))))))))))))))))))))
.
.
2011-07-05 23:21 . 2011-07-05 23:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-04 21:21 . 2011-07-04 21:21 -------- d-----w- C:\rsit
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\users\Tomík\AppData\Local\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\FaceSmooch Smileys
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\users\Tomík\AppData\Local\DiskAnalyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\program files (x86)\Free Disk Analyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\programdata\DiskAnalyzer
2011-07-02 15:39 . 2011-07-02 15:39 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-02 15:38 . 2011-07-02 15:39 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-02 13:29 . 2011-07-02 13:29 -------- d-----w- c:\users\Tomík\AppData\Local\ALI213
2011-07-02 12:54 . 2011-07-05 18:12 -------- d-----w- c:\users\Tomík\AppData\Roaming\BlackBean
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\users\Tomík\AppData\Roaming\Malwarebytes
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\programdata\Malwarebytes
2011-07-01 20:40 . 2011-05-29 07:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-01 20:40 . 2011-05-29 07:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-01 09:45 . 2011-07-04 21:21 -------- d-----w- c:\program files\trend micro
2011-06-30 21:16 . 2011-07-05 23:22 -------- d-----w- C:\Fraps
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\Electronic Arts
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\EA Core
2011-06-25 23:16 . 2011-06-25 23:16 -------- d-----w- c:\program files\Yamicsoft
2011-06-22 15:26 . 2011-06-22 15:26 -------- d-----w- c:\users\Tomík\AppData\Local\3DMGAME
2011-06-21 17:50 . 2011-06-21 17:50 -------- d-----w- c:\users\Tomík\AppData\Local\Adobe
2011-06-21 17:33 . 2011-06-21 17:33 -------- d-----w- c:\users\Tomík\AppData\Roaming\AdobeUM
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----w- c:\programdata\McAfee
2011-06-14 18:50 . 2011-06-14 18:50 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-06-14 18:20 . 2011-06-14 18:20 -------- d-----w- c:\users\Tomík\AppData\Roaming\gnupg
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-05 23:22 . 2011-04-21 13:36 25640 ----a-w- c:\windows\gdrv.sys
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-07-02 20:01 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-25 22:50 . 2011-04-21 19:05 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-25 22:50 . 2011-04-21 13:19 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-22 12:18 . 2011-05-20 05:03 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-03 12:25 . 2011-06-03 12:25 8107 ----a-w- c:\windows\w7dsd.reg
2011-06-03 12:25 . 2011-06-03 12:25 8089 ----a-w- c:\windows\w7dse.reg
2011-06-03 12:25 . 2011-06-03 12:25 275360 ----a-w- c:\windows\system32\DreamScene.dll
2011-05-28 12:56 . 2011-05-28 12:56 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-05-20 05:03 . 2011-04-21 13:37 30528 ----a-w- c:\windows\GVTDrv64.sys
2011-05-18 09:31 . 2011-04-21 14:34 25640 ----a-w- c:\windows\etdrv.sys
2011-05-10 13:10 . 2009-11-30 12:18 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2009-11-30 12:18 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-10 13:04 . 2009-11-30 12:18 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 13:04 . 2009-11-30 12:18 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2009-11-30 12:18 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:59 . 2009-11-30 12:18 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2009-11-30 12:18 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 12:59 . 2009-11-30 12:19 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-10 12:10 . 2011-04-21 16:55 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-07 16:28 . 2011-05-07 16:28 3865704 ----a-w- c:\windows\system32\dffsetup_mss32.exe
2011-05-04 23:28 . 2011-05-04 23:28 59904 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-05-04 23:27 . 2011-05-04 23:27 51712 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-05-04 23:27 . 2011-05-04 23:27 12385280 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-05-04 17:18 . 2011-05-04 17:18 33344 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 19:05 . 2011-04-21 19:05 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-21 19:05 . 2011-04-21 13:19 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-04-21 15:39 . 2011-04-21 15:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-21 15:39 . 2011-04-21 15:39 126976 ----a-w- c:\windows\War3Unin.exe
2011-04-20 01:40 . 2011-04-20 01:40 1222656 ----a-w- c:\windows\system32\atiumd6v.dll
2011-04-20 01:40 . 2011-04-20 01:40 1923584 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-04-19 20:10 . 2011-04-19 20:10 61952 ----a-w- c:\windows\system32\OVDecode64.dll
2011-04-19 20:10 . 2011-04-19 20:10 53760 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-19 20:10 . 2011-04-19 20:10 16116224 ----a-w- c:\windows\system32\amdocl64.dll
2011-04-18 07:15 . 2011-04-21 13:26 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6468172E-1762-4CE5-AB0E-DE30C06F72A4}\mpengine.dll
2011-04-15 23:40 . 2011-05-25 16:30 809496 ----a-r- c:\windows\SysWow64\tmpB3F3.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmpB3F2.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp6B16.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp4384.tmp
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\SysWow64\xlivefnt.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{539F76FD-084E-4858-86D5-62F02F54AE86}"= "c:\program files (x86)\Minibar\Froggy.dll" [2011-06-01 124416]
.
[HKEY_CLASSES_ROOT\clsid\{539f76fd-084e-4858-86d5-62f02f54ae86}]
[HKEY_CLASSES_ROOT\TypeLib\{4F9AD2F2-3A64-470E-93F7-A03423E52ACA}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B}]
2011-06-01 14:58 124416 ----a-w- c:\program files (x86)\Minibar\Froggy.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}]
2011-05-26 07:40 338432 ----a-w- c:\program files (x86)\Minibar\Kango.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-04-21 399736]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Tilt"="c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe" [2009-06-26 724992]
.
c:\users\Tomˇk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fraps.lnk - c:\fraps\fraps.exe [2011-5-28 2363568]
SpeedFan.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2009-8-9 3986552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2011-05-18 25640]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-20 30528]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2010-02-25 1398088]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-25 11856]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-06 11474024]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{AAA38851-3CFF-475F-B5E0-720D3645E4A5} - {AAA38851-3CFF-475F-B5E0-720D3645E4A5} - c:\program files (x86)\Minibar\MinibarButton.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Tomík\AppData\Roaming\Mozilla\Firefox\Profiles\0y10mge4.default\
FF - prefs.js: browser.startup.homepage - hxxp://abuchak.net/
FF - prefs.js: keyword.URL - hxxp://abuchak.net/?ref=ff.1.1.93&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Fasterfox: {c36177c0-224a-11da-8cd6-0800200c9a91} - %profile%\extensions\{c36177c0-224a-11da-8cd6-0800200c9a91}
FF - Ext: KwiClick: vinceturk@gmail.com - %profile%\extensions\vinceturk@gmail.com
FF - Ext: ConnectBar: {c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9} - %profile%\extensions\{c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9}
FF - Ext: FoxLingo: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} - %profile%\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF - Ext: FaceSmooch: {97A78363-B868-4B48-AC91-A783A31215AF} - %profile%\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2b,cb,42,fd,10,0a,8d,58,87,96,61,dc,a8,46,5a,a7,e3,64,d1,69,75,1a,67,
7c,ba,74,02,65,8b,86,0d,c0,b1,a1,7b,ff,7f,53,0b,a0,a2,fc,90,56,81,37,42,d2,\
"??"=hex:8f,6d,54,cf,bc,07,61,54,63,b0,c9,31,d2,8e,ec,cf
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,ce,e6,2f,f7,a0,bb,59,6d,7a,3e,59,5c,5f,ce,1c,1c,24,ed,35,79,
db,8a,63,55,2d,67,eb,88,65,19,ad,90,72,d6,f3,f3,3c,80,51,61,01,69,d8,49,3a,\
"rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2011-07-06 01:26:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-05 23:26
ComboFix2.txt 2011-07-02 08:19
.
Před spuštěním: Volných bajtů: 20 469 878 784
Po spuštění: Volných bajtů: 20 030 013 440
.
- - End Of File - - 0D2625BA249E61855295B6E6C0040A53
Nahr nˇ probŘhlo ŁspŘçnŘ

tak zmenu uz jsem zaregistroval je to mnohem lepsi:)

Z nějakého programu se vám ukládají *.tmp soubory, které to patrně způsobují. Zkuste spustit CF ještě jednou tímto skriptem:

Collect::
c:\windows\SysWow64\tmpB3F3.tmp
c:\windows\SysWow64\tmpB3F2.tmp
c:\windows\SysWow64\tmp6B16.tmp
c:\windows\SysWow64\tmp4384.tmp

Nevím, odkud se berou, ale určitě vám nebudou chybět.

ComboFix 11-07-06.01 - Tomík 06.07.2011 11:58:35.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.8190.6622 [GMT 2:00]
Spuštěný z: c:\combofix\ComboFix.exe
Použité ovládací přepínače :: c:\users\TomÝk\Desktop\CFScript.txt.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\TOMK~1\AppData\Local\Temp\sfamcc00001.dll
c:\users\TOMK~1\AppData\Local\Temp\sfareca00001.dll
c:\users\Tomík\AppData\Local\Temp\sfamcc00001.dll
c:\users\Tomík\AppData\Local\Temp\sfareca00001.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-06 do 2011-07-06 )))))))))))))))))))))))))))))))
.
.
2011-07-06 10:01 . 2011-07-06 10:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\users\Tomík\AppData\Local\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\FaceSmooch Smileys
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\users\Tomík\AppData\Local\DiskAnalyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\program files (x86)\Free Disk Analyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\programdata\DiskAnalyzer
2011-07-02 15:39 . 2011-07-02 15:39 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-02 15:38 . 2011-07-02 15:39 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-02 13:29 . 2011-07-02 13:29 -------- d-----w- c:\users\Tomík\AppData\Local\ALI213
2011-07-02 12:54 . 2011-07-05 18:12 -------- d-----w- c:\users\Tomík\AppData\Roaming\BlackBean
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\users\Tomík\AppData\Roaming\Malwarebytes
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\programdata\Malwarebytes
2011-07-01 20:40 . 2011-05-29 07:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-01 20:40 . 2011-05-29 07:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-01 09:45 . 2011-07-04 21:21 -------- d-----w- c:\program files\trend micro
2011-06-30 21:16 . 2011-07-06 10:02 -------- d-----w- C:\Fraps
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\Electronic Arts
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\EA Core
2011-06-25 23:16 . 2011-06-25 23:16 -------- d-----w- c:\program files\Yamicsoft
2011-06-22 15:26 . 2011-06-22 15:26 -------- d-----w- c:\users\Tomík\AppData\Local\3DMGAME
2011-06-21 17:50 . 2011-06-21 17:50 -------- d-----w- c:\users\Tomík\AppData\Local\Adobe
2011-06-21 17:33 . 2011-06-21 17:33 -------- d-----w- c:\users\Tomík\AppData\Roaming\AdobeUM
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----w- c:\programdata\McAfee
2011-06-14 18:50 . 2011-06-14 18:50 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-06-14 18:20 . 2011-06-14 18:20 -------- d-----w- c:\users\Tomík\AppData\Roaming\gnupg
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 10:02 . 2011-04-21 13:36 25640 ----a-w- c:\windows\gdrv.sys
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-07-02 20:01 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-25 22:50 . 2011-04-21 19:05 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-25 22:50 . 2011-04-21 13:19 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-22 12:18 . 2011-05-20 05:03 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-03 12:25 . 2011-06-03 12:25 8107 ----a-w- c:\windows\w7dsd.reg
2011-06-03 12:25 . 2011-06-03 12:25 8089 ----a-w- c:\windows\w7dse.reg
2011-06-03 12:25 . 2011-06-03 12:25 275360 ----a-w- c:\windows\system32\DreamScene.dll
2011-05-28 12:56 . 2011-05-28 12:56 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-05-20 05:03 . 2011-04-21 13:37 30528 ----a-w- c:\windows\GVTDrv64.sys
2011-05-18 09:31 . 2011-04-21 14:34 25640 ----a-w- c:\windows\etdrv.sys
2011-05-10 13:10 . 2009-11-30 12:18 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2009-11-30 12:18 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-10 13:04 . 2009-11-30 12:18 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 13:04 . 2009-11-30 12:18 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2009-11-30 12:18 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:59 . 2009-11-30 12:18 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2009-11-30 12:18 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 12:59 . 2009-11-30 12:19 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-10 12:10 . 2011-04-21 16:55 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-07 16:28 . 2011-05-07 16:28 3865704 ----a-w- c:\windows\system32\dffsetup_mss32.exe
2011-05-04 23:28 . 2011-05-04 23:28 59904 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-05-04 23:27 . 2011-05-04 23:27 51712 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-05-04 23:27 . 2011-05-04 23:27 12385280 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-05-04 17:18 . 2011-05-04 17:18 33344 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 19:05 . 2011-04-21 19:05 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-21 19:05 . 2011-04-21 13:19 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-04-21 15:39 . 2011-04-21 15:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-21 15:39 . 2011-04-21 15:39 126976 ----a-w- c:\windows\War3Unin.exe
2011-04-20 01:40 . 2011-04-20 01:40 1222656 ----a-w- c:\windows\system32\atiumd6v.dll
2011-04-20 01:40 . 2011-04-20 01:40 1923584 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-04-19 20:10 . 2011-04-19 20:10 61952 ----a-w- c:\windows\system32\OVDecode64.dll
2011-04-19 20:10 . 2011-04-19 20:10 53760 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-19 20:10 . 2011-04-19 20:10 16116224 ----a-w- c:\windows\system32\amdocl64.dll
2011-04-18 07:15 . 2011-04-21 13:26 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6468172E-1762-4CE5-AB0E-DE30C06F72A4}\mpengine.dll
2011-04-15 23:40 . 2011-05-25 16:30 809496 ----a-r- c:\windows\SysWow64\tmpB3F3.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmpB3F2.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp6B16.tmp
2011-04-15 23:40 . 2011-04-15 23:40 809496 ----a-r- c:\windows\SysWow64\tmp4384.tmp
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\SysWow64\xlivefnt.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-05_23.22.44 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-07-05 23:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-07-06 10:02 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-05 23:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-06 10:02 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-06 10:02 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-05 23:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-21 12:53 . 2011-07-06 07:56 34012 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-07-06 07:56 30394 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-21 12:43 . 2011-07-06 07:56 11014 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3519509175-1736981896-2490464381-1000_UserData.bin
+ 2011-04-21 13:10 . 2011-07-06 10:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-21 13:10 . 2011-07-05 23:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-21 13:10 . 2011-07-06 10:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-21 13:10 . 2011-07-05 23:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-07-05 23:22 . 2011-07-05 23:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-06 10:01 . 2011-07-06 10:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-06 10:01 . 2011-07-06 10:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-07-05 23:22 . 2011-07-05 23:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-07-05 23:13 660218 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-07-06 07:59 660218 c:\windows\system32\perfh009.dat
- 2009-07-26 18:41 . 2011-07-05 23:13 674400 c:\windows\system32\perfh005.dat
+ 2009-07-26 18:41 . 2011-07-06 07:59 674400 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-07-06 07:59 124408 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-07-05 23:13 124408 c:\windows\system32\perfc009.dat
- 2009-07-26 18:41 . 2011-07-05 23:13 144354 c:\windows\system32\perfc005.dat
+ 2009-07-26 18:41 . 2011-07-06 07:59 144354 c:\windows\system32\perfc005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{539F76FD-084E-4858-86D5-62F02F54AE86}"= "c:\program files (x86)\Minibar\Froggy.dll" [2011-06-01 124416]
.
[HKEY_CLASSES_ROOT\clsid\{539f76fd-084e-4858-86d5-62f02f54ae86}]
[HKEY_CLASSES_ROOT\TypeLib\{4F9AD2F2-3A64-470E-93F7-A03423E52ACA}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B}]
2011-06-01 14:58 124416 ----a-w- c:\program files (x86)\Minibar\Froggy.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}]
2011-05-26 07:40 338432 ----a-w- c:\program files (x86)\Minibar\Kango.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-04-21 399736]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Tilt"="c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe" [2009-06-26 724992]
.
c:\users\Tomˇk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fraps.lnk - c:\fraps\fraps.exe [2011-5-28 2363568]
SpeedFan.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2009-8-9 3986552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2011-05-18 25640]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-20 30528]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2010-02-25 1398088]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-25 11856]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-06 11474024]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{AAA38851-3CFF-475F-B5E0-720D3645E4A5} - {AAA38851-3CFF-475F-B5E0-720D3645E4A5} - c:\program files (x86)\Minibar\MinibarButton.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Tomík\AppData\Roaming\Mozilla\Firefox\Profiles\0y10mge4.default\
FF - prefs.js: browser.startup.homepage - hxxp://abuchak.net/
FF - prefs.js: keyword.URL - hxxp://abuchak.net/?ref=ff.1.1.93&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Fasterfox: {c36177c0-224a-11da-8cd6-0800200c9a91} - %profile%\extensions\{c36177c0-224a-11da-8cd6-0800200c9a91}
FF - Ext: KwiClick: vinceturk@gmail.com - %profile%\extensions\vinceturk@gmail.com
FF - Ext: ConnectBar: {c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9} - %profile%\extensions\{c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9}
FF - Ext: FoxLingo: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} - %profile%\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF - Ext: FaceSmooch: {97A78363-B868-4B48-AC91-A783A31215AF} - %profile%\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2b,cb,42,fd,10,0a,8d,58,87,96,61,dc,a8,46,5a,a7,e3,64,d1,69,75,1a,67,
7c,ba,74,02,65,8b,86,0d,c0,b1,a1,7b,ff,7f,53,0b,a0,a2,fc,90,56,81,37,42,d2,\
"??"=hex:8f,6d,54,cf,bc,07,61,54,63,b0,c9,31,d2,8e,ec,cf
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,ce,e6,2f,f7,a0,bb,59,6d,7a,3e,59,5c,5f,ce,1c,1c,24,ed,35,79,
db,8a,63,55,2d,67,eb,88,65,19,ad,90,72,d6,f3,f3,3c,80,51,61,01,69,d8,49,3a,\
"rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2011-07-06 12:06:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-06 10:06
ComboFix2.txt 2011-07-05 23:27
ComboFix3.txt 2011-07-02 08:19
.
Před spuštěním: Volných bajtů: 20 278 321 152
Po spuštění: Volných bajtů: 20 122 705 920
.
- - End Of File - - 635C9637F5BFDD00BCD9084E51C26140

Skript byl chybně uložen (CFScript.txt.txt). Musí být uložen jako CFScript.txt . Změňte, uložte a zkuste nový sken.

pockata le ja to mel ulozeno tak jak rikate(vis obr.)...jak to teda ma byt_?

Máte zdvojenou příponu txt. Jedou txt odmažte a bude to OK.

ComboFix 11-07-06.04 - Tomík 07.07.2011 3:48.4.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.8190.6752 [GMT 2:00]
Spuštěný z: c:\users\Tomík\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Tomík\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\tmp4384.tmp
c:\windows\SysWow64\tmp6B16.tmp
c:\windows\SysWow64\tmpB3F2.tmp
c:\windows\SysWow64\tmpB3F3.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-07 do 2011-07-07 )))))))))))))))))))))))))))))))
.
.
2011-07-07 01:51 . 2011-07-07 01:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\users\Tomík\AppData\Local\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\Minibar
2011-07-04 21:09 . 2011-07-04 21:09 -------- d-----w- c:\program files (x86)\FaceSmooch Smileys
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\users\Tomík\AppData\Local\DiskAnalyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\program files (x86)\Free Disk Analyzer
2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\programdata\DiskAnalyzer
2011-07-02 15:39 . 2011-07-02 15:39 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-02 15:38 . 2011-07-02 15:39 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2011-07-02 13:29 . 2011-07-02 13:29 -------- d-----w- c:\users\Tomík\AppData\Local\ALI213
2011-07-02 12:54 . 2011-07-05 18:12 -------- d-----w- c:\users\Tomík\AppData\Roaming\BlackBean
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\users\Tomík\AppData\Roaming\Malwarebytes
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\programdata\Malwarebytes
2011-07-01 20:40 . 2011-05-29 07:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-01 20:40 . 2011-07-01 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-01 20:40 . 2011-05-29 07:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-01 09:45 . 2011-07-04 21:21 -------- d-----w- c:\program files\trend micro
2011-06-30 21:16 . 2011-07-07 01:52 -------- d-----w- C:\Fraps
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\Electronic Arts
2011-06-28 10:55 . 2011-06-28 10:55 -------- d-----w- c:\programdata\EA Core
2011-06-25 23:16 . 2011-06-25 23:16 -------- d-----w- c:\program files\Yamicsoft
2011-06-22 15:26 . 2011-06-22 15:26 -------- d-----w- c:\users\Tomík\AppData\Local\3DMGAME
2011-06-21 17:50 . 2011-06-21 17:50 -------- d-----w- c:\users\Tomík\AppData\Local\Adobe
2011-06-21 17:33 . 2011-06-21 17:33 -------- d-----w- c:\users\Tomík\AppData\Roaming\AdobeUM
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----w- c:\programdata\McAfee
2011-06-14 18:50 . 2011-06-14 18:50 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-06-14 18:20 . 2011-06-14 18:20 -------- d-----w- c:\users\Tomík\AppData\Roaming\gnupg
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-07 01:51 . 2011-04-21 13:36 25640 ----a-w- c:\windows\gdrv.sys
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-07-02 21:16 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-07-02 20:01 . 2011-04-22 17:12 234536 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-25 22:50 . 2011-04-21 19:05 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-25 22:50 . 2011-04-21 13:19 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-06-22 12:18 . 2011-05-20 05:03 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-03 12:25 . 2011-06-03 12:25 8107 ----a-w- c:\windows\w7dsd.reg
2011-06-03 12:25 . 2011-06-03 12:25 8089 ----a-w- c:\windows\w7dse.reg
2011-06-03 12:25 . 2011-06-03 12:25 275360 ----a-w- c:\windows\system32\DreamScene.dll
2011-05-28 12:56 . 2011-05-28 12:56 71680 ----a-w- c:\windows\system32\frapsv64.dll
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-05-20 05:03 . 2011-04-21 13:37 30528 ----a-w- c:\windows\GVTDrv64.sys
2011-05-18 09:31 . 2011-04-21 14:34 25640 ----a-w- c:\windows\etdrv.sys
2011-05-10 13:10 . 2009-11-30 12:18 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2009-11-30 12:18 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-10 13:04 . 2009-11-30 12:18 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 13:04 . 2009-11-30 12:18 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2009-11-30 12:18 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:59 . 2009-11-30 12:18 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2009-11-30 12:18 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 12:59 . 2009-11-30 12:19 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-10 12:10 . 2011-04-21 16:55 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-07 16:28 . 2011-05-07 16:28 3865704 ----a-w- c:\windows\system32\dffsetup_mss32.exe
2011-05-04 23:28 . 2011-05-04 23:28 59904 ----a-w- c:\windows\SysWow64\OVDecode.dll
2011-05-04 23:27 . 2011-05-04 23:27 51712 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-05-04 23:27 . 2011-05-04 23:27 12385280 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-05-04 17:18 . 2011-05-04 17:18 33344 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 20:18 . 2011-04-21 20:18 14744 ----a-w- c:\users\Tomík\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll
2011-04-21 19:05 . 2011-04-21 19:05 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-21 19:05 . 2011-04-21 13:19 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-04-21 15:39 . 2011-04-21 15:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-21 15:39 . 2011-04-21 15:39 126976 ----a-w- c:\windows\War3Unin.exe
2011-04-20 01:40 . 2011-04-20 01:40 1222656 ----a-w- c:\windows\system32\atiumd6v.dll
2011-04-20 01:40 . 2011-04-20 01:40 1923584 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-04-19 20:10 . 2011-04-19 20:10 61952 ----a-w- c:\windows\system32\OVDecode64.dll
2011-04-19 20:10 . 2011-04-19 20:10 53760 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-19 20:10 . 2011-04-19 20:10 16116224 ----a-w- c:\windows\system32\amdocl64.dll
2011-04-18 07:15 . 2011-04-21 13:26 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6468172E-1762-4CE5-AB0E-DE30C06F72A4}\mpengine.dll
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\SysWow64\xlivefnt.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-05_23.22.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-07-07 01:51 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-05 23:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-05 23:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-07 01:51 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-05 23:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-07 01:51 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-21 12:53 . 2011-07-07 01:44 34196 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-07-07 01:44 30538 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-21 12:43 . 2011-07-07 01:44 11030 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3519509175-1736981896-2490464381-1000_UserData.bin
- 2011-04-21 13:10 . 2011-07-05 23:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-21 13:10 . 2011-07-07 01:52 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-21 13:10 . 2011-07-05 23:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-21 13:10 . 2011-07-07 01:52 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-07-05 23:22 . 2011-07-05 23:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-07 01:51 . 2011-07-07 01:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-07-07 01:51 . 2011-07-07 01:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-07-05 23:22 . 2011-07-05 23:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-07-07 01:47 660218 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-07-05 23:13 660218 c:\windows\system32\perfh009.dat
+ 2009-07-26 18:41 . 2011-07-07 01:47 674400 c:\windows\system32\perfh005.dat
- 2009-07-26 18:41 . 2011-07-05 23:13 674400 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-07-05 23:13 124408 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-07-07 01:47 124408 c:\windows\system32\perfc009.dat
- 2009-07-26 18:41 . 2011-07-05 23:13 144354 c:\windows\system32\perfc005.dat
+ 2009-07-26 18:41 . 2011-07-07 01:47 144354 c:\windows\system32\perfc005.dat
- 2009-07-14 02:34 . 2011-07-05 18:11 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-07-06 14:54 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{539F76FD-084E-4858-86D5-62F02F54AE86}"= "c:\program files (x86)\Minibar\Froggy.dll" [2011-06-01 124416]
.
[HKEY_CLASSES_ROOT\clsid\{539f76fd-084e-4858-86d5-62f02f54ae86}]
[HKEY_CLASSES_ROOT\TypeLib\{4F9AD2F2-3A64-470E-93F7-A03423E52ACA}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B}]
2011-06-01 14:58 124416 ----a-w- c:\program files (x86)\Minibar\Froggy.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}]
2011-05-26 07:40 338432 ----a-w- c:\program files (x86)\Minibar\Kango.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-04-21 399736]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Tilt"="c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe" [2009-06-26 724992]
.
c:\users\Tomˇk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fraps.lnk - c:\fraps\fraps.exe [2011-5-28 2363568]
SpeedFan.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2009-8-9 3986552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2011-05-18 25640]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-20 30528]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2010-02-25 1398088]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-25 11856]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 134384 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-06 11474024]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{AAA38851-3CFF-475F-B5E0-720D3645E4A5} - {AAA38851-3CFF-475F-B5E0-720D3645E4A5} - c:\program files (x86)\Minibar\MinibarButton.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Tomík\AppData\Roaming\Mozilla\Firefox\Profiles\0y10mge4.default\
FF - prefs.js: browser.startup.homepage - hxxp://abuchak.net/
FF - prefs.js: keyword.URL - hxxp://abuchak.net/?ref=ff.1.1.93&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Fasterfox: {c36177c0-224a-11da-8cd6-0800200c9a91} - %profile%\extensions\{c36177c0-224a-11da-8cd6-0800200c9a91}
FF - Ext: KwiClick: vinceturk@gmail.com - %profile%\extensions\vinceturk@gmail.com
FF - Ext: ConnectBar: {c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9} - %profile%\extensions\{c7661bd8-ec96-cf1f-abb1-1f239fbdbbb9}
FF - Ext: FoxLingo: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} - %profile%\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF - Ext: FaceSmooch: {97A78363-B868-4B48-AC91-A783A31215AF} - %profile%\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2b,cb,42,fd,10,0a,8d,58,87,96,61,dc,a8,46,5a,a7,e3,64,d1,69,75,1a,67,
7c,ba,74,02,65,8b,86,0d,c0,b1,a1,7b,ff,7f,53,0b,a0,a2,fc,90,56,81,37,42,d2,\
"??"=hex:8f,6d,54,cf,bc,07,61,54,63,b0,c9,31,d2,8e,ec,cf
.
[HKEY_USERS\S-1-5-21-3519509175-1736981896-2490464381-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,ce,e6,2f,f7,a0,bb,59,6d,7a,3e,59,5c,5f,ce,1c,1c,24,ed,35,79,
db,8a,63,55,2d,67,eb,88,65,19,ad,90,72,d6,f3,f3,3c,80,51,61,01,69,d8,49,3a,\
"rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2011-07-07 03:56:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-07 01:56
ComboFix2.txt 2011-07-06 10:06
ComboFix3.txt 2011-07-05 23:27
ComboFix4.txt 2011-07-02 08:19
.
Před spuštěním: Volných bajtů: 21 235 089 408
Po spuštění: Volných bajtů: 21 139 505 152
.
- - End Of File - - 21D6472235EBA7209E383B95E30674E2
Nahr nˇ probŘhlo ŁspŘçnŘ

Už je všechno pryč. Nastala nějaká změna?

ano je to lepsi:) dekuji a budou se nadale ty soubory co mi to zpomaluji ukladat nebo jsme to zrusili?

To vám, bohužel neřeknu, nevím, co je ukládá. uvidíte sám, když so otevřete příslušný adresář. Pokud ty soubory nejsou viry, určitě jsou zbytečné. Nemáte zač!