VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Jindra-Dell-modry at 2012-01-19 00:26:34
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 535 GB (88%) free of 610 GB
Total RAM: 4092 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:26:37, on 19.1.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files\trend micro\Jindra-Dell-modry.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss ... 55f94d5a5b
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: KMPlayer Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: DW WLAN Tray Service (wltrysvc) - Dell Inc. - C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7243 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\system32\WLANExt.exe 26299824
\??\C:\Windows\system32\conhost.exe "-1972747591522104091-1658712083-644127149-199234695-4416527411401194929-941181943
"C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE" "C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe"
C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\AESTSr64.exe
"C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe" /service /P DellSupportCenter
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\msiexec.exe /V
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Jindra-Dell-modry\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000UA.job
C:\Windows\tasks\SymInstallStub.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Jindra-Dell-modry\AppData\Roaming\Mozilla\Firefox\Profiles\br14tz65.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - "http://search.babylon.com/?AF=109130&ba ... 94d5a5b&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
wikipedia-cz.xml

C:\Users\Jindra-Dell-modry\AppData\Roaming\Mozilla\Firefox\Profiles\br14tz65.default\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}

C:\Users\Jindra-Dell-modry\AppData\Roaming\Mozilla\Firefox\Profiles\br14tz65.default\searchplugins\
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-30 43520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
KMPlayer Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-11-17 1515688]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-12-01 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - KMPlayer Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-11-17 1515688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2011-06-15 1436736]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]
C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2011-11-17 901800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [2011-11-30 6301696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [2009-05-21 206064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-16 137536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Finder]
C:\Program Files (x86)\Media Finder\MF.exe /opentotray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickSet]
C:\Program Files\Dell\QuickSet\QuickSet.exe [2010-01-06 3179288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-01-13 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-12-23 1890088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
C:\Program Files\IDT\WDM\sttray64.exe [2010-01-21 487424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2009-07-01 1079584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
C:\PROGRA~2\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Jindra-Dell-modry^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
""= []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-12-24 460872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-01-19 00:20:07 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-01-19 00:20:06 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-01-18 21:08:53 ----D---- C:\Program Files (x86)\VisualRoute
2012-01-18 20:28:23 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Balabolka
2012-01-18 20:27:51 ----D---- C:\Program Files (x86)\Balabolka
2012-01-18 18:24:26 ----D---- C:\Program Files (x86)\CountryWhois
2012-01-18 14:58:35 ----D---- C:\Program Files (x86)\7-Zip
2012-01-18 10:50:33 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Malwarebytes
2012-01-18 10:50:23 ----D---- C:\ProgramData\Malwarebytes
2012-01-18 08:32:54 ----D---- C:\rsit
2012-01-18 08:32:54 ----D---- C:\Program Files\trend micro
2012-01-17 23:53:48 ----D---- C:\Program Files (x86)\Radmin Viewer 3
2012-01-17 23:40:48 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Media Finder
2012-01-17 23:15:12 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Radmin
2012-01-17 22:52:28 ----D---- C:\Windows\SYSWOW64\rserver30
2012-01-17 01:10:39 ----D---- C:\RMSApps
2012-01-14 00:33:29 ----D---- C:\ProgramData\{064AAB59-6E39-4326-B66B-8F03A445A635}
2012-01-14 00:05:55 ----D---- C:\Program Files (x86)\Cain
2012-01-13 00:07:38 ----A---- C:\Windows\SYSWOW64\webio.dll
2012-01-13 00:07:38 ----A---- C:\Windows\SYSWOW64\schannel.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\webio.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\sspicli.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\schannel.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\secur32.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\lsass.exe
2012-01-13 00:07:38 ----A---- C:\Windows\system32\lsasrv.dll
2012-01-13 00:07:38 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-01-13 00:07:38 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-01-13 00:07:38 ----A---- C:\Windows\system32\drivers\cng.sys
2012-01-13 00:07:37 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2012-01-13 00:07:37 ----A---- C:\Windows\SYSWOW64\secur32.dll
2012-01-13 00:07:37 ----A---- C:\Windows\system32\sspisrv.dll
2012-01-12 23:15:19 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Devicescape
2012-01-12 23:11:52 ----D---- C:\Program Files (x86)\Makayama Interactive
2012-01-11 17:03:34 ----A---- C:\Windows\system32\quartz.dll
2012-01-11 17:03:33 ----A---- C:\Windows\SYSWOW64\quartz.dll
2012-01-11 17:03:33 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2012-01-11 17:03:33 ----A---- C:\Windows\system32\qdvd.dll
2012-01-11 17:03:32 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2012-01-11 17:03:32 ----A---- C:\Windows\system32\ntdll.dll
2012-01-11 17:03:31 ----A---- C:\Windows\SYSWOW64\packager.dll
2012-01-11 17:03:31 ----A---- C:\Windows\system32\packager.dll
2012-01-11 00:13:13 ----A---- C:\user.js
2012-01-11 00:13:04 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Babylon
2012-01-11 00:13:04 ----D---- C:\ProgramData\Babylon
2012-01-11 00:13:03 ----D---- C:\Program Files (x86)\ExpressFiles
2012-01-11 00:04:31 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\PSpad
2012-01-11 00:04:15 ----D---- C:\Program Files (x86)\PSPad editor
2012-01-10 23:49:56 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Notepad++
2012-01-10 23:49:56 ----D---- C:\Program Files (x86)\Notepad++
2012-01-08 11:27:33 ----D---- C:\Program Files (x86)\ESET
2012-01-07 02:21:42 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\calibre
2012-01-07 02:11:21 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\OpenOffice.org
2012-01-07 02:09:07 ----D---- C:\Program Files (x86)\OpenOffice.org 3
2012-01-07 02:08:22 ----A---- C:\Windows\SYSWOW64\javaws.exe
2012-01-07 02:08:22 ----A---- C:\Windows\SYSWOW64\javaw.exe
2012-01-07 02:08:22 ----A---- C:\Windows\SYSWOW64\java.exe
2012-01-05 23:00:32 ----D---- C:\Windows\Downloaded Installations
2012-01-05 23:00:12 ----A---- C:\Windows\SYSWOW64\drivers\NSHE.SYS
2012-01-05 19:11:02 ----A---- C:\Windows\SYSWOW64\hlduinst.exe
2012-01-05 19:11:02 ----A---- C:\Windows\SYSWOW64\hdinst_windows.dll
2012-01-05 19:11:02 ----A---- C:\Windows\SYSWOW64\haspds_windows.dll
2012-01-05 19:11:02 ----A---- C:\Windows\SYSWOW64\hasp_inst_help1.dll
2012-01-05 19:11:01 ----A---- C:\Windows\SYSWOW64\hinstd.dll
2012-01-05 19:11:00 ----A---- C:\Windows\SYSWOW64\UNWISE.EXE
2012-01-02 21:45:21 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\AnvSoft
2012-01-02 21:44:53 ----D---- C:\Program Files (x86)\AnvSoft
2012-01-02 15:34:59 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\AD ON Multimedia
2012-01-02 15:34:50 ----D---- C:\Program Files (x86)\AntiTwin
2012-01-02 15:21:01 ----D---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Key Metric Software
2011-12-31 15:35:37 ----D---- C:\Program Files\Movie Maker
2011-12-21 00:56:58 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-12-21 00:56:58 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-12-21 00:56:58 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-12-21 00:56:58 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-12-21 00:56:57 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-12-21 00:56:56 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\url.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-12-21 00:56:55 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-12-21 00:56:54 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-12-21 00:56:53 ----A---- C:\Windows\system32\wininet.dll
2011-12-21 00:56:53 ----A---- C:\Windows\system32\urlmon.dll
2011-12-21 00:56:53 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-12-21 00:56:53 ----A---- C:\Windows\system32\msls31.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\pngfilt.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\occache.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\msrating.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\mshtml.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\mshta.exe
2011-12-21 00:56:52 ----A---- C:\Windows\system32\jsproxy.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\ieUnatt.exe
2011-12-21 00:56:52 ----A---- C:\Windows\system32\iertutil.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\ieakui.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\ieaksie.dll
2011-12-21 00:56:52 ----A---- C:\Windows\system32\admparse.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\msfeedssync.exe
2011-12-21 00:56:51 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\jscript9.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\jscript.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\imgutil.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\iepeers.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\ieakeng.dll
2011-12-21 00:56:51 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-12-21 00:56:50 ----A---- C:\Windows\system32\mshtmler.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\ieui.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\iesysprep.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\ieframe.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\dxtrans.dll
2011-12-21 00:56:50 ----A---- C:\Windows\system32\dxtmsft.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\webcheck.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\url.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\licmgr10.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\iesetup.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\iernonce.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\iedkcs32.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\ieapfltr.dll
2011-12-21 00:56:49 ----A---- C:\Windows\system32\ieapfltr.dat
2011-12-21 00:56:49 ----A---- C:\Windows\system32\ie4uinit.exe
2011-12-21 00:56:49 ----A---- C:\Windows\system32\icardie.dll
2011-12-21 00:56:48 ----A---- C:\Windows\system32\wextract.exe
2011-12-21 00:56:48 ----A---- C:\Windows\system32\vbscript.dll
2011-12-21 00:56:48 ----A---- C:\Windows\system32\mshtmled.dll
2011-12-21 00:56:48 ----A---- C:\Windows\system32\msfeeds.dll
2011-12-21 00:56:48 ----A---- C:\Windows\system32\inseng.dll
2011-12-21 00:56:48 ----A---- C:\Windows\system32\iexpress.exe

======List of files/folders modified in the last 1 month======

2012-01-19 00:25:44 ----RD---- C:\Program Files (x86)
2012-01-19 00:24:46 ----D---- C:\Windows\Temp
2012-01-19 00:22:00 ----SHD---- C:\Windows\Installer
2012-01-19 00:21:51 ----SHD---- C:\System Volume Information
2012-01-19 00:20:07 ----D---- C:\Windows\system32\drivers
2012-01-19 00:17:28 ----HD---- C:\ProgramData
2012-01-19 00:17:28 ----D---- C:\Windows\Prefetch
2012-01-18 21:41:22 ----D---- C:\Windows\SysWOW64
2012-01-18 21:38:06 ----D---- C:\Windows\inf
2012-01-18 21:38:06 ----D---- C:\Windows
2012-01-18 21:33:56 ----SD---- C:\Users\Jindra-Dell-modry\AppData\Roaming\Microsoft
2012-01-18 18:33:19 ----AD---- C:\Windows\System32
2012-01-18 18:13:33 ----D---- C:\Windows\system32\config
2012-01-18 16:26:44 ----D---- C:\Windows\rescache
2012-01-18 15:04:43 ----D---- C:\Program Files (x86)\WinRAR
2012-01-18 13:30:22 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-18 08:32:54 ----RD---- C:\Program Files
2012-01-17 22:52:41 ----D---- C:\Windows\system32\DriverStore
2012-01-17 22:52:41 ----D---- C:\Windows\system32\catroot
2012-01-17 00:02:43 ----D---- C:\Windows\winsxs
2012-01-17 00:02:34 ----D---- C:\Windows\system32\cs-CZ
2012-01-16 21:30:18 ----D---- C:\Windows\system32\wbem
2012-01-16 21:29:41 ----HD---- C:\Windows\system32\GroupPolicy
2012-01-16 21:29:41 ----D---- C:\Windows\Tasks
2012-01-16 21:29:41 ----D---- C:\Windows\system32\NDF
2012-01-16 21:29:41 ----D---- C:\Windows\system32\CodeIntegrity
2012-01-16 21:29:41 ----D---- C:\Windows\system32\catroot2
2012-01-16 21:29:41 ----D---- C:\Windows\registration
2012-01-16 20:32:53 ----HD---- C:\Windows\system32\GroupPolicyUsers
2012-01-16 17:20:47 ----D---- C:\Program Files\WinRAR
2012-01-14 00:31:45 ----D---- C:\Windows\system32\Tasks
2012-01-13 00:05:55 ----D---- C:\Windows\debug
2012-01-12 23:16:53 ----RSD---- C:\Windows\assembly
2012-01-12 23:13:13 ----D---- C:\Windows\SYSWOW64\drivers
2012-01-12 16:37:59 ----D---- C:\Windows\system
2012-01-12 08:35:24 ----D---- C:\Windows\LiveKernelReports
2012-01-12 00:30:42 ----SHD---- C:\$Recycle.Bin
2012-01-12 00:30:32 ----RD---- C:\Users
2012-01-11 23:45:09 ----D---- C:\Windows\ehome
2012-01-11 23:39:14 ----A---- C:\Windows\system32\MRT.exe
2012-01-07 02:15:11 ----D---- C:\Windows\pss
2012-01-07 02:09:27 ----RSD---- C:\Windows\Fonts
2012-01-07 02:08:00 ----D---- C:\Program Files (x86)\Java
2012-01-05 23:27:42 ----D---- C:\Windows\system32\Setup
2012-01-02 15:23:23 ----D---- C:\Program Files (x86)\Common Files
2012-01-01 11:53:42 ----D---- C:\Windows\SoftwareDistribution
2011-12-31 11:42:38 ----D---- C:\Program Files (x86)\Dell
2011-12-30 10:09:18 ----D---- C:\Windows\Microsoft.NET
2011-12-29 23:01:51 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-12-26 13:14:18 ----D---- C:\Windows\system32\LogFiles
2011-12-22 12:25:52 ----D---- C:\Program Files\CCleaner
2011-12-21 01:02:08 ----D---- C:\Windows\Panther
2011-12-21 01:02:06 ----D---- C:\Windows\Logs
2011-12-21 00:59:51 ----D---- C:\Program Files (x86)\Internet Explorer
2011-12-21 00:59:50 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-12-21 00:59:50 ----D---- C:\Program Files\Internet Explorer
2011-12-21 00:59:49 ----D---- C:\Windows\SYSWOW64\migration
2011-12-21 00:59:49 ----D---- C:\Windows\SYSWOW64\en-US
2011-12-21 00:59:48 ----D---- C:\Windows\system32\migration
2011-12-21 00:59:48 ----D---- C:\Windows\system32\en-US
2011-12-21 00:59:48 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2011-04-18 189440]
R1 Uim_IM;Universal Image Mounter Plugin; C:\Windows\System32\Drivers\Uim_IMx64.sys [2011-07-05 572336]
R1 Uim_VIM;UIM Virtual Image Plugin; C:\Windows\System32\Drivers\uim_vimx64.sys [2011-07-05 352816]
R1 UimBus;Universal Image Mounter Controller; C:\Windows\system32\DRIVERS\uimx64.sys [2011-07-05 59184]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-01-13 6327296]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-01-13 185344]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 116736]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2011-11-30 22592]
R3 BCM43XX;Ovladač pro bezdrátovou síťovou kartu DW WLAN; C:\Windows\system32\DRIVERS\bcmwl664.sys [2011-11-30 4716608]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2009-07-02 98344]
R3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2009-07-02 132648]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2009-07-02 35104]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2009-07-02 21160]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 40832]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 84864]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt64.sys [2010-01-21 505856]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-12-23 301104]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 NSHE;Guardant Emulator Driver; \??\C:\Windows\system32\Drivers\NSHE.SYS []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-01-13 6327296]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 mirrorv3;mirrorv3; C:\Windows\system32\DRIVERS\rminiv3.sys [2009-10-09 5632]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2011-08-17 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2011-08-17 27136]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\drivers\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\drivers\nusb3xhc.sys [2010-09-30 180736]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2011-08-17 9216]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-21 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2011-08-17 9216]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\AESTSr64.exe [2009-03-03 89600]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-01-13 202752]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-07-01 864032]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2011-04-27 12784]
R2 sprtsvc_DellSupportCenter;SupportSoft Sprocket Service (DellSupportCenter); C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe [2009-05-21 206064]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\STacSV64.exe [2010-01-21 244736]
R2 wltrysvc;DW WLAN Tray Service; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [2011-11-30 48128]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2011-10-27 718384]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-01 1255736]

-----------------EOF-----------------

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\Program Files (x86)\Ask.com
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000UA.job
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na MoveIt! PC by měl být restartován.

Udelano,vytvoril se log-posilam,mam jeste neco udelat??
All processes killed
========== FILES ==========
C:\Program Files (x86)\Ask.com\Updater folder moved successfully.
C:\Program Files (x86)\Ask.com\assets\oobe folder moved successfully.
C:\Program Files (x86)\Ask.com\assets folder moved successfully.
C:\Program Files (x86)\Ask.com folder moved successfully.
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000Core.job moved successfully.
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1260641067-3451729402-1417893360-1000UA.job moved successfully.
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update\Manifest\Initial folder moved successfully.
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update\Manifest folder moved successfully.
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update\Download folder moved successfully.
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update\1.2.203.0 folder moved successfully.
C:\Users\Jindra-Dell-modry\AppData\Local\Facebook\Update folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 51960 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Jindra-Dell-modry
->Temp folder emptied: 96894207 bytes
->Temporary Internet Files folder emptied: 82121 bytes
->Java cache emptied: 4770971 bytes
->FireFox cache emptied: 56371174 bytes
->Flash cache emptied: 830 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 38868 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50641 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 746 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 151,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Guest

User: Jindra-Dell-modry
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 01192012_182115

Files moved on Reboot...
C:\Users\Jindra-Dell-modry\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File C:\Users\Jindra-Dell-modry\AppData\Local\Mozilla\Firefox\Profiles\br14tz65.default\startupCache\startupCache.4.little not found!
File C:\Users\Jindra-Dell-modry\AppData\Local\Mozilla\Firefox\Profiles\br14tz65.default\Cache.Trash\D\8A\34C9Ad01 not found!
File C:\Users\Jindra-Dell-modry\AppData\Local\Mozilla\Firefox\Profiles\br14tz65.default\Cache.Trash\D\8A\C2B14d01 not found!
File C:\Users\Jindra-Dell-modry\AppData\Local\Mozilla\Firefox\Profiles\br14tz65.default\Cache.Trash\D\8A\D0C9Dd01 not found!

Registry entries deleted on Reboot...

Vše smazáno. Pokud nemáte jiný problém, je to vše.

Pc se mi zda nejake divne..Je to od vcerejska,kdy se mi pokousel nekdo zmenit heslo na facebooku.Je pravda,ze jsem koukal na ruzne stranky o Kevinu Mitnickovi a to jak vime,byl jeden z nej hackeru sveta,tak jestli se mi nekdo neproboural do meho pc.Pc jsem prohledal i on-line programem od Essetu a naslo mi to 1 smejdika,ale nevim,jestli je to vse,co jsem tam mel.Jestli se muzu zeptat,jaky program je dle Vasich zkusenosti nejlepsi na ochranu pc??Myslim antivir,atd.....?Ja pouzivam Microsoft Security Essentials.Co myslite vy??

Těžku říci, nebyl jsem u toho. Udělejte pro jistotu sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Vkladam log z mbam
Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.60.0.1800
www.malwarebytes.org

Verze databáze: v2012.01.19.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jindra-Dell-modry :: JINDRA [administrátor]

Ochrana: Zakázána

19.1.2012 19:20:22
mbam-log-2012-01-19 (19-20-22).txt

Typ: Úplná kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 279441
Uplynulý čas: 36 minut, 21 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Log je OK. Doporučil bych změnu hesla na FB.

to jsem udelal uz,kdyz jsem zjistil Attack....Doporucily by jste mi nejake programy na ochranu?

Antivir Avira, nebo Avast, antispy SuperAntispyware (stačí jako občasný skener), příp. firewall Comodo, ZoneAlarm.