VIRY.CZ

Zdravím, nedávno se mi stalo, že když jsem chtěl psát háčky například u d, tak to ten háček udělalo dvakrát a výsledek byl ´´d. Když jsem projel PC antivirem (ESET Smart Security), tak mi to našlo že se v Catalyst.exe něco skrývá, ale že to nejde odstranit. Zatím to řeším tak, že to vždycky vypnu ve správci úloh. Pak už můžu normálně psát háčky, ale ten vir (keylogger?!) tam pořád je...

Včera jsem si koupil i novou zvukovku a sluchátka, ale zjistil jsem, že mi v Google Chrome nefugnuje zvuk, a ani se mi neukazuje ve směšovači zvuku. Ale ostatní prohlížeče se mi tam ukazují normálně..

// Tak nakonec mi jdou jenom systémové zvuky, VLC media player a zvuky (hudba) přes Interent Explorer... Chrome se mi ve směšovači neukazuje vůbec, Firefox se ukazuje ale nehraje...

Zkoušel jsem PC restartovat, zakázat a povolit ovladače na tu novou zvukovku, ale pořád nevím co s tím je. Nevím jestli by to mohl být vir nebo problém je někdo v nastavení, ale i tak se radši ptám....


Výpis z RSIT:

• Logfile of random's system information tool 1.09 (written by random/random)
  Run by Daniel at 2012-07-02 09:56:00
  Microsoft® Windows Vista™ Home Basic
  System drive C: has 38 GB (25%) free of 153 GB
  Total RAM: 2047 MB (24% free)
  
  Logfile of Trend Micro HijackThis v2.0.4
  Scan saved at 9:56:05, on 2.7.2012
  Platform: Windows Vista (WinNT 6.00.1904)
  MSIE: Internet Explorer v7.00 (7.00.6000.16982)
  Boot mode: Normal
  
  Running processes:
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
  C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Program Files\trend micro\Daniel.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  F2 - REG:system.ini: UserInit=userinit.exe
  O1 - Hosts: ::1 localhost
  O2 - BHO: WTBAddon - {1630669F-9D0C-4F0B-8AA9-10DE8BEE1755} - C:\Program Files (x86)\MyBrowserCash\WTBPlugin.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [SwitchBoard] "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"
  O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
  O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
  O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
  O4 - HKCU\..\Run: [Google Update] "C:\Users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe" /c
  O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
  O4 - HKCU\..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s
  O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
  O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
  O4 - HKCU\..\Run: [uTorrent] "C:\Users\Daniel\Desktop\uTorrent.exe" /MINIMIZED
  O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
  O4 - HKCU\..\Run: [MyBrowserCash] C:\Program Files (x86)\MyBrowserCash\MyBrowserCash.exe
  O4 - HKCU\..\Run: [CCC] C:\Users\Daniel\AppData\Local\Temp\ATI .exe
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
  O4 - Startup: ATI .exe
  O4 - Global Startup: 20Dollars2Surf.lnk = C:\Program Files (x86)\20Dollars2Surf\20dollars2surf.exe
  O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html
  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - (no file)
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
  O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwar ... PIDPDE.cab
  O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwar ... TSUEng.cab
  O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
  O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
  O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
  O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
  O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
  O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
  O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
  O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
  O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
  O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
  O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
  O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
  O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
  O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
  O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
  O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
  O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
  O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
  O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
  O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
  O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
  O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
  O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
  O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
  O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
  O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
  
  --
  End of file - 9329 bytes
  
  ======Listing Processes======
  
  \SystemRoot\System32\smss.exe
  C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
  wininit.exe
  C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  winlogon.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  C:\Windows\system32\nvvsvc.exe
  C:\Windows\system32\svchost.exe -k rpcss
  C:\Windows\System32\svchost.exe -k secsvcs
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  C:\Windows\system32\svchost.exe -k netsvcs
  "C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe"
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe -k LocalService
  "C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
  C:\Windows\system32\nvvsvc.exe -session -first
  C:\Windows\system32\svchost.exe -k NetworkService
  "C:\Windows\system32\Dwm.exe"
  C:\Windows\Explorer.EXE
  C:\Windows\System32\spoolsv.exe
  taskeng.exe {53EB758D-11E0-4FF7-ABC6-C20FB5863969}
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
  "C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
  "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
  C:\Windows\SysWOW64\PnkBstrA.exe
  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
  C:\Windows\system32\svchost.exe -k imgsvc
  C:\Windows\System32\svchost.exe -k WerSvcGroup
  C:\Windows\system32\SearchIndexer.exe /Embedding
  "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-03131f8f-56e0-4a49-8eda-7b1ed17760ab -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-75b8c35f-e748-4af7-96d2-d0ef8586a0cb -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-96e1ae3e-4c47-4ed0-bf53-3442a4d737f2 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:29019e2c-d9e3-46df-bdb1-7b4a7f2b79ce
  C:\Windows\system32\svchost.exe -k WindowsMobile
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
  C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
  "C:\Windows\system32\wuauclt.exe"
  taskeng.exe {EB99680A-2173-4A67-A670-0A4898B2E096}
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe"
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/SILENT/OmniboxDisallowInlineHQP/Standard/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/11/Prerender/ContentPrefetchPrerender1/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/spdy3/UMA-Uniformity-Trial-1-Percent/group_61/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/WebStoreLinkExperiment/FooterLink/ --extension-process --renderer-print-preview --channel="1888.2.89078283\1027929319" /prefetch:3
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="1888.4.852874930\590107687" /prefetch:12
  C:\Windows\system32\rundll32.exe "C:\Users\Daniel\AppData\Local\Google\Chrome\APPLIC~1\200113~1.47\gcswf32.dll",BrokerMain browser=chrome
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Daniel\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll" --lang=cs --channel="1888.6.528250021\1128732145" --flash-broker=3976 /prefetch:4
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/HttpPipeliningCompatibility/disable_test/IdleSktToImpact/idle_timeout_10/Instant/SILENT/NetworkConnectivity/disable_network_stats/OmniboxDisallowInlineHQP/Standard/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/11/Prerender/ContentPrefetchPrerender1/PrerenderFromOmnibox/OmniboxPrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/spdy3/UMA-Uniformity-Trial-1-Percent/group_61/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/WebStoreLinkExperiment/FooterLink/ --renderer-print-preview --channel="1888.11.785334835\1176819067" /prefetch:3
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/HttpPipeliningCompatibility/disable_test/IdleSktToImpact/idle_timeout_10/Instant/SILENT/NetworkConnectivity/disable_network_stats/OmniboxDisallowInlineHQP/Standard/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/11/Prerender/ContentPrefetchPrerender1/PrerenderFromOmnibox/OmniboxPrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/spdy3/UMA-Uniformity-Trial-1-Percent/group_61/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/WebStoreLinkExperiment/FooterLink/ --renderer-print-preview --channel="1888.15.625739551\1619807144" /prefetch:3
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/HttpPipeliningCompatibility/disable_test/IdleSktToImpact/idle_timeout_10/Instant/SILENT/NetworkConnectivity/disable_network_stats/OmniboxDisallowInlineHQP/Standard/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/11/Prerender/ContentPrefetchPrerender1/PrerenderFromOmnibox/OmniboxPrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/spdy3/UMA-Uniformity-Trial-1-Percent/group_61/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/WebStoreLinkExperiment/FooterLink/ --renderer-print-preview --channel="1888.19.54849751\649808548" /prefetch:3
  C:\Windows\system32\wbem\wmiprvse.exe
  "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Daniel\Desktop\TechLaRocca.pls"
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot) " "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  "C:\Windows\system32\SearchFilterHost.exe" 0 624 628 636 65536 632
  "C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/HttpPipeliningCompatibility/disable_test/IdleSktToImpact/idle_timeout_10/Instant/SILENT/NetworkConnectivity/disable_network_stats/OmniboxDisallowInlineHQP/Standard/OmniboxPrerenderHitWeightingTrial/OmniboxPrerenderWeight1.0/OmniboxSearchSuggest/11/Prerender/ContentPrefetchPrerender1/PrerenderFromOmnibox/OmniboxPrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/spdy3/UMA-Uniformity-Trial-1-Percent/group_61/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/WebStoreLinkExperiment/FooterLink/ --renderer-print-preview --channel="1888.28.1500763274\566252865" /prefetch:3
  "C:\Users\Daniel\Desktop\RSITx64.exe"
  
  ======Scheduled tasks folder======
  
  C:\Windows\tasks\Adobe Flash Player Updater.job
  C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
  C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000Core.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000UA.job
  
  ======Registry dump======
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1630669F-9D0C-4F0B-8AA9-10DE8BEE1755}]
  WTBAddon Class - C:\Program Files (x86)\MyBrowserCash\WTBPlugin.dll [2011-12-13 98816]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
  Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
  Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-05-04 453504]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
  Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-05-04 157576]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2011-11-16 1581752]
  "Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 225792]
  "AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15 499608]
  "egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2012-03-07 4081008]
  "RivaTunerStartupDaemon"=C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe [2009-08-22 24576]
  "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2011-10-15 10406208]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "Google Update"=C:\Users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-14 136176]
  "Steam"=C:\Program Files (x86)\Steam\steam.exe [2011-11-14 1242448]
  "KiesHelper"=C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [2012-02-03 943504]
  "KiesTrayAgent"=C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2012-02-03 3508624]
  "KiesPDLR"=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-02-03 21392]
  "uTorrent"=C:\Users\Daniel\Desktop\uTorrent.exe [2011-12-08 641400]
  "DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-01-19 3477312]
  "MyBrowserCash"=C:\Program Files (x86)\MyBrowserCash\MyBrowserCash.exe [2012-03-31 104960]
  "CCC"=C:\Users\Daniel\AppData\Local\Temp\ATI .exe [2012-03-09 1643520]
  
  [HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
  "Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
  "QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2009-05-26 413696]
  "SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  "AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
  "LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2012-06-27 1996200]
  "SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-17 252296]
  "P17RunE"=RunDll32 P17RunE.dll,RunDLLEntry []
  
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  20Dollars2Surf.lnk - C:\Program Files (x86)\20Dollars2Surf\20dollars2surf.exe
  
  C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  ATI .exe
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "dontdisplaylastusername"=0
  "legalnoticecaption"=
  "legalnoticetext"=
  "shutdownwithoutlogon"=1
  "undockwithoutlogon"=1
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoActiveDesktop"=1
  "NoActiveDesktopChanges"=1
  "ForceActiveDesktopOn"=0
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
  "vidc.mrle"=msrle32.dll
  "vidc.msvc"=msvidc32.dll
  "msacm.imaadpcm"=imaadp32.acm
  "msacm.msg711"=msg711.acm
  "msacm.msgsm610"=msgsm32.acm
  "msacm.msadpcm"=msadp32.acm
  "midimapper"=midimap.dll
  "wavemapper"=msacm32.drv
  "VIDC.UYVY"=msyuv.dll
  "VIDC.YUY2"=msyuv.dll
  "VIDC.YVYU"=msyuv.dll
  "VIDC.IYUV"=iyuv_32.dll
  "vidc.i420"=iyuv_32.dll
  "VIDC.YVU9"=tsbyuv.dll
  "msacm.l3acm"=C:\Windows\System32\l3codeca.acm
  "wave"=wdmaud.drv
  "midi"=wdmaud.drv
  "mixer"=wdmaud.drv
  "aux"=wdmaud.drv
  "MSVideo8"=VfWWDM32.dll
  "wave1"=wdmaud.drv
  "midi1"=wdmaud.drv
  "mixer1"=wdmaud.drv
  
  ======List of files/folders created in the last 1 month======
  
  2012-07-02 09:44:42 ----D---- C:\Program Files\trend micro
  2012-07-02 09:44:41 ----D---- C:\rsit
  2012-07-01 18:28:29 ----D---- C:\Program Files (x86)\Realtek
  2012-07-01 18:28:25 ----A---- C:\Windows\RtlExUpd.dll
  2012-07-01 18:20:39 ----HD---- C:\Program Files (x86)\Temp
  2012-07-01 17:39:44 ----D---- C:\ProgramData\Creative Labs
  2012-07-01 17:39:01 ----N---- C:\Windows\Ctregrun.exe
  2012-07-01 17:09:03 ----HD---- C:\Program Files (x86)\Creative Installation Information
  2012-07-01 17:08:59 ----A---- C:\Windows\SYSWOW64\wrap_oal.dll
  2012-07-01 17:08:59 ----A---- C:\Windows\SYSWOW64\OpenAL32.dll
  2012-07-01 17:08:59 ----A---- C:\Windows\system32\wrap_oal.dll
  2012-07-01 17:08:59 ----A---- C:\Windows\system32\OpenAL32.dll
  2012-07-01 17:08:58 ----N---- C:\Windows\SYSWOW64\Sens_oal.dll
  2012-07-01 17:08:58 ----N---- C:\Windows\system32\Sens_oal.dll
  2012-07-01 17:07:50 ----D---- C:\Program Files\Creative
  2012-07-01 17:06:55 ----D---- C:\ProgramData\Creative
  2012-07-01 17:06:26 ----A---- C:\Windows\SYSWOW64\CmdRtr.DLL
  2012-07-01 17:06:26 ----A---- C:\Windows\SYSWOW64\APOMngr.DLL
  2012-07-01 17:06:26 ----A---- C:\Windows\system32\CmdRtr64.DLL
  2012-07-01 17:06:26 ----A---- C:\Windows\system32\APOMgr64.DLL
  2012-07-01 17:05:05 ----A---- C:\Windows\SYSWOW64\INRES.DLL
  2012-07-01 17:05:05 ----A---- C:\Windows\system32\INRES.DLL
  2012-07-01 17:05:04 ----D---- C:\Program Files (x86)\Creative
  2012-06-30 14:02:09 ----D---- C:\Program Files (x86)\Oracle
  2012-06-30 14:00:58 ----A---- C:\Windows\SYSWOW64\npDeployJava1.dll
  2012-06-30 14:00:58 ----A---- C:\Windows\SYSWOW64\javaws.exe
  2012-06-30 13:59:46 ----A---- C:\Windows\SYSWOW64\javaw.exe
  2012-06-30 13:59:45 ----A---- C:\Windows\SYSWOW64\java.exe
  2012-06-30 13:31:28 ----D---- C:\Users\Daniel\AppData\Roaming\Auslogics
  2012-06-30 12:19:03 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
  2012-06-30 12:17:03 ----A---- C:\Windows\system32\FNTCACHE.DAT
  2012-06-30 10:54:45 ----D---- C:\Windows\Logs
  2012-06-30 10:27:01 ----D---- C:\Program Files (x86)\Auslogics
  2012-06-30 10:00:19 ----D---- C:\Users\Daniel\AppData\Roaming\Day 1 Studios
  2012-06-27 17:26:03 ----D---- C:\ProgramData\ESET
  2012-06-27 17:26:03 ----D---- C:\Program Files\ESET
  2012-06-14 16:45:30 ----D---- C:\Users\Daniel\AppData\Roaming\Sun
  
  ======List of files/folders modified in the last 1 month======
  
  2012-07-02 09:55:57 ----D---- C:\Windows\Temp
  2012-07-02 09:44:53 ----D---- C:\Windows\Prefetch
  2012-07-02 09:44:42 ----RD---- C:\Program Files
  2012-07-02 09:15:50 ----D---- C:\Program Files (x86)\Steam
  2012-07-02 09:14:52 ----D---- C:\Users\Daniel\AppData\Roaming\uTorrent
  2012-07-01 23:36:20 ----D---- C:\Users\Daniel\AppData\Roaming\Skype
  2012-07-01 21:51:54 ----SHD---- C:\Windows\Installer
  2012-07-01 21:24:05 ----D---- C:\Program Files (x86)\World_of_Tanks
  2012-07-01 20:36:17 ----D---- C:\Users\Daniel\AppData\Roaming\vlc
  2012-07-01 18:36:42 ----A---- C:\Windows\DIFxAPI.dll
  2012-07-01 18:36:30 ----D---- C:\Windows
  2012-07-01 18:30:20 ----D---- C:\Windows\system32\catroot
  2012-07-01 18:30:11 ----D---- C:\Windows\inf
  2012-07-01 18:30:00 ----SHD---- C:\System Volume Information
  2012-07-01 18:28:29 ----RD---- C:\Program Files (x86)
  2012-07-01 18:28:29 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
  2012-07-01 17:39:44 ----HD---- C:\ProgramData
  2012-07-01 17:39:02 ----D---- C:\Windows\SysWOW64
  2012-07-01 17:20:06 ----SD---- C:\Windows\Downloaded Program Files
  2012-07-01 17:10:39 ----D---- C:\Windows\System32
  2012-07-01 17:09:04 ----D---- C:\Program Files (x86)\Common Files
  2012-07-01 17:06:03 ----D---- C:\Windows\system32\drivers
  2012-06-30 15:52:05 ----D---- C:\Users\Daniel\AppData\Roaming\DAEMON Tools Lite
  2012-06-30 14:36:09 ----AD---- C:\ProgramData\TEMP
  2012-06-30 13:59:02 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
  2012-06-30 13:58:41 ----D---- C:\Program Files (x86)\Java
  2012-06-30 13:29:25 ----D---- C:\Program Files (x86)\SpeedFan
  2012-06-30 12:18:05 ----D---- C:\Windows\system32\LogFiles
  2012-06-30 11:46:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
  2012-06-30 11:07:39 ----D---- C:\Windows\SYSWOW64\LogFiles
  2012-06-30 11:03:49 ----D---- C:\Users\Daniel\AppData\Roaming\FileZilla
  2012-06-30 11:00:47 ----D---- C:\Windows\Panther
  2012-06-30 11:00:37 ----D---- C:\Windows\Minidump
  2012-06-30 11:00:37 ----D---- C:\Windows\Debug
  2012-06-30 10:53:41 ----D---- C:\Windows\system32\catroot2
  2012-06-30 10:36:34 ----D---- C:\Program Files\CyberGhost VPN
  2012-06-30 10:33:28 ----D---- C:\Users\Daniel\AppData\Roaming\Notepad++
  2012-06-30 10:32:37 ----D---- C:\Program Files (x86)\Opera
  2012-06-30 10:32:26 ----D---- C:\Users\Daniel\AppData\Roaming\Opera
  2012-06-30 10:30:05 ----SD---- C:\Users\Daniel\AppData\Roaming\Microsoft
  2012-06-30 10:25:30 ----D---- C:\Users\Daniel\AppData\Roaming\FlightSimTools.com
  2012-06-27 15:47:31 ----D---- C:\Program Files (x86)\Free Easy CD DVD Burner
  2012-06-23 13:45:36 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
  2012-06-14 16:58:06 ----D---- C:\Users\Daniel\AppData\Roaming\.minecraft
  2012-06-13 22:37:20 ----D---- C:\Program Files (x86)\Microsoft Games
  
  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2011-03-18 29592]
  R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-01-28 283200]
  R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 209768]
  R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 148528]
  R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2012-03-14 38288]
  R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2012-03-14 73296]
  R2 cpuz135;cpuz135; \??\C:\Windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]
  R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2012-03-14 187632]
  R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
  R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2012-02-10 13624128]
  R3 P17;SB Audigy; C:\Windows\system32\drivers\P17.sys [2009-04-21 1288192]
  R3 RivaTuner64;RivaTuner64; \??\C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [2012-01-27 19952]
  R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2006-09-18 55640]
  R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 108032]
  S3 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool64.sys [2006-11-10 30720]
  S3 DCamUSBVM;Lenovo Q350 USB PC Camera; C:\Windows\System32\Drivers\usbVM31b.sys [2005-09-19 142336]
  S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 6144]
  S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 273920]
  S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
  S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 11008]
  S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 7040]
  S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 6656]
  S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 7936]
  S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-07-20 157672]
  S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-07-20 16872]
  S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-07-20 177640]
  S3 tap0901;TAP-Win32 Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2010-02-25 29696]
  S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 41472]
  S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
  S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\winusb.sys [2006-11-02 36864]
  S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 46080]
  
  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
  R2 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-11-18 307200]
  R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2012-03-07 913144]
  R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]
  R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-10-15 1640768]
  R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-04-14 76888]
  R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 26624]
  R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 26624]
  R3 WPFFontCache_v0400;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
  S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-27 116648]
  S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
  S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
  S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-07-01 79360]
  S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-07-01 79360]
  S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-27 116648]
  S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
  S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2012-06-27 529232]
  S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
  S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
  S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
  
  -----------------EOF-----------------

Keylogger možná máte, ale rozhodně by se neměl xchovávat v ovladačích dr. karty. Pokud jste si ho nenainstaloval vědomě, dejte log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Zvuk byl záhada, začalo to nakonec samo od sebe fungovat... Takže zvuk je v pohodě... Ale toho keyloggeru se možná trochu bojím, aby sem nakonec neměl toho ještě víc.

ComboFix:


ComboFix 12-07-02.01 - Daniel 02.07.2012 19:45:47.1.1 - x64
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.420.1029.18.2047.1051 [GMT 2:00]
Spuštěný z: c:\users\Daniel\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Daniel\AppData\Local\TempDIR
c:\users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATI .exe
c:\users\Daniel\AppData\Roaming\Roaming
c:\users\Daniel\AppData\Roaming\Roaming\Quest3D\ShipSimExtreme\channels.lst
c:\users\Daniel\AppData\Roaming\Uninstal.exe
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\SET353F.tmp
c:\windows\SysWow64\SET5B51.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-02 do 2012-07-02 )))))))))))))))))))))))))))))))
.
.
2012-07-02 10:55 . 2012-07-02 10:55 -------- d-----w- c:\windows\SysWow64\Data
2012-07-02 10:55 . 2012-07-02 10:55 -------- d-----w- c:\windows\system32\Data
2012-07-02 10:55 . 2005-06-14 17:09 10752 ----a-w- c:\windows\system32\INRES.DLL
2012-07-02 10:55 . 2005-06-14 17:07 11264 ----a-w- c:\windows\SysWow64\INRES.DLL
2012-07-02 10:55 . 2012-07-02 10:55 431104 ----a-w- c:\windows\system32\wrap_oal.dll
2012-07-02 10:55 . 2012-07-02 10:55 409600 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2012-07-02 10:55 . 2012-07-02 10:55 136192 ----a-w- c:\windows\system32\OpenAL32.dll
2012-07-02 10:55 . 2012-07-02 10:55 114688 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2012-07-02 10:54 . 2007-03-22 14:57 1527808 ------w- c:\windows\SysWow64\Sens_oal.dll
2012-07-02 10:54 . 2007-03-22 14:56 1839616 ------w- c:\windows\system32\Sens_oal.dll
2012-07-02 10:53 . 2007-03-27 11:12 135168 ------w- c:\windows\system32\APOMgr64.dll
2012-07-02 10:53 . 2007-03-27 11:11 105472 ------w- c:\windows\SysWow64\APOMngr.dll
2012-07-02 10:53 . 2007-03-15 09:10 80896 ------w- c:\windows\system32\CmdRtr64.dll
2012-07-02 10:53 . 2007-03-15 09:09 67072 ------w- c:\windows\SysWow64\CmdRtr.dll
2012-07-02 10:50 . 2003-11-10 16:14 729088 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2012-07-02 10:50 . 2003-11-10 16:13 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2012-07-02 10:50 . 2003-11-10 16:12 266240 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2012-07-02 10:50 . 2003-11-10 16:12 192512 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2012-07-02 10:50 . 2003-11-10 16:11 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2012-07-02 10:49 . 2012-07-02 10:49 311428 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2012-07-02 10:49 . 2012-07-02 10:49 188548 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2012-07-02 09:43 . 2012-07-02 09:43 -------- d-----w- c:\program files (x86)\ffdshow
2012-07-02 09:05 . 2012-07-02 09:05 -------- d-----w- c:\users\Daniel\AppData\Local\Macromedia
2012-07-02 07:44 . 2012-07-02 07:56 -------- d-----w- c:\program files\trend micro
2012-07-02 07:44 . 2012-07-02 07:56 -------- d-----w- C:\rsit
2012-07-01 16:28 . 2007-01-12 15:54 520192 ----a-w- c:\windows\RtlExUpd.dll
2012-07-01 16:28 . 2006-02-07 14:44 65024 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2012-07-01 16:20 . 2012-07-01 16:37 -------- d--h--w- c:\program files (x86)\Temp
2012-07-01 15:39 . 2012-07-01 15:39 -------- d-----w- c:\programdata\Creative Labs
2012-07-01 15:09 . 2012-07-01 15:44 -------- d-----w- c:\program files (x86)\Creative Installation Information
2012-07-01 15:07 . 2012-07-01 15:43 -------- d-----w- c:\program files\Creative
2012-07-01 15:06 . 2012-07-01 15:52 -------- d-----w- c:\programdata\Creative
2012-07-01 15:05 . 2012-07-02 10:55 -------- d-----w- c:\program files (x86)\Creative
2012-07-01 01:54 . 2012-07-01 01:54 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3D0146E5-55BE-4051-98B1-65EE1F597F31}\offreg.dll
2012-06-30 12:03 . 2012-06-30 12:03 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-06-30 12:02 . 2012-06-30 12:02 -------- d-----w- c:\program files (x86)\Oracle
2012-06-30 12:00 . 2012-06-30 11:59 772592 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-06-30 11:31 . 2012-06-30 22:56 -------- d-----w- c:\users\Daniel\AppData\Roaming\Auslogics
2012-06-30 10:19 . 2012-06-30 10:19 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-06-30 08:54 . 2012-07-02 10:55 -------- d-----w- c:\windows\Logs
2012-06-30 08:27 . 2012-06-30 11:25 -------- d-----w- c:\program files (x86)\Auslogics
2012-06-30 08:00 . 2012-06-30 08:00 -------- d-----w- c:\users\Daniel\AppData\Roaming\Day 1 Studios
2012-06-30 07:59 . 2012-06-30 17:43 -------- d-----w- c:\users\Daniel\AppData\Local\ALI213
2012-06-29 19:40 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3D0146E5-55BE-4051-98B1-65EE1F597F31}\mpengine.dll
2012-06-27 15:26 . 2012-06-27 15:26 -------- d-----w- c:\program files\ESET
2012-06-13 21:02 . 2012-06-13 21:04 126224 ----a-w- c:\program files (x86)\Microsoft Games\Microsoft Flight Simulator X\LotusL39uninst.exe
2012-06-13 20:44 . 2012-06-13 20:44 53555 ----a-w- c:\program files (x86)\Microsoft Games\Microsoft Flight Simulator X\uninstallC337.exe
2012-06-13 19:00 . 2012-06-13 19:00 58575 ----a-w- c:\program files (x86)\Microsoft Games\Microsoft Flight Simulator X\UNCARMOONEY.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-30 11:59 . 2011-11-14 19:14 687600 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-23 11:45 . 2012-04-11 04:45 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 11:45 . 2011-11-14 19:04 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-12 20:29 . 2012-03-06 12:36 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-05-12 20:29 . 2012-01-24 15:48 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-05-12 20:10 . 2012-01-24 15:48 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-04-14 20:47 . 2012-01-24 15:48 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1630669F-9D0C-4F0B-8AA9-10DE8BEE1755}]
2011-12-13 16:55 98816 ----a-w- c:\program files (x86)\MyBrowserCash\WTBPlugin.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-11-14 1242448]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-02-03 943504]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-02-03 3508624]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-02-03 21392]
"uTorrent"="c:\users\Daniel\Desktop\uTorrent.exe" [2011-12-08 641400]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-01-19 3477312]
"MyBrowserCash"="c:\program files (x86)\MyBrowserCash\MyBrowserCash.exe" [2012-03-31 104960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-05-26 413696]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"P17RunE"="P17RunE.dll" [2007-04-09 14848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
20Dollars2Surf.lnk - c:\program files (x86)\20Dollars2Surf\20dollars2surf.exe [2011-11-14 89088]
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 11:45]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-27 16:55]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-27 16:55]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000Core.job
- c:\users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-14 17:21]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000UA.job
- c:\users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-14 17:21]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2007-03-09 5021696]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 225792]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-03-07 4081008]
"RivaTunerStartupDaemon"="c:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe" [2009-08-22 24576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-15 10406208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\mgbpwlgq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?babsrc=HP_ss&affID=111015&mntrId=4490361000000000000000ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.id - 4490361000000000000000ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.hardId - 4490361000000000000000ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15433
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1712:51
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111015
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\ESET\ESET Smart Security\x86\ekrn.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2012-07-02 20:12:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-07-02 18:12
.
Před spuštěním: Volných bajtů: 51 443 249 152
Po spuštění: Volných bajtů: 51 766 845 440
.
- - End Of File - - 79ECCDD74DF8B774B2041DC386A2FDC0

Ještě dočiastíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files (x86)\MyBrowserCash

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813507152-3011710665-1745928197-1000UA.job

Registry::
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1630669F-9D0C-4F0B-8AA9-10DE8BEE1755}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyBrowserCash"=-

Firefox::
FF - ProfilePath - c:\users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\mgbpwlgq.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?babsrc=HP_ss ... ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.id - 4490361000000000000000ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.hardId - 4490361000000000000000ff6c3c22a2
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15433
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1712:51
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111015
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CE Services]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Ok, díky, udělal jsem to tak... Snad takhle pročištěný to už stačí

Problém byl vyřešen?

Zdá se že ano, děkuji

Nemáte zač!