VIRY.CZ

Zdravím, prosím o pomoc s odstraněním tohoto viru který vznikl otevřením odkazu na skype.
Díky moc!
Přikládám log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Uživatel at 2012-10-08 14:13:51
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 91 GB (38%) free of 238 GB
Total RAM: 2012 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:13:56, on 8.10.2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: TBSB02843 - {22E4A387-EBFC-442B-B46A-4E7957176FE0} - C:\Program Files\Facicons\tbcore3.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Uživatel\AppData\Local\Akamai\netsession_win.exe"
O4 - HKUS\S-1-5-18\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Application Updater - Unknown owner - C:\Program Files\Application Updater\ApplicationUpdater.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 10188 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{20a82645-c095-46ed-80e3-08825760534b}:1.1, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, dealio@mybrowserbar.com:4.4, wtxpcom@mybrowserbar.com:4.4, wrc@avast.com:20110101, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
prefs.js - "keyword.URL" - "http://websearch.ask.com/redirect?clien ... YYYYCZ&&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"{4B3803EA-5230-4DC3-A7FC-33638F3D3542}"=C:\PROGRA~1\Crawler\firefox\
"{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.7.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ngm.nexoneu.com/NxGame]
"Description"=Nexon Game Controller
"Path"=C:\ProgramData\NexonEU\NGM\npNxGameeu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
npijjiFFPlugin1.xpt

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npijjiFFPlugin1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\extensions\
jid1-uabu5A9hduqzCw@jetpack
toolbar@ask.com
{2458abc0-f443-11dd-87af-0800200c9a66}
{5e5ab302-7f65-44cd-8211-c1d4caaccea3}

C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-03-26 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22E4A387-EBFC-442B-B46A-4E7957176FE0}]
TBSB02843 Class - C:\Program Files\Facicons\tbcore3.dll [2010-06-18 2604032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-01 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-06-06 1519304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-01 157672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-06-06 1519304]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-08-18 7711264]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"ApnUpdater"=C:\Program Files\Ask.com\Updater\Updater.exe [2012-06-06 1564872]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-03-27 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-02-16 500208]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"SearchSettings"=C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe []
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-07-03 462920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"Akamai NetSession Interface"=C:\Users\Uživatel\AppData\Local\Akamai\netsession_win.exe [2012-08-10 4440896]

C:\Users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"
"C:\Users\Uživatel\Desktop\P17535732.JPG-www.facebook.exe"="C:\Windows\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe"="C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Downloader_Engine.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"VIDC.FPS1"=frapsvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.ACDV"=ACDV.dll
"msacm.lhacm"=lhacm.acm
"msacm.siren"=sirenacm.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2012-10-08 14:06:33 ----D---- C:\Program Files\trend micro
2012-10-08 14:06:32 ----DC---- C:\rsit
2012-10-08 13:56:11 ----D---- C:\Users\Uživatel\AppData\Roaming\Malwarebytes
2012-10-08 13:56:05 ----D---- C:\ProgramData\Malwarebytes
2012-10-08 13:56:04 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-10-08 13:56:04 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-10-08 13:02:55 ----SDC---- C:\32788R22FWJFW
2012-10-07 17:25:15 ----A---- C:\Windows\system32\FntCache.dll
2012-10-07 17:25:14 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2012-10-07 17:25:05 ----A---- C:\Windows\system32\gameux.dll
2012-10-07 17:25:03 ----A---- C:\Windows\system32\Apphlpdm.dll
2012-10-07 17:25:01 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2012-10-07 17:24:53 ----A---- C:\Windows\system32\kernel32.dll
2012-10-07 17:22:50 ----A---- C:\Windows\system32\xmllite.dll
2012-10-07 17:05:30 ----A---- C:\Windows\system32\psisdecd.dll
2012-10-07 17:05:27 ----A---- C:\Windows\system32\winmm.dll
2012-10-07 17:05:26 ----A---- C:\Windows\system32\mciseq.dll
2012-10-07 17:05:20 ----A---- C:\Windows\system32\odbc32.dll
2012-10-07 16:55:24 ----D---- C:\Program Files\MSECache
2012-10-07 16:08:44 ----A---- C:\Windows\system32\wmi.dll
2012-10-07 16:08:44 ----A---- C:\Windows\system32\wintrust.dll
2012-10-07 16:08:44 ----A---- C:\Windows\system32\imagehlp.dll
2012-10-07 16:08:44 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-10-07 16:00:25 ----A---- C:\Windows\system32\win32k.sys
2012-10-07 15:59:38 ----A---- C:\Windows\system32\wininet.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\urlmon.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\url.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2012-10-07 15:59:38 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2012-10-07 15:59:38 ----A---- C:\Windows\system32\msrating.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\msls31.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\mshtmler.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\jsproxy.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\ieui.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\iesysprep.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\iesetup.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\iertutil.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\iernonce.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\ieframe.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\ieapfltr.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\ieapfltr.dat
2012-10-07 15:59:38 ----A---- C:\Windows\system32\ie4uinit.exe
2012-10-07 15:59:38 ----A---- C:\Windows\system32\icardie.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\dxtrans.dll
2012-10-07 15:59:38 ----A---- C:\Windows\system32\dxtmsft.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\wextract.exe
2012-10-07 15:59:37 ----A---- C:\Windows\system32\webcheck.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\vbscript.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\pngfilt.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\occache.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\mshtmled.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\mshtml.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\mshta.exe
2012-10-07 15:59:37 ----A---- C:\Windows\system32\msfeedssync.exe
2012-10-07 15:59:37 ----A---- C:\Windows\system32\msfeedsbs.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\msfeeds.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\licmgr10.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\jscript9.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\jscript.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\inseng.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\imgutil.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\iexpress.exe
2012-10-07 15:59:37 ----A---- C:\Windows\system32\ieUnatt.exe
2012-10-07 15:59:37 ----A---- C:\Windows\system32\iepeers.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\iedkcs32.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\ieakui.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\ieaksie.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\ieakeng.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\IEAdvpack.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\advpack.dll
2012-10-07 15:59:37 ----A---- C:\Windows\system32\admparse.dll
2012-10-07 15:58:43 ----A---- C:\Windows\system32\MFHEAACdec.dll
2012-10-07 15:58:43 ----A---- C:\Windows\system32\MFH264Dec.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\stobject.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\shdocvw.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\mfreadwrite.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\mfps.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\mfplat.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\mfmp4src.dll
2012-10-07 15:58:42 ----A---- C:\Windows\system32\mf.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\XpsRasterService.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2012-10-07 15:58:41 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\dxgi.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2012-10-07 15:58:41 ----A---- C:\Windows\system32\d3d10level9.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\d3d10core.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\d3d10.dll
2012-10-07 15:58:41 ----A---- C:\Windows\system32\cdd.dll
2012-10-07 15:58:40 ----A---- C:\Windows\system32\xpsservices.dll
2012-10-07 15:58:40 ----A---- C:\Windows\system32\XpsPrint.dll
2012-10-07 15:58:40 ----A---- C:\Windows\system32\OpcServices.dll
2012-10-07 15:36:18 ----A---- C:\Windows\system32\atmfd.dll
2012-10-07 15:36:17 ----A---- C:\Windows\system32\fontsub.dll
2012-10-07 15:36:16 ----A---- C:\Windows\system32\atmlib.dll
2012-10-07 15:35:39 ----A---- C:\Windows\system32\localspl.dll
2012-10-07 15:35:19 ----A---- C:\Windows\system32\mfc42u.dll
2012-10-07 15:35:18 ----A---- C:\Windows\system32\mfc42.dll
2012-10-07 15:34:57 ----A---- C:\Windows\system32\crypt32.dll
2012-10-07 15:34:56 ----A---- C:\Windows\system32\cryptsvc.dll
2012-10-07 15:34:56 ----A---- C:\Windows\system32\cryptnet.dll
2012-10-07 15:34:25 ----A---- C:\Windows\system32\drivers\bowser.sys
2012-10-07 15:34:04 ----A---- C:\Windows\system32\drivers\dfsc.sys
2012-10-07 15:33:56 ----A---- C:\Windows\system32\drivers\srv.sys
2012-10-07 15:33:49 ----A---- C:\Windows\system32\ntdll.dll
2012-10-07 15:33:45 ----A---- C:\Windows\system32\netapi32.dll
2012-10-07 15:33:40 ----A---- C:\Windows\system32\iphlpsvc.dll
2012-10-07 15:33:40 ----A---- C:\Windows\system32\drivers\tunnel.sys
2012-10-07 15:31:01 ----A---- C:\Windows\system32\shsvcs.dll
2012-10-07 15:30:32 ----A---- C:\Windows\system32\UIAutomationCore.dll
2012-10-07 15:30:32 ----A---- C:\Windows\system32\oleaut32.dll
2012-10-07 15:30:32 ----A---- C:\Windows\system32\oleacc.dll
2012-10-07 15:30:31 ----A---- C:\Windows\system32\oleaccrc.dll
2012-10-07 15:28:39 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-10-07 15:28:35 ----A---- C:\Windows\system32\msxml6.dll
2012-10-07 15:28:34 ----A---- C:\Windows\system32\msxml3.dll
2012-10-07 15:28:31 ----A---- C:\Windows\system32\drivers\srvnet.sys
2012-10-07 15:28:31 ----A---- C:\Windows\system32\drivers\srv2.sys
2012-10-07 15:28:25 ----A---- C:\Windows\system32\taskschd.dll
2012-10-07 15:28:25 ----A---- C:\Windows\system32\schedsvc.dll
2012-10-07 15:28:24 ----A---- C:\Windows\system32\wmicmiplugin.dll
2012-10-07 15:28:24 ----A---- C:\Windows\system32\taskeng.exe
2012-10-07 15:28:24 ----A---- C:\Windows\system32\taskcomp.dll
2012-10-07 15:28:10 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-10-07 15:27:40 ----A---- C:\Windows\system32\drivers\afd.sys
2012-10-07 15:27:26 ----A---- C:\Windows\system32\shell32.dll
2012-10-07 15:27:19 ----A---- C:\Windows\system32\EncDec.dll
2012-10-07 15:27:17 ----A---- C:\Windows\system32\inetcomm.dll
2012-10-07 15:27:16 ----A---- C:\Windows\system32\consent.exe
2012-10-07 15:27:14 ----A---- C:\Windows\system32\sdclt.exe
2012-10-07 15:27:11 ----A---- C:\Windows\system32\dnsrslvr.dll
2012-10-07 15:27:11 ----A---- C:\Windows\system32\dnsapi.dll
2012-10-07 15:27:10 ----A---- C:\Windows\system32\dnscacheugc.exe
2012-10-07 15:27:09 ----A---- C:\Windows\system32\msvcrt.dll
2012-10-07 15:27:04 ----A---- C:\Windows\system32\tzres.dll
2012-10-07 15:26:34 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-10-07 15:26:34 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-10-07 15:26:27 ----A---- C:\Windows\system32\shlwapi.dll
2012-10-07 15:26:25 ----A---- C:\Windows\system32\quartz.dll
2012-10-07 15:26:25 ----A---- C:\Windows\system32\qdvd.dll
2012-10-07 15:25:53 ----A---- C:\Windows\system32\winhttp.dll
2012-10-07 15:25:51 ----A---- C:\Windows\system32\DWrite.dll
2012-10-07 15:25:51 ----A---- C:\Windows\system32\d3d10_1core.dll
2012-10-07 15:25:51 ----A---- C:\Windows\system32\d3d10_1.dll
2012-10-07 15:25:51 ----A---- C:\Windows\system32\d2d1.dll
2012-10-07 15:25:50 ----A---- C:\Windows\system32\d3d10warp.dll
2012-10-07 15:25:48 ----A---- C:\Windows\system32\mstscax.dll
2012-10-07 15:25:47 ----A---- C:\Windows\system32\mstsc.exe
2012-10-07 15:25:45 ----A---- C:\Windows\system32\drivers\partmgr.sys
2012-10-07 15:25:41 ----A---- C:\Windows\system32\sbeio.dll
2012-10-07 15:25:41 ----A---- C:\Windows\system32\sbe.dll
2012-10-07 15:25:38 ----A---- C:\Windows\system32\csrsrv.dll
2012-10-07 15:25:35 ----A---- C:\Windows\system32\rdpencom.dll
2012-10-07 15:25:33 ----A---- C:\Windows\system32\packager.dll
2012-10-07 15:25:28 ----A---- C:\Windows\system32\winsrv.dll
2012-10-07 15:25:24 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2012-10-07 15:25:24 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2012-10-07 15:25:24 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2012-10-07 15:16:32 ----A---- C:\Windows\system32\schannel.dll
2012-10-07 15:16:32 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-10-07 15:16:31 ----A---- C:\Windows\system32\secur32.dll
2012-10-07 15:16:31 ----A---- C:\Windows\system32\ncrypt.dll
2012-10-07 15:16:31 ----A---- C:\Windows\system32\lsass.exe
2012-10-07 15:16:31 ----A---- C:\Windows\system32\lsasrv.dll
2012-10-07 15:11:14 ----A---- C:\Users\Uživatel\AppData\Roaming\1DAE.exe
2012-10-07 15:05:06 ----A---- C:\Windows\system32\wups2.dll
2012-10-07 15:05:06 ----A---- C:\Windows\system32\wucltux.dll
2012-10-07 15:05:06 ----A---- C:\Windows\system32\wuaueng.dll
2012-10-07 15:05:06 ----A---- C:\Windows\system32\wuauclt.exe
2012-10-07 15:01:26 ----A---- C:\Users\Uživatel\AppData\Roaming\1B5C.exe
2012-10-07 00:58:16 ----A---- C:\Windows\system32\wups.dll
2012-10-07 00:58:16 ----A---- C:\Windows\system32\wudriver.dll
2012-10-07 00:58:16 ----A---- C:\Windows\system32\wuapi.dll
2012-10-07 00:58:00 ----A---- C:\Windows\system32\wuwebv.dll
2012-10-07 00:58:00 ----A---- C:\Windows\system32\wuapp.exe
2012-10-07 00:49:58 ----A---- C:\Windows\wininit.ini
2012-10-07 00:42:53 ----A---- C:\Users\Uživatel\AppData\Roaming\91F3.exe
2012-10-07 00:42:25 ----A---- C:\Users\Uživatel\AppData\Roaming\2422.exe
2012-10-06 23:58:16 ----A---- C:\Users\Uživatel\AppData\Roaming\BA27.exe
2012-10-06 23:51:07 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-10-06 23:43:35 ----A---- C:\Users\Uživatel\AppData\Roaming\49E4.exe
2012-10-06 23:40:13 ----A---- C:\Users\Uživatel\AppData\Roaming\3451.exe
2012-10-06 23:39:31 ----D---- C:\Windows\temp
2012-10-06 23:39:30 ----AC---- C:\ComboFix.txt
2012-10-06 23:08:02 ----D---- C:\Windows\erdnt
2012-10-04 21:28:58 ----D---- C:\Program Files\Metin2
2012-09-26 15:43:51 ----D---- C:\Program Files\LaRoXion MT2

======List of files/folders modified in the last 1 month======

2012-10-08 14:13:12 ----D---- C:\Windows\Prefetch
2012-10-08 14:12:10 ----D---- C:\Windows\system32\drivers
2012-10-08 14:06:33 ----RD---- C:\Program Files
2012-10-08 13:56:05 ----D---- C:\ProgramData
2012-10-08 13:40:31 ----D---- C:\Windows
2012-10-08 13:37:21 ----SD---- C:\ProgramData\Microsoft
2012-10-08 13:03:14 ----D---- C:\Windows\System32
2012-10-08 13:03:14 ----D---- C:\Windows\inf
2012-10-08 13:03:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-10-08 13:02:38 ----D---- C:\Windows\system32\Tasks
2012-10-08 12:56:55 ----D---- C:\Windows\system32\catroot
2012-10-08 12:56:53 ----D---- C:\Windows\winsxs
2012-10-08 12:52:34 ----D---- C:\Program Files\Common Files\Akamai
2012-10-08 11:17:31 ----SHD---- C:\System Volume Information
2012-10-08 07:54:14 ----D---- C:\Windows\tracing
2012-10-07 23:47:39 ----RSD---- C:\Windows\assembly
2012-10-07 23:47:39 ----D---- C:\Windows\Microsoft.NET
2012-10-07 18:08:38 ----D---- C:\Windows\rescache
2012-10-07 17:51:38 ----D---- C:\Windows\system32\catroot2
2012-10-07 17:49:11 ----RSD---- C:\Windows\Fonts
2012-10-07 17:49:11 ----D---- C:\Windows\AppPatch
2012-10-07 17:49:11 ----D---- C:\Program Files\Windows Mail
2012-10-07 17:47:04 ----SHD---- C:\Windows\Installer
2012-10-07 16:56:13 ----D---- C:\Program Files\Common Files\microsoft shared
2012-10-07 16:56:03 ----D---- C:\Program Files\Microsoft Office
2012-10-07 16:31:03 ----HD---- C:\Windows\system32\GroupPolicy
2012-10-07 16:21:50 ----D---- C:\Windows\system32\cs-CZ
2012-10-07 16:21:46 ----D---- C:\Program Files\Windows Journal
2012-10-07 16:21:44 ----RD---- C:\Windows\Offline Web Pages
2012-10-07 16:21:44 ----D---- C:\Windows\system32\wbem
2012-10-07 16:21:44 ----D---- C:\Windows\system32\migration
2012-10-07 16:21:44 ----D---- C:\Windows\system32\en-US
2012-10-07 16:21:44 ----D---- C:\Windows\PolicyDefinitions
2012-10-07 16:21:44 ----D---- C:\Program Files\Internet Explorer
2012-10-07 16:21:42 ----SD---- C:\Windows\Downloaded Program Files
2012-10-07 16:21:38 ----D---- C:\Windows\ehome
2012-10-07 16:21:35 ----D---- C:\Program Files\Common Files\System
2012-10-07 16:04:32 ----D---- C:\Windows\Debug
2012-10-07 15:59:57 ----D---- C:\Windows\Logs
2012-10-07 15:46:46 ----D---- C:\Windows\system32\XPSViewer
2012-10-07 15:37:16 ----D---- C:\Windows\Tasks
2012-10-07 15:36:05 ----D---- C:\Program Files\Common Files
2012-10-07 15:36:04 ----D---- C:\ProgramData\Skype
2012-10-06 23:38:13 ----AC---- C:\Windows\system.ini
2012-10-06 23:38:08 ----D---- C:\Windows\system32\drivers\etc
2012-10-06 23:14:19 ----AD---- C:\ProgramData\TEMP
2012-09-26 15:15:30 ----HD---- C:\Program Files\InstallShield Installation Information
2012-09-26 15:14:23 ----D---- C:\Program Files\Microsoft Games
2012-09-26 14:32:55 ----D---- C:\Users\Uživatel\AppData\Roaming\LaRoXion
2012-09-20 21:21:09 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-09-20 16:08:19 ----A---- C:\Windows\NeroDigital.ini
2012-09-09 05:22:32 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 prohlp02;StarForce Protection Helper Driver v2; C:\Windows\System32\drivers\prohlp02.sys [2004-05-13 111808]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\Windows\System32\drivers\prosync1.sys [2003-09-06 6944]
R0 sfhlp01;StarForce Protection Helper Driver; C:\Windows\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2012-08-21 35928]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2012-08-21 729752]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2012-08-21 355632]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2012-08-21 54232]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\Windows\System32\drivers\prodrv06.sys [2004-05-13 79488]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2012-08-21 21256]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2012-08-21 58680]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-08-18 2752352]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x86.sys [2009-08-05 48640]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-18 7680]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 catchme;catchme; \??\C:\Users\UIVATE~1\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 EagleXNt;EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-03-08 39272]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-10 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340); C:\Windows\system32\drivers\WPRO_40_1340.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Akamai;Akamai NetSession Interface; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2012-08-21 44808]
R2 ezGOSvc;Easybits GO Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\BingBar\SeaPort.EXE [2011-03-28 249648]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 1713536]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S2 Application Updater;Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-02-25 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-20 250288]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 BBSvc;Bing Bar Update Service; C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2012-03-08 1492840]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-02-25 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2010-12-15 3994768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WPFFontCache_v0400;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------

Zdravím.


Stáhni RKill z tohoto odkazu - http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havěť blokuje, použij jeden z následujících (i ty přejmenované):
  • RKill EXE - http://download.bleepingcomputer.com/grinler/rkill.exe
    RKill iExplore.exe - http://download.bleepingcomputer.com/gr ... xplore.exe
    RKill uSeRiNiT.exe - http://download.bleepingcomputer.com/gr ... eRiNiT.exe
    RKill WiNlOgOn.exe - http://download.bleepingcomputer.com/gr ... NlOgOn.exe
• Utilitu ulož nejlépe na Plochu a ukonči všechny aplikace (jinak to RKill udělá za Tebe)!
• Spusť dvojklikem - program proběhne téměř okamžitě a ukončí i svou činnost.
• RKill ukončí všechny nesystémové procesy - tedy i procesy, pod kterými běží havěť.
• Na Ploše vznikne log RKill.txt - ten mi sem vlož.
• TEĎ NERESTARTUJ PC - přišel bys o účinek RKillu!!

PROSÍM, ČTI NÁVOD DŮKLADNĚ - TATO UTILITA MÁ VELKOU SCHOPNOST MAZAT A JE NUTNÉ JI APLIKOVAT JEN NA DOPORUČENÍ RÁDCE TOHOTO FÓRA, JINAK TI MŮŽE JÍT SYSTÉM DO KYTEK
Stáhni a ulož na Plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypni všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary apod.
• Vypni všechny běžící aplikace - ICQ, Skype, browsery, prostě všechny programy, ať běží pouze ComboFix.
• Pokud máš operační systém Windows XP, spusť pod účtem Správce/Administrator.
• Pokud máš operační systém Windows Vista či Windows 7, klikni na ComboFix pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Ihned po startu se zobrazí stránka s licenčním ujednáním - pokračuj kliknutím na [Ano].
• Pokud Ti ComboFix nabídne instalaci Konzoly pro zotavení, tak souhlas.
• Dále postupuj dle pokynů. Během scanu nech PC naprosto v klidu - nespouštěj žádné aplikace a neklikej do zobrazujícího se okna!
• Scan by měl trvat cca 10 min, ale pokud bude PC hodne zaneseno, může se čas samozřejmě prodloužit.
• Po dokončení scanu a případném restartu ComboFix zobrazí log, který případně najdeš v C:\ComboFix.txt. Jeho obsah mi sem vlož.
• Detailní postup včetně obrázků najdeš zde: http://www.bleepingcomputer.com/combofi ... t-combofix

Díky za reakci

zde je log Rkill:
Rkill 2.4.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 10/08/2012 03:33:04 PM in x86 mode.
Windows Version: Windows Vista (TM) Home Premium Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

* msiserver => %systemroot%\system32\msiexec.exe /V [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 10/08/2012 03:33:12 PM
Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s)

a zde z Combofix:

ComboFix 12-10-08.01 - Uživatel 08.10.2012 15:39:23.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2012.1144 [GMT 2:00]
Spuštěný z: c:\users\U×ivatel\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Uživatel\AppData\Roaming\1DAE.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-08 do 2012-10-08 )))))))))))))))))))))))))))))))
.
.
2012-10-08 13:45 . 2012-10-08 13:45 -------- d-----w- c:\users\Uživatel\AppData\Local\temp
2012-10-08 13:45 . 2012-10-08 13:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-08 12:06 . 2012-10-08 12:13 -------- d-----w- c:\program files\trend micro
2012-10-08 12:06 . 2012-10-08 12:06 -------- dc----w- C:\rsit
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\users\Uživatel\AppData\Roaming\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-08 11:56 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-07 15:25 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-10-07 15:25 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-10-07 15:25 . 2010-08-26 16:34 1696256 ----a-w- c:\windows\system32\gameux.dll
2012-10-07 15:25 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2012-10-07 15:25 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2012-10-07 15:24 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-10-07 15:05 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2012-10-07 15:05 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
2012-10-07 15:05 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-10-07 15:05 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-10-07 15:05 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll
2012-10-07 15:05 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll
2012-10-07 15:05 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-10-07 15:05 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2012-10-07 15:05 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-10-07 15:05 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2012-10-07 15:05 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-10-07 14:55 . 2012-10-07 14:55 -------- d-----w- c:\program files\MSECache
2012-10-07 14:50 . 2012-10-07 14:50 -------- d-----w- c:\users\Uživatel\AppData\Local\ElevatedDiagnostics
2012-10-07 14:37 . 2012-09-18 22:59 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{48EEEE5B-8489-44DC-900D-EFFE140EDD9C}\mpengine.dll
2012-10-07 14:08 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-10-07 14:08 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-10-07 14:08 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-10-07 14:08 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-10-07 14:00 . 2012-07-04 14:02 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-10-07 13:58 . 2012-10-07 13:58 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-10-07 13:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2012-10-07 13:36 . 2010-06-16 15:30 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-10-07 13:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-10-07 13:35 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll
2012-10-07 13:35 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2012-10-07 13:35 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2012-10-07 13:34 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-10-07 13:34 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-07 13:34 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-07 13:34 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-10-07 13:34 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2012-10-07 13:34 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2012-10-07 13:34 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2012-10-07 13:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-10-07 13:33 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2012-10-07 13:33 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll
2012-10-07 13:33 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-07 13:33 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2012-10-07 13:30 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2012-10-07 13:30 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
2012-10-07 13:30 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
2012-10-07 13:30 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2012-10-07 13:28 . 2012-03-30 12:39 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-07 13:28 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-10-07 13:28 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-10-07 13:28 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-10-07 13:28 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-10-07 13:28 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2012-10-07 13:28 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2012-10-07 13:28 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-10-07 13:28 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2012-10-07 13:28 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2012-10-07 13:28 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-10-07 13:28 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-10-07 13:26 . 2012-04-03 08:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-07 13:26 . 2012-04-03 08:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-10-07 13:26 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2012-10-07 13:26 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll
2012-10-07 13:16 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-10-07 13:16 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
2012-10-07 13:16 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-10-07 13:16 . 2011-11-16 16:23 72704 ----a-w- c:\windows\system32\secur32.dll
2012-10-07 13:16 . 2011-11-16 16:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2012-10-07 13:16 . 2011-11-16 14:12 9728 ----a-w- c:\windows\system32\lsass.exe
2012-10-07 13:05 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-10-07 13:05 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-10-07 13:05 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-10-07 13:05 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-10-06 22:58 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-10-06 22:58 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-10-06 22:58 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-10-06 22:58 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-10-06 22:58 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-10-06 21:51 . 2012-10-07 13:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-10-04 19:28 . 2012-10-04 19:38 -------- d-----w- c:\program files\Metin2
2012-09-26 13:43 . 2012-10-08 13:01 -------- d-----w- c:\program files\LaRoXion MT2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-20 19:21 . 2012-04-10 20:12 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-20 19:21 . 2011-05-18 12:18 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-01 11:31 . 2012-09-01 11:31 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-01 11:30 . 2012-05-12 13:38 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-01 11:30 . 2010-10-29 21:04 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-21 09:13 . 2011-04-11 21:27 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2011-01-09 12:44 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2011-01-09 12:44 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2011-01-09 12:44 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2011-01-09 12:44 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2011-01-09 12:44 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-01-28 17:42 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2011-01-09 12:43 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-26 21:11 . 2011-03-28 16:36 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-09-08 10:27 . 2012-09-08 10:27 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22E4A387-EBFC-442B-B46A-4E7957176FE0}]
2010-06-18 16:01 2604032 ------w- c:\program files\Facicons\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-06 19:33 1519304 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Akamai NetSession Interface"="c:\users\Uživatel\AppData\Local\Akamai\netsession_win.exe" [2012-08-10 4440896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-06-06 1564872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-02-16 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
c:\users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3597898428-2883692351-2398126780-1000]
"EnableNotificationsRef"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezGOSvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-10-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:21]
.
2012-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 16:41]
.
2012-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 16:41]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: ????3?? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=en_EU&apn_uid=9D8E4926-1B5B-408B-86A9-76F2DF388FC2&apn_ptnrs=FV&apn_sauid=653134C8-9433-4E13-8522-B66D266E491E&apn_dtid=YYYYYYYYCZ&&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-08 15:45
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_5891ae0.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.032"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.abr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ani"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.apd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.arw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.bay"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Bitmap"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.bw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.cr2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.crw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.cs1"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.cur"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.dib"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.djv"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.djvu"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.dng"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.emf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.eps"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.erf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.fff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.fpx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Gif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.hdr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.icl"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.icn"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.iff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ilbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.int"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.inta"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.iw4"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.j2c"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.j2k"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jbr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jp2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpe"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jpk"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jpx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.kdc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.lbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.mef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.mos"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.mrw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.nef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.nrw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.orf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pbr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pcd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pct"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pcx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pgm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pict"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pix"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Png"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.ppm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.psd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.psp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pspbrush"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.raf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ras"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.raw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rgb"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rgba"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rle"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rsb"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rw2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rwl"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.sgi"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.sr2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.srf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.tga"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.thm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Tiff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Tiff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ttc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ttf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30po"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30pp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30ppf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wmf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xmp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xpm"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2012-10-08 15:46:55
ComboFix-quarantined-files.txt 2012-10-08 13:46
ComboFix2.txt 2012-10-06 21:39
.
Před spuštěním: Volných bajtů: 95 466 082 304
Po spuštění: Volných bajtů: 95 505 059 840
.
- - End Of File - - 17476B7C017435A7FF81E9A2EADA799C

Teď na to koukám... Tys spouštěl ComboFix ještě před mým doporučením?!

Pokud je tam najdeš, tak v nabídce Přidat nebo odebrat programy odinstaluj tyto toolbary:

• Ask Toolbar, Bing Bar a &Crawler lišta.

Toolbary (lišty prohlížečů) jsou veliká "zdržovadla" systému a v případě například Ask.com Toolbar, Conduit Engine a dalších se dá hovořit už i o havěti.

Dále odinstaluj Akamai NetSession Interface.


Pokud jsi tak ještě neučinil, přesuň ComboFix na Plochu.

• Otevři si Poznámkový blok (Start >> Spustit... (nebo Win+R) >> do okénka napiš notepad >> [Enter]).
• Zkopíruj do něj tento script (pouze zelená písmenka v bílém poli!):

• Ulož vytvořený TXT jako CFScript.txt
• Přetáhni vytvořený CFScript.txt nad ComboFix a pusť (viz obrázek).
  
• Po aplikaci scriptu (a případném restartu PC) na Tebe vyskočí log. Jeho obsah mi sem vlož.

Může se stát, že po aplikaci scriptu nenaběhnou Windows. V tom případě restartuj PC, hned při náběhu mačkej klávesu F8 a zvol Poslední známou konfiguraci.

Tak snad jsem systém dřívějším spuštěním Combofixu ještě vice neponičil.

Zde je log:

ComboFix 12-10-08.01 - Uživatel 09.10.2012 8:21.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2012.968 [GMT 2:00]
Spuštěný z: c:\users\U×ivatel\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\U×ivatel\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-09 do 2012-10-09 )))))))))))))))))))))))))))))))
.
.
2012-10-09 06:26 . 2012-10-09 06:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-08 13:46 . 2012-10-09 06:26 -------- d-----w- c:\users\Uživatel\AppData\Local\temp
2012-10-08 12:06 . 2012-10-08 12:13 -------- d-----w- c:\program files\trend micro
2012-10-08 12:06 . 2012-10-08 12:06 -------- dc----w- C:\rsit
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\users\Uživatel\AppData\Roaming\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-08 11:56 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-08 10:57 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2012-10-07 15:25 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-10-07 15:25 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-10-07 15:25 . 2010-08-26 16:34 1696256 ----a-w- c:\windows\system32\gameux.dll
2012-10-07 15:25 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2012-10-07 15:25 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2012-10-07 15:24 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-10-07 15:05 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2012-10-07 15:05 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
2012-10-07 15:05 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-10-07 15:05 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-10-07 15:05 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll
2012-10-07 15:05 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll
2012-10-07 15:05 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-10-07 15:05 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2012-10-07 15:05 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-10-07 15:05 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2012-10-07 15:05 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-10-07 14:55 . 2012-10-07 14:55 -------- d-----w- c:\program files\MSECache
2012-10-07 14:50 . 2012-10-07 14:50 -------- d-----w- c:\users\Uživatel\AppData\Local\ElevatedDiagnostics
2012-10-07 14:37 . 2012-09-18 22:59 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{48EEEE5B-8489-44DC-900D-EFFE140EDD9C}\mpengine.dll
2012-10-07 14:08 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-10-07 14:08 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-10-07 14:08 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-10-07 14:08 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-10-07 14:00 . 2012-07-04 14:02 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-10-07 13:58 . 2012-10-07 13:58 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-10-07 13:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2012-10-07 13:36 . 2010-06-16 15:30 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-10-07 13:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-10-07 13:35 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll
2012-10-07 13:35 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2012-10-07 13:35 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2012-10-07 13:34 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-10-07 13:34 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-07 13:34 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-07 13:34 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-10-07 13:34 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2012-10-07 13:34 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2012-10-07 13:34 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2012-10-07 13:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-10-07 13:33 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2012-10-07 13:33 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll
2012-10-07 13:33 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-07 13:33 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2012-10-07 13:30 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2012-10-07 13:30 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
2012-10-07 13:30 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
2012-10-07 13:30 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2012-10-07 13:28 . 2012-03-30 12:39 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-07 13:28 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-10-07 13:28 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-10-07 13:28 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-10-07 13:28 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-10-07 13:28 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2012-10-07 13:28 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2012-10-07 13:28 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-10-07 13:28 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2012-10-07 13:28 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2012-10-07 13:28 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-10-07 13:28 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-10-07 13:26 . 2012-04-03 08:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-07 13:26 . 2012-04-03 08:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-10-07 13:26 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2012-10-07 13:26 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll
2012-10-07 13:16 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-10-07 13:16 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
2012-10-07 13:16 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-10-07 13:16 . 2011-11-16 16:23 72704 ----a-w- c:\windows\system32\secur32.dll
2012-10-07 13:16 . 2011-11-16 16:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2012-10-07 13:16 . 2011-11-16 14:12 9728 ----a-w- c:\windows\system32\lsass.exe
2012-10-07 13:05 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-10-07 13:05 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-10-07 13:05 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-10-07 13:05 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-10-06 22:58 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-10-06 22:58 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-10-06 22:58 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-10-06 22:58 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-10-06 22:58 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-10-06 21:51 . 2012-10-07 13:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-10-04 19:28 . 2012-10-04 19:38 -------- d-----w- c:\program files\Metin2
2012-09-26 13:43 . 2012-10-08 13:01 -------- d-----w- c:\program files\LaRoXion MT2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-20 19:21 . 2012-04-10 20:12 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-20 19:21 . 2011-05-18 12:18 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-01 11:31 . 2012-09-01 11:31 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-01 11:30 . 2012-05-12 13:38 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-01 11:30 . 2010-10-29 21:04 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-21 09:13 . 2011-04-11 21:27 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2011-01-09 12:44 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2011-01-09 12:44 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2011-01-09 12:44 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2011-01-09 12:44 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2011-01-09 12:44 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-01-28 17:42 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2011-01-09 12:43 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-26 21:11 . 2011-03-28 16:36 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-09-08 10:27 . 2012-09-08 10:27 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22E4A387-EBFC-442B-B46A-4E7957176FE0}]
2010-06-18 16:01 2604032 ------w- c:\program files\Facicons\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-02-16 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
c:\users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3597898428-2883692351-2398126780-1000]
"EnableNotificationsRef"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezGOSvc
.
Obsah adresáře 'Naplánované úlohy'
.
2012-10-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:21]
.
2012-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 16:41]
.
2012-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 16:41]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: ????3?? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=672991&p=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Akamai NetSession Interface - c:\users\Uživatel\AppData\Local\Akamai\netsession_win.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-09 08:26
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.032"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.abr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ani"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.apd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.arw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.bay"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Bitmap"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.bw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.cr2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.crw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.cs1"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.cur"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.dib"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.djv"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.djvu"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.dng"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.emf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.eps"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.erf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.fff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.fpx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Gif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.hdr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.icl"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.icn"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.iff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ilbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.int"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.inta"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.iw4"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.j2c"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.j2k"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jbr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jp2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpe"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jpk"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jpx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.kdc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.lbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.mef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.mos"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.mrw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.nef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.nrw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.orf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pbr"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pcd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pct"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pcx"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pef"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pgm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pict"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pix"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Png"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.ppm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.psd"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.psp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pspbrush"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.raf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ras"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.raw"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rgb"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rgba"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rle"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.rsb"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rw2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.rwl"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.sgi"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.sr2"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.srf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.tga"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.thm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Tiff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Tiff"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ttc"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.ttf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30po"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30pp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.v30ppf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (S-1-5-21-3597898428-2883692351-2398126780-1000)
@Denied: (2) (LocalSystem)
"Progid"="ZPS140.Document.wmf"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xbm"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xmp"
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xpm"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2012-10-09 08:28:12
ComboFix-quarantined-files.txt 2012-10-09 06:28
ComboFix2.txt 2012-10-08 13:46
ComboFix3.txt 2012-10-06 21:39
.
Před spuštěním: Volných bajtů: 129 461 276 672
Po spuštění: Volných bajtů: 129 461 186 560
.
- - End Of File - - 55D982E81167E28117F64A9B26A1BD46

Co se týče ComboFixu, tak na základě licence a pravidel fóra se ptám - umíš s ním pracovat (spuštění, rozluštění logu, sestavení opravného scriptu, případně vrácení nechtěných výmazů a oprav)?

Licenční podmínky hovoří jasně: "Nikdy by neměl být použit v prostředí bez dozoru zkušené osoby".


Nebezpečí CFka:

• Tento program je určen primárně pro rádce - jeho svévolným použitím ztrácíš nárok na podporu!
• Maže stopy po havěti, takže v logu ze RSITu není potom nic vidět!
• Jeho log je třeba doluštit, jelikož neumí smazat vše - to ovšem těžko zvládneš, pokud k tomu nejsi vyškolen!
• CF může mít bug - sundá Ti systém a pokud nevíš, kam co ukládá a jak co obnovit, máš systém v kytkách a čeká Tě reinstall!
• CF taky bohužel prozatím nekontroluje některé důležité knihovny (např. hal.dll) - ty mažou kupříkladu některé typy havěti (Angela a další) - smaže Ti po restartu hal.dll = nenajede Ti systém a jsi o řádek výše = reinstall!

K opravě: Script se neaplikoval. Je to proto, že máš název počítače Uživatel a ComboFix si neumí poradit s češtinou:

Spuštěný z: c:\users\U×ivatel\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\U×ivatel\Desktop\CFScript.txt

Poprosím Tě tedy, abys jak ComboFix, tak i mnou napsaný script přesunul do kořenového adresáře C:\.
Bude to tedy vypadat takto: C:\ComboFix.exe a C:\CFScript.txt - v kořenovém adresáři aplikuj můj script ještě jednou.

Předchiozí log mi přišel stejný jako ten první. Tak snad už se skript aplikoval. Jinak s Combofixem pracuji jen když mě o to požádá rádce zde na foru. Bohužel teď jsem viděl v odpovědi i návod na combofix a nechal PC projet i jím.

Zde je log:

ComboFix 12-10-08.03 - Uživatel 09.10.2012 11:00:39.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2012.992 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\Facicons\tbcore3.dll"
"c:\users\Uživatel\AppData\Roaming\2422.exe"
"c:\users\Uživatel\AppData\Roaming\3451.exe"
"c:\users\Uživatel\AppData\Roaming\49E4.exe"
"c:\users\Uživatel\AppData\Roaming\91F3.exe"
"c:\users\Uživatel\AppData\Roaming\BA27.exe"
"c:\users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk"
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Crawler
c:\program files\Crawler\firefox\components\xcomm.dll
c:\program files\Crawler\firefox\components\xplugin.xpt
c:\program files\Crawler\firefox\components\xshared.dll
c:\program files\Crawler\firefox\components\xshared.xpt
c:\program files\Crawler\firefox\components\xsupport.dll
c:\program files\Crawler\firefox\components\xsupport.xpt
c:\program files\Crawler\firefox\components\xwsg.dll
c:\program files\Crawler\firefox\chrome.manifest
c:\program files\Crawler\firefox\chrome\common.jar
c:\program files\Crawler\firefox\chrome\stwsg.jar
c:\program files\Crawler\firefox\install.ini
c:\program files\Crawler\firefox\install.rdf
c:\program files\Crawler\firefox\stwsg_ff.ini
c:\program files\Facicons\tbcore3.dll
c:\programdata\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy\Cleaning\121007-002046.xml
c:\programdata\Spybot - Search & Destroy\ClientCount.bin
c:\programdata\Spybot - Search & Destroy\Immunization.ini
c:\programdata\Spybot - Search & Destroy\Logs\Firewall.log
c:\programdata\Spybot - Search & Destroy\Logs\Checks.121007-001355.txt
c:\programdata\Spybot - Search & Destroy\Logs\Checks.121007-004137.txt
c:\programdata\Spybot - Search & Destroy\Logs\Immunization-Browsers.log
c:\programdata\Spybot - Search & Destroy\Logs\Scanner.log
c:\programdata\Spybot - Search & Destroy\Logs\SDCleaner.log
c:\programdata\Spybot - Search & Destroy\Logs\Updates.log
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_AdobeFlashPlayerUpdateSvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-09 do 2012-10-09 )))))))))))))))))))))))))))))))
.
.
2012-10-09 08:31 . 2012-09-18 22:59 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{08E12621-2AE4-435A-9352-E384B58C952D}\mpengine.dll
2012-10-08 12:06 . 2012-10-08 12:13 -------- d-----w- c:\program files\trend micro
2012-10-08 12:06 . 2012-10-08 12:06 -------- dc----w- C:\rsit
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\users\Uživatel\AppData\Roaming\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 11:56 . 2012-10-09 07:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-08 11:56 . 2012-09-07 15:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-08 10:57 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2012-10-07 15:25 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-10-07 15:25 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-10-07 15:25 . 2010-08-26 16:34 1696256 ----a-w- c:\windows\system32\gameux.dll
2012-10-07 15:25 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2012-10-07 15:25 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2012-10-07 15:24 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-10-07 15:05 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2012-10-07 15:05 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
2012-10-07 15:05 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-10-07 15:05 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-10-07 15:05 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll
2012-10-07 15:05 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll
2012-10-07 15:05 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-10-07 15:05 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2012-10-07 15:05 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-10-07 15:05 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2012-10-07 15:05 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-10-07 14:55 . 2012-10-07 14:55 -------- d-----w- c:\program files\MSECache
2012-10-07 14:50 . 2012-10-07 14:50 -------- d-----w- c:\users\Uživatel\AppData\Local\ElevatedDiagnostics
2012-10-07 14:08 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-10-07 14:08 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-10-07 14:08 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-10-07 14:08 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-10-07 14:00 . 2012-07-04 14:02 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-10-07 13:58 . 2012-10-07 13:58 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-10-07 13:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2012-10-07 13:36 . 2010-06-16 15:30 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-10-07 13:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-10-07 13:35 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll
2012-10-07 13:35 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2012-10-07 13:35 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2012-10-07 13:34 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-10-07 13:34 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-07 13:34 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-07 13:34 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-10-07 13:34 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2012-10-07 13:34 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2012-10-07 13:34 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2012-10-07 13:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-10-07 13:33 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2012-10-07 13:33 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll
2012-10-07 13:33 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-07 13:33 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2012-10-07 13:30 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2012-10-07 13:30 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
2012-10-07 13:30 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
2012-10-07 13:30 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2012-10-07 13:28 . 2012-03-30 12:39 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-07 13:28 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-10-07 13:28 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-10-07 13:28 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-10-07 13:28 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-10-07 13:28 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2012-10-07 13:28 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2012-10-07 13:28 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-10-07 13:28 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2012-10-07 13:28 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2012-10-07 13:28 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-10-07 13:28 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-10-07 13:26 . 2012-04-03 08:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-07 13:26 . 2012-04-03 08:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-10-07 13:26 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2012-10-07 13:26 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll
2012-10-07 13:16 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-10-07 13:16 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
2012-10-07 13:16 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-10-07 13:16 . 2011-11-16 16:23 72704 ----a-w- c:\windows\system32\secur32.dll
2012-10-07 13:16 . 2011-11-16 16:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2012-10-07 13:16 . 2011-11-16 14:12 9728 ----a-w- c:\windows\system32\lsass.exe
2012-10-07 13:05 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-10-07 13:05 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-10-07 13:05 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-10-07 13:05 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-10-06 22:58 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-10-06 22:58 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-10-06 22:58 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-10-06 22:58 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-10-06 22:58 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-10-04 19:28 . 2012-10-04 19:38 -------- d-----w- c:\program files\Metin2
2012-09-26 13:43 . 2012-10-08 13:01 -------- d-----w- c:\program files\LaRoXion MT2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-20 19:21 . 2012-04-10 20:12 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-20 19:21 . 2011-05-18 12:18 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-01 11:31 . 2012-09-01 11:31 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-01 11:30 . 2012-05-12 13:38 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-01 11:30 . 2010-10-29 21:04 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-21 09:13 . 2011-04-11 21:27 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2011-01-09 12:44 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2011-01-09 12:44 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2011-01-09 12:44 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2011-01-09 12:44 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2011-01-09 12:44 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-01-28 17:42 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2011-01-09 12:43 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-26 21:11 . 2011-03-28 16:36 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-09-08 10:27 . 2012-09-08 10:27 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
.
c:\users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3597898428-2883692351-2398126780-1000]
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezGOSvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: ????3?? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-10-09 11:10:24 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-10-09 09:10
ComboFix2.txt 2012-10-09 06:28
.
Před spuštěním: Volných bajtů: 129 448 214 528
Po spuštění: Volných bajtů: 129 145 139 200
.
- - End Of File - - EF5DEB980044C854669611B44A960C0D

Larsnip píše:Předchiozí log mi přišel stejný jako ten první. Tak snad už se skript aplikoval. Jinak s Combofixem pracuji jen když mě o to požádá rádce zde na foru. Bohužel teď jsem viděl v odpovědi i návod na combofix a nechal PC projet i jím.

OK, takže příště už to prosím nedělej, ComboFix patří do ruky pouze lidem znalým a proškoleným, což je pro Českou republiku pouze na tomto fóru.


Aplikuj pro ComboFix ještě tento script, prosím: Jak se chová počítač nyní?

Děkuji mnohokrát za pomoc. Abych řekl pravdu tak toto PC neni moje. Od majitele mi jen bylo řečeno že se mu do PC dostal vir přes skype a nyní rozesilá odkaz všem kontaktům. Jinak na PC teď žádný náznak viru nepozoruji a skype je odinstalovaný a přístup k napadenemu účtu na skype nemám takže ani nevím jak to otestovat.

LOG:

ComboFix 12-10-08.03 - Uživatel 09.10.2012 12:51:51.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2012.1122 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-09 do 2012-10-09 )))))))))))))))))))))))))))))))
.
.
2012-10-09 10:56 . 2012-10-09 10:57 -------- d-----w- c:\users\Uživatel\AppData\Local\temp
2012-10-09 10:56 . 2012-10-09 10:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-09 08:31 . 2012-09-18 22:59 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{08E12621-2AE4-435A-9352-E384B58C952D}\mpengine.dll
2012-10-08 12:06 . 2012-10-08 12:13 -------- d-----w- c:\program files\trend micro
2012-10-08 12:06 . 2012-10-08 12:06 -------- dc----w- C:\rsit
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\users\Uživatel\AppData\Roaming\Malwarebytes
2012-10-08 11:56 . 2012-10-08 11:56 -------- d-----w- c:\programdata\Malwarebytes
2012-10-08 11:56 . 2012-10-09 07:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-08 11:56 . 2012-09-07 15:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-08 10:57 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2012-10-07 15:25 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-10-07 15:25 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-10-07 15:25 . 2010-08-26 16:34 1696256 ----a-w- c:\windows\system32\gameux.dll
2012-10-07 15:25 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2012-10-07 15:25 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2012-10-07 15:24 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-10-07 15:05 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2012-10-07 15:05 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
2012-10-07 15:05 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-10-07 15:05 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-10-07 15:05 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll
2012-10-07 15:05 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll
2012-10-07 15:05 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-10-07 15:05 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2012-10-07 15:05 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-10-07 15:05 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2012-10-07 15:05 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-10-07 14:55 . 2012-10-07 14:55 -------- d-----w- c:\program files\MSECache
2012-10-07 14:50 . 2012-10-07 14:50 -------- d-----w- c:\users\Uživatel\AppData\Local\ElevatedDiagnostics
2012-10-07 14:08 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-10-07 14:08 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-10-07 14:08 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-10-07 14:08 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-10-07 14:00 . 2012-07-04 14:02 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-10-07 13:58 . 2012-10-07 13:58 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-10-07 13:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2012-10-07 13:36 . 2010-06-16 15:30 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-10-07 13:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-10-07 13:35 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll
2012-10-07 13:35 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2012-10-07 13:35 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2012-10-07 13:34 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-10-07 13:34 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-07 13:34 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-07 13:34 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-10-07 13:34 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2012-10-07 13:34 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2012-10-07 13:34 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2012-10-07 13:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-10-07 13:33 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2012-10-07 13:33 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll
2012-10-07 13:33 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-07 13:33 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2012-10-07 13:30 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2012-10-07 13:30 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
2012-10-07 13:30 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
2012-10-07 13:30 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2012-10-07 13:28 . 2012-03-30 12:39 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-07 13:28 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-10-07 13:28 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-10-07 13:28 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-10-07 13:28 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-10-07 13:28 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2012-10-07 13:28 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2012-10-07 13:28 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-10-07 13:28 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2012-10-07 13:28 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2012-10-07 13:28 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-10-07 13:28 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-10-07 13:26 . 2012-04-03 08:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-07 13:26 . 2012-04-03 08:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-10-07 13:26 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2012-10-07 13:26 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll
2012-10-07 13:16 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-10-07 13:16 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
2012-10-07 13:16 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-10-07 13:16 . 2011-11-16 16:23 72704 ----a-w- c:\windows\system32\secur32.dll
2012-10-07 13:16 . 2011-11-16 16:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2012-10-07 13:16 . 2011-11-16 14:12 9728 ----a-w- c:\windows\system32\lsass.exe
2012-10-07 13:05 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-10-07 13:05 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-10-07 13:05 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-10-07 13:05 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-10-06 22:58 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-10-06 22:58 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-10-06 22:58 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-10-06 22:58 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-10-06 22:58 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-10-04 19:28 . 2012-10-04 19:38 -------- d-----w- c:\program files\Metin2
2012-09-26 13:43 . 2012-10-08 13:01 -------- d-----w- c:\program files\LaRoXion MT2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-20 19:21 . 2012-04-10 20:12 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-20 19:21 . 2011-05-18 12:18 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-01 11:31 . 2012-09-01 11:31 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-01 11:30 . 2012-05-12 13:38 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-01 11:30 . 2010-10-29 21:04 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-21 09:13 . 2011-04-11 21:27 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2011-01-09 12:44 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2011-01-09 12:44 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2011-01-09 12:44 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2011-01-09 12:44 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2011-01-09 12:44 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-01-28 17:42 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2011-01-09 12:43 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-26 21:11 . 2011-03-28 16:36 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-09-08 10:27 . 2012-09-08 10:27 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
.
c:\users\Uživatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3597898428-2883692351-2398126780-1000]
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezGOSvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: ????3?? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Uživatel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-09 12:57
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@="c:\\Users\\Uživatel\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-10-09 13:00:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-10-09 11:00
ComboFix2.txt 2012-10-09 09:10
ComboFix3.txt 2012-10-09 06:28
.
Před spuštěním: Volných bajtů: 129 055 834 112
Po spuštění: Volných bajtů: 128 951 115 776
.
- - End Of File - - 12D5F391FCCF524C3984151196703EEA

OK, jen doufám, že se tím neživíš a já to tu nedělám jako pako zadarmo.
Tak jedeme dál...


Stáhni AdwCleaner - http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulož jej nejlépe na Plochu.
• Ukonči všechny programy!!
• Pokud používáš operační systém Windows Vista či Windows 7, klikni na AdwCleaner pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Klikni na [Search].
• Proběhne scan a pak se objeví log, který bude případně uložen na systémovém disku jako AdwCleaner[R?].txt - ten mi sem vlož.

log z AdwCleaneru:

# AdwCleaner v2.004 - Logfile created 10/09/2012 at 16:06:59
# Updated 06/10/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Uživatel - UŽIVATEL-PC
# Boot Mode : Normal
# Running from : C:\Users\Uživatel\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
File Found : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\searchplugins\Askcom.xml
Folder Found : C:\Users\Uživatel\AppData\Local\Conduit
Folder Found : C:\Users\Uživatel\AppData\Local\ConduitEngine
Folder Found : C:\Users\Uživatel\AppData\LocalLow\Conduit
Folder Found : C:\Users\Uživatel\AppData\LocalLow\Toolbar4
Folder Found : C:\Users\Uživatel\AppData\LocalLow\Vuze_Remote
Folder Found : C:\Users\Uživatel\AppData\LocalLow\Vuze_Remote

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\AskBarDis
Key Found : HKCU\Software\AppDataLow\Software\Vuze_Remote
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{9DDD0B95-1F3E-453E-9F12-EACB0DD6B6CF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C878CD69-85DB-426B-81A3-E71175AAEB91}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Found : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Found : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Found : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Key Found : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Key Found : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AA0F425C-8D8B-41B1-99B5-0569E1937CA0}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\Software\Vuze_Remote
Key Found : HKU\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKU\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKU\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKU\S-1-5-21-3597898428-2883692351-2398126780-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://www.crawler.com/search/ie.aspx?tb_id=60076
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60076

-\\ Mozilla Firefox v15.0.1 (cs)

Profile name : default
File : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\prefs.js

Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "Ask.com");
Found : user_pref("browser.search.order.1", "Ask.com");

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Uživatel\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [8397 octets] - [09/10/2012 16:06:59]

########## EOF - C:\AdwCleaner[R1].txt - [8457 octets] ##########

Tam toho bylo.


Tak provedeme opravy.

• Spusť AdwCleaner znovu.
• Pokud používáš operační systém Windows Vista či Windows 7, klikni na AdwCleaner pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Klikni na [Delete].
• PC provede opravu, restartuje se a vytvoří log C:\AdwCleaner [S1].txt - jeho obsah mi sem zase vlož.

log z AdwCleaneru[S1] :

# AdwCleaner v2.004 - Logfile created 10/10/2012 at 08:16:59
# Updated 06/10/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Uživatel - UŽIVATEL-PC
# Boot Mode : Normal
# Running from : C:\Users\Uživatel\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
File Deleted : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\searchplugins\Askcom.xml
Folder Deleted : C:\Users\Uživatel\AppData\Local\Conduit
Folder Deleted : C:\Users\Uživatel\AppData\Local\ConduitEngine
Folder Deleted : C:\Users\Uživatel\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Uživatel\AppData\LocalLow\Toolbar4
Folder Deleted : C:\Users\Uživatel\AppData\LocalLow\Vuze_Remote

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\AskBarDis
Key Deleted : HKCU\Software\AppDataLow\Software\Vuze_Remote
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{9DDD0B95-1F3E-453E-9F12-EACB0DD6B6CF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C878CD69-85DB-426B-81A3-E71175AAEB91}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Deleted : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Key Deleted : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AA0F425C-8D8B-41B1-99B5-0569E1937CA0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\Software\Vuze_Remote
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://www.crawler.com/search/ie.aspx?tb_id=60076 --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0.1 (cs)

Profile name : default
File : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\22kf9mou.default\prefs.js

Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Deleted : user_pref("browser.search.order.1", "Ask.com");

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Uživatel\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [8526 octets] - [09/10/2012 16:06:59]
AdwCleaner[S1].txt - [8022 octets] - [10/10/2012 08:16:59]

########## EOF - C:\AdwCleaner[S1].txt - [8082 octets] ##########

OK, AdwCleaner to všechno pomazal.

Hoď mi sem nový aktuální log ze RSITu, ať vím, co se zatím povedlo a co ne.