VIRY.CZ

Dobrý večer všem zdejším doktorům.

V domácnosti se jednomu členu podařilo nainstalovat po kliku na banner přehrávače internetových televizí a už byl průser na světě. Po restartu PC ihned nabídky k odblokování přístupu po uhrazení částky + mnoho a mnoho nainstalovaných "sračiček". Přikládám log z RSIT, prosím o rady. Děkuji

Logfile of random's system information tool 1.09 (written by random/random)
Run by Boro at 2013-04-24 20:24:58
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 283 GB (59%) free of 477 GB
Total RAM: 3894 MB (48% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
atieclxx
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe"
"C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe"
"C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe"
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe" service
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe"
"C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\Boro\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\Boro\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
\??\C:\Windows\system32\conhost.exe "-3916033511702634188-48571473254713107183922508716009594572774956471932225059
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe" /dts
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe" /noprogress
"C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -Embedding
"c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-cf4113ab-51f2-4244-9c2a-fd6f69225df4 -SystemEventPortName:HostProcess-b00a7f94-98fd-4ae2-996f-8b35711f9eac -IoCancelEventPortName:HostProcess-6090b49c-1367-40cf-84e7-0dcd43995a4b -NonStateChangingEventPortName:HostProcess-b7f0b1e8-1897-4610-93bf-1d39100efb91 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:f1f71f61-1966-47f4-bd4b-e088ab4383c1 -DeviceGroupId:WpdFsGroup
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Users\Boro\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2024539283-1701944665-3573123774-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2024539283-1701944665-3573123774-1001UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Boro\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tzvx4.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.6.602.180 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.17.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775]
"Description"=RealJukebox Netscape Plugin
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0]
"Description"=RealPlayer(tm) HTML5VideoShim Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775]
"Description"=6.0.12.775
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0]
"Description"=BlackBerry Web Software Loading Helper Plug-In for Mozilla browsers
"Path"=C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.6.602.180 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
ask.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Boro\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tzvx4.default\extensions\
LogMeInClient@logmein.com

C:\Users\Boro\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tzvx4.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-01-14 253584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-03-19 6305912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-07-07 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-03-14 461216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-14 192144]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-03-19 4529272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-03-14 170912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-01-14 253584]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-14 192144]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-07-27 161304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-07-27 386584]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-07-27 415256]
"LogMeIn GUI"=C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [2012-06-08 57928]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 1281512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-11 3672384]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2012-08-09 39408]
"BlackBerryLink.exe"=C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe [2013-03-19 3781136]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-02-28 18642024]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-09-09 98304]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-04-13 284696]
"TkBellExe"=C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe [2012-07-07 202256]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-01-28 59720]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2013-02-20 152392]
"RIMBBLaunchAgent.exe"=C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [2013-01-17 267792]
"RIM PeerManager"=C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [2013-03-12 4206592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-07-27 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2013-04-24 20:20:07 ----D---- C:\Program Files\trend micro
2013-04-24 20:20:06 ----D---- C:\rsit
2013-04-24 20:10:34 ----D---- C:\Windows\temp
2013-04-24 20:10:32 ----A---- C:\ComboFix.txt
2013-04-24 19:47:15 ----A---- C:\Windows\zip.exe
2013-04-24 19:47:15 ----A---- C:\Windows\SWSC.exe
2013-04-24 19:47:15 ----A---- C:\Windows\SWREG.exe
2013-04-24 19:47:15 ----A---- C:\Windows\sed.exe
2013-04-24 19:47:15 ----A---- C:\Windows\PEV.exe
2013-04-24 19:47:15 ----A---- C:\Windows\NIRCMD.exe
2013-04-24 19:47:15 ----A---- C:\Windows\MBR.exe
2013-04-24 19:47:15 ----A---- C:\Windows\grep.exe
2013-04-24 19:46:10 ----D---- C:\Qoobox
2013-04-24 19:45:57 ----D---- C:\Windows\erdnt
2013-04-24 19:44:23 ----D---- C:\Program Files\CCleaner
2013-04-23 19:09:34 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-15 20:19:42 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-04-11 08:50:33 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-04-11 08:50:33 ----A---- C:\Windows\system32\ieui.dll
2013-04-11 08:50:32 ----A---- C:\Windows\system32\ie4uinit.exe
2013-04-11 08:50:31 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-04-11 08:50:31 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-04-11 08:50:31 ----A---- C:\Windows\system32\iesetup.dll
2013-04-11 08:50:31 ----A---- C:\Windows\system32\iernonce.dll
2013-04-11 08:50:30 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-04-11 08:50:30 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-04-11 08:50:30 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-04-11 08:50:30 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-04-11 08:50:30 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-04-11 08:50:30 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-11 08:50:30 ----A---- C:\Windows\system32\iesysprep.dll
2013-04-11 08:50:29 ----A---- C:\Windows\system32\iertutil.dll
2013-04-11 08:50:28 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-04-11 08:50:27 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-04-11 08:50:27 ----A---- C:\Windows\system32\urlmon.dll
2013-04-11 08:50:27 ----A---- C:\Windows\system32\jscript.dll
2013-04-11 08:50:26 ----A---- C:\Windows\system32\jscript9.dll
2013-04-11 08:50:25 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-04-11 08:50:24 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-04-11 08:50:24 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-04-11 08:50:24 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-11 08:50:23 ----A---- C:\Windows\system32\wininet.dll
2013-04-11 08:50:22 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-04-11 08:50:21 ----A---- C:\Windows\system32\ieframe.dll
2013-04-11 08:50:19 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-04-11 08:50:18 ----A---- C:\Windows\system32\mshtml.dll
2013-04-10 16:21:02 ----A---- C:\Windows\system32\mstscax.dll
2013-04-10 16:21:01 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-04-10 16:21:00 ----A---- C:\Windows\SYSWOW64\aaclient.dll
2013-04-10 16:20:59 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-04-10 16:20:59 ----A---- C:\Windows\system32\tsgqec.dll
2013-04-10 16:20:59 ----A---- C:\Windows\system32\aaclient.dll
2013-04-10 16:20:56 ----A---- C:\Windows\system32\win32k.sys
2013-04-10 16:20:52 ----A---- C:\Windows\system32\drivers\fvevol.sys
2013-04-10 16:20:50 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-10 16:20:49 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-04-10 16:20:49 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-04-10 16:20:48 ----A---- C:\Windows\system32\smss.exe
2013-04-10 16:20:48 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-10 16:20:47 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-03-31 21:15:46 ----D---- C:\Program Files (x86)\DauDen.vn
2013-03-31 20:37:45 ----D---- C:\Users\Boro\AppData\Roaming\Research In Motion
2013-03-31 20:37:14 ----A---- C:\Windows\system32\drivers\RimSerial_AMD64.sys
2013-03-31 20:37:02 ----D---- C:\ProgramData\Research In Motion
2013-03-31 20:37:02 ----A---- C:\Windows\SYSWOW64\out.txt
2013-03-31 20:37:02 ----A---- C:\Windows\SYSWOW64\err.txt
2013-03-31 20:36:16 ----D---- C:\Program Files (x86)\Research In Motion

======List of files/folders modified in the last 1 month======

2013-04-24 20:20:07 ----RD---- C:\Program Files
2013-04-24 20:12:48 ----D---- C:\Windows\system32\config
2013-04-24 20:10:34 ----D---- C:\Windows
2013-04-24 20:09:01 ----A---- C:\Windows\system.ini
2013-04-24 20:07:06 ----D---- C:\Windows\SYSWOW64\drivers
2013-04-24 20:07:06 ----D---- C:\Windows\SysWOW64
2013-04-24 20:07:06 ----D---- C:\Windows\AppPatch
2013-04-24 20:07:05 ----D---- C:\Program Files (x86)\Common Files
2013-04-24 20:06:54 ----D---- C:\Windows\System32
2013-04-24 20:06:54 ----D---- C:\Windows\inf
2013-04-24 20:06:54 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-24 20:01:41 ----A---- C:\Windows\SYSWOW64\log.txt
2013-04-24 20:01:15 ----D---- C:\Windows\system32\drivers
2013-04-24 19:55:39 ----D---- C:\Windows\system32\drivers\etc
2013-04-24 19:52:56 ----D---- C:\Users\Boro\AppData\Roaming\DAEMON Tools Lite
2013-04-24 19:52:56 ----D---- C:\ProgramData\LogMeIn
2013-04-24 19:52:52 ----D---- C:\Windows\Panther
2013-04-24 19:52:52 ----D---- C:\Windows\ModemLogs
2013-04-24 19:48:36 ----D---- C:\Windows\system32\NDF
2013-04-24 19:44:26 ----D---- C:\Windows\system32\Tasks
2013-04-24 19:43:56 ----D---- C:\Windows\Prefetch
2013-04-24 19:23:11 ----RD---- C:\Program Files (x86)
2013-04-24 19:22:50 ----AD---- C:\ProgramData\TEMP
2013-04-24 19:22:15 ----D---- C:\ProgramData
2013-04-24 19:17:03 ----SHD---- C:\Windows\Installer
2013-04-24 19:17:02 ----D---- C:\Program Files (x86)\Ask.com
2013-04-24 16:53:22 ----D---- C:\Windows\Logs
2013-04-24 16:53:22 ----D---- C:\Windows\debug
2013-04-23 21:35:17 ----D---- C:\Windows\winsxs
2013-04-23 21:31:09 ----SHD---- C:\System Volume Information
2013-04-23 21:22:13 ----D---- C:\Windows\Tasks
2013-04-23 21:22:13 ----D---- C:\Windows\system32\wfp
2013-04-23 21:22:11 ----D---- C:\Windows\system32\wbem
2013-04-23 21:21:35 ----D---- C:\Windows\system32\DriverStore
2013-04-23 21:21:35 ----D---- C:\Windows\system32\catroot2
2013-04-23 21:21:32 ----D---- C:\Windows\registration
2013-04-23 19:16:34 ----D---- C:\Users\Boro\AppData\Roaming\Skype
2013-04-23 19:08:34 ----D---- C:\Windows\system32\catroot
2013-04-16 20:22:37 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-15 19:55:32 ----RSD---- C:\Windows\assembly
2013-04-15 19:55:32 ----D---- C:\Windows\Microsoft.NET
2013-04-15 19:04:01 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-04-11 22:17:25 ----D---- C:\Program Files (x86)\Balkaniyum.tv
2013-04-11 13:34:11 ----A---- C:\Windows\system32\MRT.exe
2013-04-11 09:08:07 ----D---- C:\Program Files\Internet Explorer
2013-04-11 09:08:07 ----D---- C:\Program Files (x86)\Internet Explorer
2013-04-11 08:51:55 ----D---- C:\ProgramData\Microsoft Help
2013-04-11 08:48:28 ----D---- C:\ProgramData\Skype
2013-04-11 08:48:27 ----RD---- C:\Program Files (x86)\Skype
2013-04-02 12:34:28 ----A---- C:\Windows\system32\MpSigStub.exe
2013-03-31 23:43:16 ----D---- C:\Users\Boro\AppData\Roaming\vlc

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2011-05-13 30008]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-04-13 540696]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 230320]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-26 283200]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [2012-06-08 15928]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2012-06-08 72216]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2011-05-13 43320]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-09-08 7767552]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-09-08 279040]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-05-05 125456]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2009-10-25 151936]
R3 intelkmd;intelkmd; C:\Windows\system32\DRIVERS\igdpmd64.sys [2010-07-27 10610400]
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2012-06-08 11552]
R3 netr28x;Ralink 802.11n – bezdrátový ovladač pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28x.sys [2009-06-10 620544]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 rimvndis;BlackBerry Virtual Private Network; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [2013-03-12 18432]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [2012-12-10 44544]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2009-07-14 11264]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WinUSB;WinUSB Service; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-07-27 10610400]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\Windows\system32\DRIVERS\netaapl64.sys [2012-03-26 22528]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RimUsb;zařízení BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [2013-01-03 78336]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-01-11 232992]
S3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\Windows\system32\DRIVERS\stwrt64.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]
S3 usbrndis6;Adaptér USB RNDIS6; C:\Windows\system32\DRIVERS\usb80236.sys [2013-02-12 19968]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-09-08 203264]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-12-21 57008]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2011-05-13 30520]
R2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2012-11-08 375728]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [2012-11-08 147888]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-05-01 325656]
R2 LogMeIn;LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [2012-06-08 407424]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 22056]
R2 RIM MDNS;RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [2013-03-12 388096]
R2 RIM Tunnel Service;BlackBerry Link Communication Manager; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [2013-03-12 1169920]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-05-01 2533400]
R2 vcsFPService;Validity VCS Fingerprint Service; C:\Windows\system32\vcsFPService.exe [2010-02-23 2192176]
R3 BlackBerry Device Manager;BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-02-06 585728]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2013-02-20 641352]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 116648]
S2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-03-19 3289208]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-13 253656]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 116648]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-22 194032]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2012-09-20 30785672]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-04-15 115608]
S3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-05 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Přikládám ještě log z Combofix po odinstalování "bordelu"'


ComboFix 13-04-24.03 - Boro 24.04.2013 19:49:14.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3894.2180 [GMT 2:00]
Spuštěný z: c:\users\Boro\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\PolicyDefinitions
c:\windows\PolicyDefinitions\cs-CZ\DeviceRedirection.adml
c:\windows\PolicyDefinitions\cs-CZ\EnhancedStorage.adml
c:\windows\PolicyDefinitions\cs-CZ\InetRes.adml
c:\windows\PolicyDefinitions\cs-CZ\NCSI.adml
c:\windows\PolicyDefinitions\cs-CZ\RacWmiProv.adml
c:\windows\PolicyDefinitions\cs-CZ\ReAgent.adml
c:\windows\PolicyDefinitions\cs-CZ\sdiageng.adml
c:\windows\PolicyDefinitions\cs-CZ\sdiagschd.adml
c:\windows\PolicyDefinitions\cs-CZ\Search.adml
c:\windows\PolicyDefinitions\cs-CZ\ShapeCollector.adml
c:\windows\PolicyDefinitions\cs-CZ\WindowsMediaDRM.adml
c:\windows\PolicyDefinitions\cs-CZ\WindowsMediaPlayer.adml
c:\windows\PolicyDefinitions\DeviceRedirection.admx
c:\windows\PolicyDefinitions\en-US\InetRes.adml
c:\windows\PolicyDefinitions\EnhancedStorage.admx
c:\windows\PolicyDefinitions\inetres.admx
c:\windows\PolicyDefinitions\NCSI.admx
c:\windows\PolicyDefinitions\RacWmiProv.admx
c:\windows\PolicyDefinitions\ReAgent.admx
c:\windows\PolicyDefinitions\sdiageng.admx
c:\windows\PolicyDefinitions\sdiagschd.admx
c:\windows\PolicyDefinitions\Search.admx
c:\windows\PolicyDefinitions\ShapeCollector.admx
c:\windows\PolicyDefinitions\WindowsMediaDRM.admx
c:\windows\PolicyDefinitions\WindowsMediaPlayer.admx
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-24 do 2013-04-24 )))))))))))))))))))))))))))))))
.
.
2013-04-24 17:55 . 2013-04-24 17:55 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2013-04-24 17:55 . 2013-04-24 17:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-24 17:44 . 2013-04-24 17:44 -------- d-----w- c:\program files\CCleaner
2013-04-24 17:25 . 2012-11-28 17:54 972264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D6B3DEDB-45A2-9D58-C6B5-E30F74762506}\GapaEngine.dll
2013-04-23 19:22 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{749988E4-7E01-4084-806F-0CB98B04F810}\mpengine.dll
2013-04-23 17:09 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-21 11:38 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-11 06:48 . 2013-04-11 06:48 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-04-10 14:21 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 14:21 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 14:21 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 14:20 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 14:20 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 14:20 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 14:20 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 14:20 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 14:20 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 14:20 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 14:20 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 14:20 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 14:20 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 14:20 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-09 19:10 . 2013-04-09 19:10 -------- d-----w- c:\users\Boro\AppData\Local\Programs
2013-03-31 21:50 . 2013-03-31 21:50 -------- d-----w- c:\users\Boro\Pi a jeho život - DroN-4
2013-03-31 19:15 . 2013-03-31 19:15 -------- d-----w- c:\program files (x86)\DauDen.vn
2013-03-31 18:37 . 2013-03-31 18:45 -------- d-----w- c:\users\Boro\AppData\Roaming\Research In Motion
2013-03-31 18:37 . 2013-03-31 18:37 -------- d-----w- c:\users\Boro\AppData\Local\Research In Motion
2013-03-31 18:37 . 2012-12-10 13:48 44544 ----a-w- c:\windows\system32\drivers\RimSerial_AMD64.sys
2013-03-31 18:37 . 2013-03-31 18:37 -------- d-----w- c:\programdata\Research In Motion
2013-03-31 18:36 . 2013-03-31 18:36 -------- d-----w- c:\program files (x86)\Common Files\Research in Motion
2013-03-31 18:36 . 2013-03-31 18:36 -------- d-----w- c:\program files (x86)\Research In Motion
2013-03-30 18:51 . 2013-03-30 18:51 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-11 11:34 . 2012-07-05 11:17 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-02 10:34 . 2012-07-05 11:21 282744 ----a-w- c:\windows\system32\MpSigStub.exe
2013-03-15 08:11 . 2013-03-15 08:11 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-15 08:11 . 2013-03-15 08:11 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-15 08:11 . 2013-03-15 08:11 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-15 08:11 . 2013-03-15 08:11 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-15 08:11 . 2013-03-15 08:11 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-15 08:11 . 2013-03-15 08:11 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-15 08:11 . 2013-03-15 08:11 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-15 08:11 . 2013-03-15 08:11 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-15 08:11 . 2013-03-15 08:11 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-15 08:11 . 2013-03-15 08:11 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-15 08:11 . 2013-03-15 08:11 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-15 08:11 . 2013-03-15 08:11 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-15 08:11 . 2013-03-15 08:11 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-15 08:11 . 2013-03-15 08:11 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-15 08:11 . 2013-03-15 08:11 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-15 08:11 . 2013-03-15 08:11 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-15 08:11 . 2013-03-15 08:11 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-15 08:11 . 2013-03-15 08:11 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-15 08:11 . 2013-03-15 08:11 441856 ----a-w- c:\windows\system32\html.iec
2013-03-15 08:11 . 2013-03-15 08:11 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-15 08:11 . 2013-03-15 08:11 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-15 08:11 . 2013-03-15 08:11 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-15 08:11 . 2013-03-15 08:11 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-15 08:11 . 2013-03-15 08:11 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-15 08:11 . 2013-03-15 08:11 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-15 08:11 . 2013-03-15 08:11 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-15 08:11 . 2013-03-15 08:11 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-15 08:11 . 2013-03-15 08:11 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-15 08:11 . 2013-03-15 08:11 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-15 08:11 . 2013-03-15 08:11 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-15 08:11 . 2013-03-15 08:11 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-15 08:11 . 2013-03-15 08:11 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-15 08:11 . 2013-03-15 08:11 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-15 08:11 . 2013-03-15 08:11 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-15 08:11 . 2013-03-15 08:11 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-15 08:11 . 2013-03-15 08:11 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-15 08:11 . 2013-03-15 08:11 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-15 08:11 . 2013-03-15 08:11 235008 ----a-w- c:\windows\system32\url.dll
2013-03-15 08:11 . 2013-03-15 08:11 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-15 08:11 . 2013-03-15 08:11 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-15 08:11 . 2013-03-15 08:11 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-15 08:11 . 2013-03-15 08:11 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-15 08:11 . 2013-03-15 08:11 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-15 08:11 . 2013-03-15 08:11 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-15 08:11 . 2013-03-15 08:11 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-15 08:11 . 2013-03-15 08:11 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-15 08:11 . 2013-03-15 08:11 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-15 08:11 . 2013-03-15 08:11 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-15 08:11 . 2013-03-15 08:11 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-14 08:21 . 2013-03-14 08:21 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-14 08:21 . 2012-07-07 19:55 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-14 08:21 . 2012-07-07 19:55 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-13 14:11 . 2012-08-14 14:21 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-13 14:11 . 2012-08-14 14:21 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-12 19:29 . 2013-03-12 19:29 18432 ----a-w- c:\windows\system32\drivers\rimvndis6_AMD64.sys
2013-03-07 14:08 . 2013-03-07 14:08 507904 ----a-r- c:\windows\SysWow64\btwapi.dll
2013-02-12 05:45 . 2013-03-13 11:49 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 11:49 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 11:49 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 11:49 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 11:49 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 11:49 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-15 07:11 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-12 04:12 . 2013-03-15 07:11 19968 ----a-w- c:\windows\system32\drivers\usb80236.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-08-09 39408]
"BlackBerryLink.exe"="c:\program files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe" [2013-03-19 3781136]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]
"TkBellExe"="c:\program files (x86)\Common Files\Real\Update_OB\realsched.exe" [2012-07-07 202256]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792]
"RIM PeerManager"="c:\program files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" [2013-03-12 4206592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-26 283200]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-09-08 203264]
S3 BlackBerry Device Manager;BlackBerry Device Manager;c:\program files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-02-06 585728]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-14 14:11]
.
2013-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 09:36]
.
2013-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 09:36]
.
2013-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2024539283-1701944665-3573123774-1001Core.job
- c:\users\Boro\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-07 19:39]
.
2013-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2024539283-1701944665-3573123774-1001UA.job
- c:\users\Boro\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-07 19:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-27 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-27 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-27 415256]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2012-06-08 57928]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Boro\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tzvx4.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL -
FF - ExtSQL: 2013-04-21 20:18; AppGraffiti@AppGraffiti.com; c:\users\Boro\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tzvx4.default\extensions\AppGraffiti@AppGraffiti.com
FF - ExtSQL: 2013-04-21 20:18; {ED76C299-85BC-4891-9237-74A140C28832}; c:\program files (x86)\RebateInformer\Firefox
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{4154552D-5341-5400-76A7-7A786E7484D7} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-04-24 19:57:54
ComboFix-quarantined-files.txt 2013-04-24 17:57
.
Před spuštěním: Volných bajtů: 291 631 329 280
Po spuštění: Volných bajtů: 296 606 437 376
.
- - End Of File - - CD210D9D2F6F39D365BAF500911BBAFE

Vyřešeno obnovením počítače ze zálohy, prosím o lock. Díky

Jen takový malý dodatek, aby to tu zaznělo!


Co se týče ComboFixu, tak na základě licence a pravidel fóra se ptám - umíš s ním pracovat (spuštění, rozluštění logu, sestavení opravného scriptu, případně vrácení nechtěných výmazů a oprav)? Vím, že neumíš.

Licenční podmínky hovoří jasně: "Nikdy by neměl být použit v prostředí bez dozoru zkušené osoby".


Nebezpečí CFka:

• Tento program je určen primárně pro rádce - jeho svévolným použitím ztrácíš nárok na podporu!
• Maže stopy po havěti, takže v logu ze RSITu není potom nic vidět!
• Jeho log je třeba doluštit, jelikož neumí smazat vše - to ovšem těžko zvládneš, pokud k tomu nejsi vyškolen!
• CF může mít bug - sundá Ti systém tím, že smaže legální soubory a pokud nevíš, kam co ukládá a jak co obnovit, máš systém v kytkách a čeká Tě reinstall!
• CF taky bohužel prozatím nekontroluje některé důležité knihovny (např. hal.dll) - ty mažou kupříkladu některé typy havěti (Angela a další) - smaže Ti po restartu hal.dll = nenajede Ti systém a jsi o řádek výše = reinstall!

Howgh.