VIRY.CZ

Kamarádovi se smazali ovladače od USB myši a požádal mě o pomoc . Při opravě ( systém WIN XP sp3) jsem zjistil, že se nedá dostat do systému přes ovládací panely - zobrazí se hláška "Systém nemůže nalézt C:/WINDOWS/system32/rundll32.exe".
Taky při startu nabíhá tabulka zda se má program spustit jako uživatel. Domnívám se že by se mohlo jednat o vir ( PC projeto antivirem AVG).

Přikládám log:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Microsoft Windows XP x86
Ran by Junkov  on so 19.10.2013 at 18:49:47,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\igearsettings
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

---------------------------------------------------------------------------------------------------------------------------------------------------------


# AdwCleaner v3.008 - Report created 19/10/2013 at 18:58:44
# Updated 17/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Junková - ATHLON
# Running from : C:\Documents and Settings\Junková\Plocha\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Junková\Local Settings\Data aplikací\AVG Secure Search
Folder Deleted : C:\Documents and Settings\peta\Local Settings\Data aplikací\AVG Secure Search
Folder Deleted : C:\Documents and Settings\peta\Data aplikací\AVG Secure Search
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKLM\Software\Description
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v23.0.1 (cs)

[ File : C:\Documents and Settings\Junková\Data aplikací\Mozilla\Firefox\Profiles\s98147at.default\prefs.js ]


[ File : C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\3ihvb12u.default\prefs.js ]


-\\ Google Chrome v30.0.1599.101

[ File : C:\Documents and Settings\Junková\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2399 octets] - [19/10/2013 18:57:37]
AdwCleaner[S0].txt - [2356 octets] - [19/10/2013 18:58:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2416 octets] ##########

Díky za pomoc

Zdravím!
Spíš to vypadá na chybu systému. Zkuste tento postup: http://forum.viry.cz/viewtopic.php?f=24&t=132509 .

scan z FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by Junková (administrator) on ATHLON on 20-10-2013 18:17:13
Running from C:\Documents and Settings\Junková\Plocha
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(HP) C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HP UT LEDM\bin\hppusg.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Nero AG) C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
(Nero AG) C:\Program Files\Nero\Nero 7\InCD\InCD.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(HP) C:\WINDOWS\system32\HPSIsvc.exe
(Nero AG) C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(TeamViewer GmbH) C:\DOCUME~1\JUNKOV~1\LOCALS~1\Temp\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\DOCUME~1\JUNKOV~1\LOCALS~1\Temp\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) c:\docume~1\junkov~1\locals~1\temp\teamviewer\version8\TeamViewer_Desktop.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgmfapx.exe
(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [UserFaultCheck] - %systemroot%\system32\dumprep 0 -u
HKLM\...\Run: [LoadPowerProfile] - Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
HKLM\...\Run: [HPDJ Taskbar Utility] - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [196608 2001-10-29] (HP)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2010-02-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RTHDCPL] - C:\Windows\RTHDCPL.EXE [19722344 2010-11-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [HPUsageTrackingLEDM] - C:\Program Files\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-10-15] (Hewlett-Packard Company)
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411440 2013-08-15] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [LGODDFU] - C:\Program Files\lg_fwupdate\lgfw.exe [27760 2012-09-21] (Bitleader)
HKLM\...\Run: [PMBVolumeWatcher] - C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation)
HKLM\...\Run: [SecurDisc] - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [1628208 2007-05-15] (Nero AG)
HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [56928 2006-11-23] (Cyberlink Corp.)
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [54832 2006-12-05] ()
HKLM\...\Run: [InCD] - C:\Program Files\Nero\Nero 7\InCD\InCD.exe [1057328 2007-05-15] (Nero AG)
HKLM\...\Run: [Family Tree Builder Update] - C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [DWQueuedReporting] - c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe [39264 2007-03-13] (Microsoft Corporation)
HKLM\...\RunServices: [LoadPowerProfile] - C:\Windows\System32\powrprof.dll [17408 2008-04-14] ( (Microsoft Corporation))
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKCU\...\Run: [PC Suite Tray] - "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MountPoints2: {2dc51d62-41f8-11de-ae58-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {2dc51d63-41f8-11de-ae58-001e8c855cc1} - F:\Start.exe
MountPoints2: {5dea6d69-5eaa-11df-b106-001e8c855cc1} - F:\Install_Nokia_Ovi_Suite.exe
MountPoints2: {8f7ad7d7-4ffa-11dd-afca-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {e7c1bbdd-c7c8-11e2-8862-001e8c855cc1} - F:\HTC_Sync_Manager_PC.exe
HKU\Default User\...\RunOnce: [tscuninstall] - C:\Windows\system32\tscupgrd.exe [ 2006-03-02] (Microsoft Corporation)
HKU\peta\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\peta\...\Run: [MSMSGS] - C:\Program Files\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\peta\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - "C:\Program Files\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB
BootExecute: autocheck autochk * sdnclean.exeC:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKLM - DefaultScope value is missing.
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
Toolbar: HKCU -&Adresa - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Společnost Microsoft)
Toolbar: HKCU -&Odkazy - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\Windows\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {1AE23F24-D3E4-4C57-8468-6618B9B8B70F} https://ib24.csob.cz/comp/IcaSignerCZ.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mv9VCM.CAB
DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mv9dmo.cab
DPF: {461A37E7-17B3-40E3-B6BB-7CAEC732C9E4} https://ib24.csob.cz/comp/CSOBEnroll.dll
DPF: {5F509E42-537E-482B-B66C-145BC170054C} http://sberna.fotostar.cz/snadno-vlozit ... loader.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8DB83558-B5E6-4449-8E59-B91126580A99} https://ib24.csob.cz/comp/ICAHsmEngine.dll
DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} http://asp.photoprintit.de/microsite/11 ... oader4.cab
DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} https://asp.photoprintit.de/microsite/1 ... oader4.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab
Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - No File
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Junková\Data aplikací\Mozilla\Firefox\Profiles\s98147at.default
FF DefaultSearchEngine: Slunečnice
FF SelectedSearchEngine: Slunečnice
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll No File
CHR Plugin: (AVG Internet Security) - C:\Documents and Settings\Junkov\u00E1\Local Settings\Data aplikac\u00ED\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Chrome In-App Payments service) - C:\DOCUME~1\JUNKOV~1\LOCALS~1\Data aplikací\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

========================== Services (Whitelisted) =================

S2 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [593920 2010-02-10] ()
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
S2 gupdate1caa5828e1060d0; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2010-02-04] (Google Inc.)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [136192 2009-10-15] (HP)
R2 InCDsrv; C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe [1550896 2007-05-15] (Nero AG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] ()

==================== Drivers (Whitelisted) ====================

S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [43008 2006-07-01] (Advanced Micro Devices)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-09-05] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-07-29] (AVG Technologies)
S3 FsUsbExDisk; C:\WINDOWS\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-06] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-06] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-06] (HP)
R4 InCDfs; C:\Windows\System32\drivers\InCDFs.sys [118576 2007-05-15] (Nero AG)
R1 InCDPass; C:\Windows\System32\drivers\InCDPass.sys [37040 2007-05-15] (Nero AG)
U1 InCDrec; C:\Windows\System32\Drivers\InCDrec.sys [16304 2007-05-15] (Nero AG)
R1 incdrm; C:\Windows\System32\drivers\InCDRm.sys [38576 2007-05-15] (Nero AG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R3 msloop; C:\Windows\System32\DRIVERS\loop.sys [4992 2001-08-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [5248 2006-09-24] (Windows (R) 2000 DDK provider)
S4 IntelIde; No ImagePath
S3 nmwcd; system32\drivers\ccdcmb.sys [x]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [x]
U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-20 18:16 - 2013-10-20 18:16 - 00000000 ____D C:\FRST
2013-10-20 18:15 - 2013-10-19 19:47 - 01087515 _____ (Farbar) C:\Documents and Settings\Junková\Plocha\FRST.exe
2013-10-20 18:14 - 2013-10-20 18:14 - 00000000 ____D C:\WINDOWS\LastGood
2013-10-19 18:57 - 2013-10-19 18:59 - 00000000 ____D C:\AdwCleaner
2013-10-19 18:49 - 2013-10-19 18:49 - 00000000 ____D C:\WINDOWS\ERUNT
2013-10-19 18:49 - 2013-10-19 12:00 - 01050644 _____ C:\Documents and Settings\Junková\Plocha\adwcleaner.exe
2013-10-19 18:48 - 2013-10-19 12:00 - 01033335 _____ (Thisisu) C:\Documents and Settings\Junková\Plocha\JRT.exe
2013-10-18 16:50 - 2013-10-18 16:50 - 00000034 _____ C:\WINDOWS\setupact.log
2013-10-18 16:50 - 2013-10-18 16:50 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-10-18 16:39 - 2013-10-18 16:48 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-18 16:36 - 2013-10-20 18:14 - 00308088 _____ C:\WINDOWS\setupapi.log
2013-10-18 16:36 - 2013-10-20 18:12 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-10-18 16:36 - 2013-10-20 18:12 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-10-18 16:36 - 2013-10-18 16:36 - 00000000 _____ C:\WINDOWS\Sti_Trace.log
2013-10-18 16:35 - 2013-10-19 20:03 - 00002144 _____ C:\WINDOWS\SchedLgU.Txt
2013-10-18 16:34 - 2013-10-20 18:17 - 00168875 _____ C:\WINDOWS\WindowsUpdate.log
2013-10-18 16:29 - 2013-10-18 16:29 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google
2013-10-18 16:22 - 2013-10-18 16:22 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Program Files\Digiarty
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Documents and Settings\Junková\Data aplikací\Digiarty
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Digiarty
2013-10-10 08:34 - 2013-10-10 08:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
2013-10-10 08:34 - 2013-10-10 08:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
2013-10-10 08:27 - 2013-10-10 08:27 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2884256$
2013-10-10 08:26 - 2013-10-10 08:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$
2013-10-10 08:24 - 2013-10-10 08:24 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2883150$
2013-10-10 08:24 - 2013-10-10 08:24 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
2013-10-10 07:57 - 2013-07-03 04:12 - 00025088 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidparse.sys
2013-10-10 07:56 - 2013-08-29 02:56 - 00026240 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbser.sys
2013-10-10 07:56 - 2013-07-17 02:58 - 00123008 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbvideo.sys
2013-10-10 07:56 - 2013-07-17 02:58 - 00060160 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbaudio.sys
2013-10-10 07:55 - 2013-08-09 02:55 - 00144128 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbport.sys
2013-10-10 07:55 - 2013-08-09 02:55 - 00032384 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbccgp.sys
2013-10-10 07:55 - 2013-08-09 02:55 - 00005376 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbd.sys
2013-10-10 07:55 - 2009-03-18 13:02 - 00030336 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbehci.sys
2013-09-27 19:56 - 2013-09-27 19:56 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\tmp

==================== One Month Modified Files and Folders =======

2013-10-20 18:17 - 2013-10-18 16:34 - 00168875 _____ C:\WINDOWS\WindowsUpdate.log
2013-10-20 18:17 - 2013-08-05 17:59 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\MFAData
2013-10-20 18:16 - 2013-10-20 18:16 - 00000000 ____D C:\FRST
2013-10-20 18:15 - 2008-05-15 15:47 - 00000000 ____D C:\Documents and Settings\Junková\Plocha
2013-10-20 18:14 - 2013-10-20 18:14 - 00000000 ____D C:\WINDOWS\LastGood
2013-10-20 18:14 - 2013-10-18 16:36 - 00308088 _____ C:\WINDOWS\setupapi.log
2013-10-20 18:12 - 2013-10-18 16:36 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-10-20 18:12 - 2013-10-18 16:36 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-10-20 18:11 - 2008-05-19 18:33 - 00000000 ____D C:\Documents and Settings\Junková\Nabídka Start\Programy\CyberLink DVD Suite
2013-10-20 18:10 - 2008-05-15 15:36 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-10-19 20:03 - 2013-10-18 16:35 - 00002144 _____ C:\WINDOWS\SchedLgU.Txt
2013-10-19 20:03 - 2011-03-11 12:22 - 00524288 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2013-10-19 20:02 - 2008-05-15 15:47 - 00000178 ___SH C:\Documents and Settings\Junková\ntuser.ini
2013-10-19 19:47 - 2013-10-20 18:15 - 01087515 _____ (Farbar) C:\Documents and Settings\Junková\Plocha\FRST.exe
2013-10-19 18:59 - 2013-10-19 18:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 18:59 - 2012-06-30 18:39 - 00000000 __RHD C:\Documents and Settings\peta\Data aplikací
2013-10-19 18:59 - 2012-06-30 18:39 - 00000000 ___HD C:\Documents and Settings\peta\Local Settings\Data aplikací
2013-10-19 18:59 - 2008-05-15 15:47 - 00000000 ___HD C:\Documents and Settings\Junková\Local Settings\Data aplikací
2013-10-19 18:49 - 2013-10-19 18:49 - 00000000 ____D C:\WINDOWS\ERUNT
2013-10-19 18:46 - 2010-06-10 20:19 - 00000470 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{0198F379-F605-4197-A939-63656352C983}.job
2013-10-19 14:30 - 2008-05-30 10:06 - 00000352 _____ C:\WINDOWS\WINCMD.INI
2013-10-19 12:00 - 2013-10-19 18:49 - 01050644 _____ C:\Documents and Settings\Junková\Plocha\adwcleaner.exe
2013-10-19 12:00 - 2013-10-19 18:48 - 01033335 _____ (Thisisu) C:\Documents and Settings\Junková\Plocha\JRT.exe
2013-10-18 17:53 - 2008-05-15 15:47 - 00000000 ____D C:\Documents and Settings\Junková
2013-10-18 17:49 - 2008-05-19 19:23 - 00000000 ____D C:\Documents and Settings\Junková\Data aplikací\OpenOffice.org2
2013-10-18 16:59 - 2013-03-09 15:58 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-18 16:50 - 2013-10-18 16:50 - 00000034 _____ C:\WINDOWS\setupact.log
2013-10-18 16:50 - 2013-10-18 16:50 - 00000000 _____ C:\WINDOWS\setuperr.log
2013-10-18 16:48 - 2013-10-18 16:39 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-18 16:42 - 2012-04-01 08:28 - 00000000 ____D C:\Documents and Settings\Junková\Data aplikací\Kastner software
2013-10-18 16:42 - 2012-04-01 08:28 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\KASTNER software
2013-10-18 16:42 - 2008-05-15 17:13 - 00000000 ___RD C:\Documents and Settings\All Users\Nabídka Start\Programy
2013-10-18 16:42 - 2008-05-15 17:13 - 00000000 ____D C:\Documents and Settings\All Users\Plocha
2013-10-18 16:41 - 2008-05-15 17:12 - 00000211 ___SH C:\boot.ini
2013-10-18 16:41 - 2006-03-02 14:00 - 00000576 _____ C:\WINDOWS\win.ini
2013-10-18 16:41 - 2006-03-02 14:00 - 00000377 _____ C:\WINDOWS\system.ini
2013-10-18 16:36 - 2013-10-18 16:36 - 00000000 _____ C:\WINDOWS\Sti_Trace.log
2013-10-18 16:34 - 2011-03-03 15:45 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-10-18 16:32 - 2012-05-26 18:13 - 00000000 ____D C:\Program Files\MyHeritage
2013-10-18 16:30 - 2008-05-15 15:47 - 00000000 __RHD C:\Documents and Settings\Junková\Data aplikací
2013-10-18 16:29 - 2013-10-18 16:29 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google
2013-10-18 16:29 - 2011-03-03 15:45 - 00000000 ___HD C:\Documents and Settings\Administrator\Local Settings\Data aplikací
2013-10-18 16:29 - 2008-06-15 16:15 - 00000000 ____D C:\Program Files\Google
2013-10-18 16:29 - 2008-06-15 16:15 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\Google
2013-10-18 16:26 - 2009-05-12 13:51 - 00000000 ____D C:\ZALOHA
2013-10-18 16:22 - 2013-10-18 16:22 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-10-18 16:22 - 2011-03-03 15:45 - 00000000 ____D C:\Documents and Settings\Administrator\Oblíbené položky
2013-10-18 16:22 - 2011-03-03 15:45 - 00000000 ____D C:\Documents and Settings\Administrator
2013-10-18 15:57 - 2008-05-19 18:34 - 00000391 _____ C:\WINDOWS\lgfwup.ini
2013-10-18 15:57 - 2008-05-19 18:34 - 00000000 ____D C:\Program Files\lg_fwupdate
2013-10-18 15:45 - 2011-03-04 22:02 - 00012598 _____ C:\WINDOWS\system32\wpa.dbl
2013-10-15 08:18 - 2008-05-15 15:47 - 00000000 ___RD C:\Documents and Settings\Junková\Dokumenty\Obrázky
2013-10-14 08:13 - 2008-05-30 11:45 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-10-13 21:23 - 2010-02-04 12:26 - 00000940 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-13 21:23 - 2010-02-04 12:26 - 00000936 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-11 11:01 - 2008-05-15 15:47 - 00000000 ___RD C:\Documents and Settings\Junková\Oblíbené položky
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Program Files\Digiarty
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Documents and Settings\Junková\Data aplikací\Digiarty
2013-10-10 18:52 - 2013-10-10 18:52 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Digiarty
2013-10-10 08:49 - 2008-05-15 17:13 - 00125320 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-10-10 08:38 - 2008-05-15 17:14 - 01135612 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-10-10 08:34 - 2013-10-10 08:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
2013-10-10 08:34 - 2013-10-10 08:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
2013-10-10 08:30 - 2013-07-14 22:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-10-10 08:27 - 2013-10-10 08:27 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2884256$
2013-10-10 08:27 - 2008-05-15 17:23 - 78106760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-10-10 08:26 - 2013-10-10 08:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$
2013-10-10 08:25 - 2009-07-08 09:26 - 00000000 ____D C:\WINDOWS\ie8updates
2013-10-10 08:24 - 2013-10-10 08:24 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2883150$
2013-10-10 08:24 - 2013-10-10 08:24 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
2013-09-27 19:56 - 2013-09-27 19:56 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\tmp
2013-09-27 19:56 - 2008-05-15 17:13 - 00000000 __RHD C:\Documents and Settings\All Users\Data aplikací
2013-09-27 19:37 - 2008-05-15 17:13 - 00000000 ___RD C:\Documents and Settings\All Users\Dokumenty
2013-09-27 19:22 - 2009-08-16 18:30 - 00000000 ____D C:\Program Files\Fotolab
2013-09-23 23:55 - 2011-03-11 16:12 - 11113472 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ieframe.dll
2013-09-23 23:55 - 2007-08-13 18:54 - 11113472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-09-23 20:25 - 2012-06-13 08:07 - 00522240 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\jsdbgui.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 02006016 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iertutil.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 00743424 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iedvtool.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 00630272 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msfeeds.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 00247808 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ieproxy.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 00055296 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2013-09-23 20:25 - 2011-03-11 16:12 - 00012800 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xpshims.dll
2013-09-23 20:25 - 2008-05-15 15:28 - 00759296 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\vgx.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 06017536 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtml.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 06017536 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 01469440 ____N (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-09-23 20:25 - 2008-04-14 14:00 - 01469440 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\inetcpl.cpl
2013-09-23 20:25 - 2008-04-14 14:00 - 01215488 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\urlmon.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 01215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00920064 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wininet.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00611840 ____N (Microsoft Corporation) C:\WINDOWS\system32\mstime.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00611840 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mstime.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00387584 ____N (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00387584 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iedkcs32.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00206848 ____N (Microsoft Corporation) C:\WINDOWS\system32\occache.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00206848 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\occache.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00184320 ____N (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00184320 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iepeers.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00105984 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\url.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00067072 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00067072 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtmled.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00043520 ____N (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00043520 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\licmgr10.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00025600 ____N (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00025600 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\jsproxy.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00018944 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\corpol.dll
2013-09-23 20:25 - 2008-04-14 14:00 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\corpol.dll
2013-09-23 20:25 - 2007-08-13 18:54 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-09-23 20:25 - 2007-08-13 18:54 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll
2013-09-23 20:25 - 2007-08-13 18:34 - 02006016 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-09-23 20:06 - 2008-04-14 14:00 - 00385024 ____N (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2013-09-23 20:06 - 2008-04-14 14:00 - 00174592 ____N (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-09-23 20:06 - 2008-04-14 14:00 - 00174592 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ie4uinit.exe

Files to move or delete:
====================
C:\Documents and Settings\Junková\PCSC.EXE


Some content of TEMP:
====================
C:\Documents and Settings\Junková\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\Junková\Local Settings\Temp\siinst.exe
C:\Documents and Settings\Junková\Local Settings\Temp\strings.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 1034240 ____A (Microsoft Corporation) 27afd587c462e280ee046b8cca3c2cd1

C:\Windows\System32\winlogon.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0507904 ____A (Microsoft Corporation) cddb1f8e1aea356f3ad106f2cf9b7fea

C:\Windows\System32\svchost.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0014336 ____A (Microsoft Corporation) be4a520e29b6391f49e79ccc52044d93

C:\Windows\System32\services.exe
[2008-04-14 14:00] - [2009-02-09 13:25] - 0111104 ____A (Microsoft Corporation) 9ef697af07bb8dd82c3b02ca953a95b7

C:\Windows\System32\User32.dll
[2008-04-14 14:00] - [2008-04-14 14:00] - 0578560 ____A (Microsoft Corporation) e16e0990967374e76f3e40cacafd3d53

C:\Windows\System32\userinit.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0026112 ____A (Microsoft Corporation) 7dc1830f22e7d275b438127b68030239

C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 14:00] - [2008-04-14 14:00] - 0052480 ____A (Microsoft Corporation) 28a4b296b47782173c346e376cb374d1


==================== End Of Log ============================

Otevřte poznámkový blok a zkopírujte do něj:

Start
HKLM\...\Run: [UserFaultCheck] - %systemroot%\system32\dumprep 0 -u
HKLM\...\Run: [] - [x]
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MountPoints2: {2dc51d62-41f8-11de-ae58-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {2dc51d63-41f8-11de-ae58-001e8c855cc1} - F:\Start.exe
MountPoints2: {5dea6d69-5eaa-11df-b106-001e8c855cc1} - F:\Install_Nokia_Ovi_Suite.exe
MountPoints2: {8f7ad7d7-4ffa-11dd-afca-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {e7c1bbdd-c7c8-11e2-8862-001e8c855cc1} - F:\HTC_Sync_Manager_PC.exe
HKU\peta\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - No File
C:\Documents and Settings\Junková\Local Settings\Temp
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

log po fixu


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 19-10-2013
Ran by Junková at 2013-10-21 10:53:08 Run:1
Running from C:\Documents and Settings\Junková\Plocha
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
HKLM\...\Run: [UserFaultCheck] - %systemroot%\system32\dumprep 0 -u
HKLM\...\Run: [] - [x]
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MountPoints2: {2dc51d62-41f8-11de-ae58-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {2dc51d63-41f8-11de-ae58-001e8c855cc1} - F:\Start.exe
MountPoints2: {5dea6d69-5eaa-11df-b106-001e8c855cc1} - F:\Install_Nokia_Ovi_Suite.exe
MountPoints2: {8f7ad7d7-4ffa-11dd-afca-001e8c855cc1} - F:\EmDesk.exe
MountPoints2: {e7c1bbdd-c7c8-11e2-8862-001e8c855cc1} - F:\HTC_Sync_Manager_PC.exe
HKU\peta\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - No File
C:\Documents and Settings\Junková\Local Settings\Temp
End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\UserFaultCheck => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoCDBurning => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\swg => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2dc51d62-41f8-11de-ae58-001e8c855cc1} => Key deleted successfully.
HKCR\CLSID\{2dc51d62-41f8-11de-ae58-001e8c855cc1} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2dc51d63-41f8-11de-ae58-001e8c855cc1} => Key deleted successfully.
HKCR\CLSID\{2dc51d63-41f8-11de-ae58-001e8c855cc1} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5dea6d69-5eaa-11df-b106-001e8c855cc1} => Key deleted successfully.
HKCR\CLSID\{5dea6d69-5eaa-11df-b106-001e8c855cc1} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f7ad7d7-4ffa-11dd-afca-001e8c855cc1} => Key deleted successfully.
HKCR\CLSID\{8f7ad7d7-4ffa-11dd-afca-001e8c855cc1} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e7c1bbdd-c7c8-11e2-8862-001e8c855cc1} => Key deleted successfully.
HKCR\CLSID\{e7c1bbdd-c7c8-11e2-8862-001e8c855cc1} => Key not found.
HKU\peta\Software\Microsoft\Windows\CurrentVersion\Run\\swg => Value deleted successfully.
HKCR\PROTOCOLS\Handler\vnd.ms.radio => Key deleted successfully.
HKCR\CLSID\{3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} => Key not found.

"C:\Documents and Settings\Junková\Local Settings\Temp" directory move:

C:\Documents and Settings\Junková\Local Settings\Temp\jrt\APPID_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\APPID_files.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\appinit64_null.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\appinit_null.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\APPPATHS.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\APPROVEDEXTENSIONS_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\ask.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askCLSID.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askregkey_x64.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askregkey_x86.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askregvalue_x64.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askregvalue_x86.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\askservices.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badAPPINIT.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badFOLDERS.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badFOLDERScom.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badFOLDERSstart.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badLNK.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\badvalues.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\BHO_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\BHO_name.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\browsermngr_keys.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\browsermngr_values.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHOICE.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\chrome.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHRregkey_x64.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHRregkey_x86.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHR_extensions.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHR_open_x64.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CHR_open_x86.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\clean_shortcut.vbs => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CLSID_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\currentmd5.txt => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\CUT.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\datamngr_del.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\defaultscope.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\delfolders.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\delorphans.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\ELEVATIONPOLICY_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\ev_clear.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\EXT.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFbrowsermngr.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFextensions.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFpluginREG.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFplugins.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFprefs.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFregkey_x64.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFregkey_x86.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFwhtlist.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFXML.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FFXPI.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FF_open_x64.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FF_open_x86.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\firefox.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FWCLSID.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\FWPolicy.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\get.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\IEwhtlst.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\iexplore.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\IE_open_x64.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\IE_open_x86.reg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\IFEO.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\INTERFACE_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\JRT.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\medfos.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\MENUEXT.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\misc.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\modules.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\modules.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\moduleservices.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\newmd5.txt => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\NIRCMD.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\NOTIFY.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\PREAPPROVED_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\prelim.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\PRODUCTS.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhcr.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhkcu_and_hklm_allow.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhkcu_and_hklm_software.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhkcu_software_appdatalow.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhkcu_software_microsoft.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGhklm_software_classes.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\REGISTRYUSERSID.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\runvalues.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\runvalues_x64.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\runvalues_x86.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\S1518COMPONENTS.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\searchlnk.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\SED.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\sednewline.txt => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\services.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\serviceseventlog.cfg => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\SETTINGS_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\SHORTCUT.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\STATS_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\TDL4.bat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\TRACING.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\TYPELIB_clsid.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\UNINSTALL.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\UpgradeCodes.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\WGET.DAT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\WOW6432NODE.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\temp\null.txt => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERDNT.E_E => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERDNTDOS.LOC => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERDNTWIN.LOC => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERUNT.EXE => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERUNT.EXE.manifest => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\ERUNT.LOC => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\jrt\erunt\README.TXT => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\History\History.IE5\desktop.ini => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\History\History.IE5\index.dat => Moved successfully.
C:\Documents and Settings\Junková\Local Settings\Temp\Cookies\index.dat => Moved successfully.
Could not move "C:\Documents and Settings\Junková\Local Settings\Temp" directory. => Scheduled to move on reboot.


=========== Result of Scheduled Files to move ===========

C:\Documents and Settings\Junková\Local Settings\Temp => Moved successfully.

==== End of Fixlog ====

Smazáno. Nastala nějaká změna?

Stav pořád stejný - nemohu se dostat do ovládacích panelů + při startu vyjíždí tabulka s potvrzením že souhlasím se spuštění systému jako ... uživatel

Zkuste obnovu systému k datu, kdy korektně fungoval.

To je taky problém jelikož to není můj pc a uživatel si ani nepamatuje od kdy mu vyskakuje hláška. Při kontrole bodu obnovení se sekla ještě jedna aktualizace, takže tam je 3měsíce každý den bod obnovy na uvedenou aktualizaci. Zkoušel jsem měsíc zpět a nic.

Pokud nevíte, zkuste ten nejstarší. Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

log z combofix

Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.894.354 [GMT 1:00]
Spuštěný z: c:\documents and settings\Junkovß\Plocha\abc.exe
AV: AVG AntiVirus 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\peta\WINDOWS
c:\documents and settings\peta\WINDOWS\lgfwup.ini
C:\install.exe
c:\windows\system32\Cache
c:\windows\system32\Cache\26c630d098e22dd5.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\3f531093e7301a5d.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\79a4279ac09abd6e.fb
c:\windows\system32\Cache\8d90e4796deeee48.fb
c:\windows\system32\Cache\95f567698be8a182.fb
c:\windows\system32\Cache\9ac731555d43f07f.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\bfca0f64a993be0b.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\cce9b1d864dca7fb.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e7ba540885dc6f43.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\SET133.tmp
c:\windows\system32\SET134.tmp
c:\windows\system32\SET139.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-09-28 do 2013-10-28 )))))))))))))))))))))))))))))))
.
.
2013-10-28 13:09 . 2013-10-28 13:23 -------- d-----w- c:\program files\NirSoft
2013-10-20 16:16 . 2013-10-21 08:54 -------- d-----w- C:\FRST
2013-10-19 16:57 . 2013-10-19 16:59 -------- d-----w- C:\AdwCleaner
2013-10-19 16:49 . 2013-10-19 16:49 -------- d-----w- c:\windows\ERUNT
2013-10-18 14:29 . 2013-10-18 14:29 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2013-10-18 14:22 . 2013-10-18 14:22 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2013-10-10 16:52 . 2013-10-10 16:52 -------- d-----w- c:\documents and settings\Junková\Data aplikací\Digiarty
2013-10-10 16:52 . 2013-10-10 16:52 -------- d-----w- c:\program files\Digiarty
2013-10-10 05:57 . 2013-07-03 02:12 25088 -c----w- c:\windows\system32\dllcache\hidparse.sys
2013-10-10 05:56 . 2013-08-29 00:56 26240 -c----w- c:\windows\system32\dllcache\usbser.sys
2013-10-10 05:56 . 2013-07-17 00:58 60160 -c----w- c:\windows\system32\dllcache\usbaudio.sys
2013-10-10 05:56 . 2013-07-17 00:58 123008 -c----w- c:\windows\system32\dllcache\usbvideo.sys
2013-10-10 05:55 . 2013-08-09 00:55 32384 -c----w- c:\windows\system32\dllcache\usbccgp.sys
2013-10-10 05:55 . 2013-08-09 00:55 5376 -c----w- c:\windows\system32\dllcache\usbd.sys
2013-10-10 05:55 . 2009-03-18 11:02 30336 -c----w- c:\windows\system32\dllcache\usbehci.sys
2013-10-10 05:55 . 2013-08-09 00:55 144128 -c----w- c:\windows\system32\dllcache\usbport.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-23 18:25 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-09-23 18:25 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-09-23 18:25 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-09-23 18:25 . 2008-04-14 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2013-09-23 18:06 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2013-09-09 23:34 . 2013-03-01 08:32 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
2013-09-04 23:43 . 2013-07-09 23:32 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2013-08-29 07:01 . 2008-04-14 12:00 1878656 ----a-w- c:\windows\system32\win32k.sys
2013-08-29 00:56 . 2008-04-14 00:15 26240 ----a-w- c:\windows\system32\drivers\usbser.sys
2013-08-09 01:56 . 2008-04-14 12:00 386560 ----a-w- c:\windows\system32\themeui.dll
2013-08-05 13:30 . 2008-04-14 12:00 1289216 ----a-w- c:\windows\system32\ole32.dll
2013-08-02 23:48 . 2006-10-18 19:47 1543680 ------w- c:\windows\system32\wmvdecod.dll
2011-12-02 18:53 . 2011-12-02 18:53 58442406 ----a-w- c:\program files\fullfree.exe - pcs free ucto.exe
2008-06-15 13:59 . 2008-06-15 13:59 22414120 ----a-w- c:\program files\SkypeSetup.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
.
[-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
.
[-] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[-] 2008-04-14 . 1B6162FE7F66B1A71A4B70F941C4AA9B . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
.
[-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
.
[-] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2012-07-06 . 89E739BBA5F636297EA5B5F811189E06 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
[-] 2012-07-06 . 89E739BBA5F636297EA5B5F811189E06 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
[-] 2012-07-06 . 218B3BBB1FAD634A84FB1A1BB030D956 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219\SP3QFE\browser.dll
.
[-] 2008-04-14 . ED0A176354487CEED65B80A7148AB739 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2008-04-14 . ED0A176354487CEED65B80A7148AB739 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe
.
[-] 2008-04-14 . 72E1E9E2977BE08BDEEDB6D8FD9D4D40 . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2008-04-14 . 72E1E9E2977BE08BDEEDB6D8FD9D4D40 . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll
.
[-] 2008-04-14 12:00 . E7B375DFFB68A16659CA66474A280C47 . 806912 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[-] 2008-04-14 12:00 . E7B375DFFB68A16659CA66474A280C47 . 806912 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll
.
[-] 2008-04-14 . 19395D092FD85DDC2D9C7729CF5A2AC8 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-14 . 19395D092FD85DDC2D9C7729CF5A2AC8 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
[-] 2008-04-14 . 19395D092FD85DDC2D9C7729CF5A2AC8 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll
.
[-] 2009-02-09 . C0BD34A62508BA68F146E22CE45919F9 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2009-02-09 . BE27674D1CBC3214AEC84B4336A38BBF . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . BE27674D1CBC3214AEC84B4336A38BBF . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
.
[-] 2009-02-09 . 9EF697AF07BB8DD82C3B02CA953A95B7 . 111104 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-09 . 9EF697AF07BB8DD82C3B02CA953A95B7 . 111104 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-09 . 3D107D45CCFDB266E91D84B52CD7F430 . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
.
[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
.
[-] 2008-04-14 . CDDB1F8E1AEA356F3AD106F2CF9B7FEA . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . CDDB1F8E1AEA356F3AD106F2CF9B7FEA . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2010-08-23 . E145ADD7DAEF759C4F5FB80A180A9C30 . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . E145ADD7DAEF759C4F5FB80A180A9C30 . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 8A72A30FDC803DC06755D3B36D966F31 . 1054208 . . [6.0] . . c:\windows\WinSxS\InstallTemp\4420243\comctl32.dll
[-] 2010-08-23 . 8A72A30FDC803DC06755D3B36D966F31 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\InstallTemp\61384\comctl32.dll
[-] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2008-04-14 . D7B7AE36A2EBA312AC4B53862019B3F5 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2006-03-02 . F76B3003366A205E05AFC0D034C7D3E9 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
.
[-] 2008-04-14 . F3AB0933CBD166D271992F411C27CCAF . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2008-04-14 . F3AB0933CBD166D271992F411C27CCAF . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll
.
[-] 2008-07-07 20:29 . A371F11EF07653591C8DE26AFB13CE7F . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:29 . A371F11EF07653591C8DE26AFB13CE7F . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[-] 2008-07-07 20:25 . BE68EA4457E2E5717231CF91BE5448E0 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
.
[-] 2008-04-14 . 6C60CA8AC7470AC01CFD3D24C7283CD1 . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2008-04-14 . 6C60CA8AC7470AC01CFD3D24C7283CD1 . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll
.
[-] 2012-10-03 . C067B66AE1C6E0C6F26509D084D3DE7F . 988672 . . [5.1.2600.6293] . . c:\windows\system32\kernel32.dll
[-] 2012-10-03 . C067B66AE1C6E0C6F26509D084D3DE7F . 988672 . . [5.1.2600.6293] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2012-10-03 . 2894EA9D89C83F65331E06AB94FB6225 . 990208 . . [5.1.2600.6293] . . c:\windows\$hf_mig$\KB2758857\SP3QFE\kernel32.dll
[-] 2009-03-21 . 0D8F61460F84139BBE5E391D8DE18D9A . 990208 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
.
[-] 2008-04-14 . 7FDE9FC15765E02B23E1756930165AD1 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2008-04-14 . 7FDE9FC15765E02B23E1756930165AD1 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll
.
[-] 2008-04-14 . C66BA7BD13C8FB8BEC4863B88641C763 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2008-04-14 . C66BA7BD13C8FB8BEC4863B88641C763 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
.
[-] 2008-04-14 . D165DFCB4EA452510E53416F573018BB . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2008-04-14 . D165DFCB4EA452510E53416F573018BB . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll
[-] 2008-04-14 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2008-04-14 . EC8D5E09C6CA5F52858A5EB71F308FDF . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2006-03-02 . AB47015B67531572BE46C0C08222C84C . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
.
[-] 2008-06-20 . B6CEC406351EA5EF131416D5F52D006F . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[-] 2008-06-20 . B6CEC406351EA5EF131416D5F52D006F . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 39EE7C3BFBC64BA87CC8CF67386E814C . 247296 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 39EE7C3BFBC64BA87CC8CF67386E814C . 247296 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
.
[-] 2008-04-14 . C2ED0E3408F50BBC149D4F0936E67832 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2008-04-14 . C2ED0E3408F50BBC149D4F0936E67832 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll
.
[-] 2008-04-14 . 9FA69781CAA7A1DA981A24F240A61A60 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2008-04-14 . 9FA69781CAA7A1DA981A24F240A61A60 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll
.
[-] 2008-04-14 . 830CE8951C71F361D7D2F38416CC8BC1 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2008-04-14 . 830CE8951C71F361D7D2F38416CC8BC1 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll
.
[-] 2008-04-14 . 5EE949255BABC0B17C09DDB2E59E3878 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2008-04-14 . 5EE949255BABC0B17C09DDB2E59E3878 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll
.
[-] 2008-04-14 . BE4A520E29B6391F49E79CCC52044D93 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2008-04-14 . BE4A520E29B6391F49E79CCC52044D93 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe
.
[-] 2008-04-14 . C2546CD7A398476F9DF5614B2AE160E8 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2008-04-14 . C2546CD7A398476F9DF5614B2AE160E8 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll
.
[-] 2008-04-14 . E16E0990967374E76F3E40CACAFD3D53 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2008-04-14 . E16E0990967374E76F3E40CACAFD3D53 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll
.
[-] 2008-04-14 . 7DC1830F22E7D275B438127B68030239 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-04-14 . 7DC1830F22E7D275B438127B68030239 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe
.
[-] 2008-04-14 . 951D473917C51F21496D914CF6E5DDD1 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2008-04-14 . 951D473917C51F21496D914CF6E5DDD1 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll
.
[-] 2008-04-14 . 859F7735F199C90403340183A3DDFB78 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[-] 2008-04-14 . 859F7735F199C90403340183A3DDFB78 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll
.
[-] 2008-04-14 . 27AFD587C462E280EE046B8CCA3C2CD1 . 1034240 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 27AFD587C462E280EE046B8CCA3C2CD1 . 1034240 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-04-14 . FDEB1D02CAE38665CBF114F44E6B997E . 147968 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . FDEB1D02CAE38665CBF114F44E6B997E . 147968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2008-04-14 . AF6A4BCDE2343E8562D3003A1740CC96 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
.
[-] 2008-04-14 . A756B8F0F7BAFBA6DFE39F7D169F2519 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-04-14 . A756B8F0F7BAFBA6DFE39F7D169F2519 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe
.
[-] 2009-07-27 . EE9A2B9EA968A792A053C9D1A86BF870 . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . EE9A2B9EA968A792A053C9D1A86BF870 . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 54A6BF743E0517528A5064CEAEB40EA7 . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
.
[-] 2008-04-14 . 627551A1011199BCE013D0F4B6CACECF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll
[-] 2008-04-14 . 627551A1011199BCE013D0F4B6CACECF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msimg32.dll
.
[-] 2008-04-14 . 35B91147124F64AC8081A2EDB9EA4DEE . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-04-14 . 35B91147124F64AC8081A2EDB9EA4DEE . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-04-14 . 278A14BEDEF58687EAF8BEC056A78D8B . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-14 . 278A14BEDEF58687EAF8BEC056A78D8B . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
.
[-] 2008-04-14 . EAA4BB9EDB3FB10CF8979FE65E63658F . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2008-04-14 . EAA4BB9EDB3FB10CF8979FE65E63658F . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll
.
[-] 2010-12-09 . AB5CE6ECA795C0AAD55D6584293D7B51 . 713216 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[-] 2010-12-09 . 0A12141F94F9C7A478AF490454320E97 . 713216 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[-] 2010-12-09 . 0A12141F94F9C7A478AF490454320E97 . 713216 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[-] 2009-02-09 . AAD43A0B688335A38807CEEAC70DD3EE . 710144 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
.
[-] 2008-04-14 . 26AE5F5ADF4A30C8BCEA736343170201 . 177152 . . [5.1.2600.5512] . . c:\windows\system32\MSCTFIME.IME
[-] 2008-04-14 . 26AE5F5ADF4A30C8BCEA736343170201 . 177152 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msctfime.ime
.
[-] 2008-04-14 . 2EE99F67C930931EB404DADCE57E976E . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2008-04-14 . 2EE99F67C930931EB404DADCE57E976E . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll
.
[-] 2008-04-14 . 56A6034E7764E23D9114223EB3523925 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2008-04-14 . 56A6034E7764E23D9114223EB3523925 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2008-04-14 . 8F31505484A190D5B22274708799F4EC . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-04-14 . 8F31505484A190D5B22274708799F4EC . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
.
[-] 2008-04-14 . 3FF232A7731621B8902D81D42418C93C . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2008-04-14 . 3FF232A7731621B8902D81D42418C93C . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll
.
[-] 2008-04-14 . BECD5271DC4E3B7C3D035F790FCBC1E5 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2008-04-14 . BECD5271DC4E3B7C3D035F790FCBC1E5 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll
.
[-] 2008-04-14 . A75DD6FC3DBEE4FFF5EBC9F2C28BB66E . 295936 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2008-04-14 . A75DD6FC3DBEE4FFF5EBC9F2C28BB66E . 295936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll
.
[-] 2008-04-14 . ED18ADEE4AA21EB26977260152D7241A . 345088 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[-] 2008-04-14 . ED18ADEE4AA21EB26977260152D7241A . 345088 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll
.
[-] 2008-04-14 . AFDFF022A01F0B11C776F0860C3B282F . 11776 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[-] 2008-04-14 12:00 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
.
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
.
[-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[-] 2010-09-18 07:18 . 2BC3ED47ACB42F664D5D1D247F2553AA . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . 9BB005DF755C4EDE048221DFD4A28A87 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . 9BB005DF755C4EDE048221DFD4A28A87 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
.
[-] 2008-04-14 . 221CD1C815B8A6B79389C3F5D1018DE8 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2008-04-14 . 221CD1C815B8A6B79389C3F5D1018DE8 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll
.
[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
.
[-] 2008-04-14 12:00 . 023DD70573D644F3D9C8B1258A7BFD08 . 435712 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2008-04-14 12:00 . 023DD70573D644F3D9C8B1258A7BFD08 . 435712 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll
.
[-] 2008-04-14 . 651BD90DCEE5B7BDC74A2EB7C9266F9E . 186368 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2008-04-14 . 651BD90DCEE5B7BDC74A2EB7C9266F9E . 186368 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll
.
[-] 2008-04-14 . 8E009E7AC012823845D5F39A77F4A27F . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[-] 2008-04-14 . 8E009E7AC012823845D5F39A77F4A27F . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll
.
[-] 2008-04-14 . 3B8AE11A3419DF8239183E94888702FA . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[-] 2008-04-14 . 3B8AE11A3419DF8239183E94888702FA . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll
.
[-] 2008-04-14 . EDAD701F01FFD9B5799B8FCF1CF6BDA7 . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[-] 2008-04-14 . EDAD701F01FFD9B5799B8FCF1CF6BDA7 . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll
.
[-] 2008-04-14 12:00 . 16C195EBC0A3EC35C48D0C2D9A346BAB . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[-] 2008-04-14 12:00 . 16C195EBC0A3EC35C48D0C2D9A346BAB . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll
.
[-] 2008-04-14 . 1682285F7C0934C764A0EBBC568153CA . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[-] 2008-04-14 . 1682285F7C0934C764A0EBBC568153CA . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
.
[-] 2008-04-14 . 614F8186BDAB926E3B1D8927A4161B54 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[-] 2008-04-14 . 614F8186BDAB926E3B1D8927A4161B54 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll
.
[-] 2008-04-14 . 35B91147124F64AC8081A2EDB9EA4DEE . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-04-14 . 35B91147124F64AC8081A2EDB9EA4DEE . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-04-14 . FA4E1CDBA256787F2149F4AAD07BC91F . 176640 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
[-] 2008-04-14 . FA4E1CDBA256787F2149F4AAD07BC91F . 176640 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll
.
[-] 2008-04-14 . C1CDD9275F6A115BB0AE1D55D8D27BA6 . 334336 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2008-04-14 . C1CDD9275F6A115BB0AE1D55D8D27BA6 . 334336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll
.
[-] 2008-04-14 . 160A1500DDBE42F8793E3AD341E4BEC4 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[-] 2008-04-14 . 160A1500DDBE42F8793E3AD341E4BEC4 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll
.
[-] 2008-04-14 . B26098F3DC08D841DE3D79C38ACCB807 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2008-04-14 . B26098F3DC08D841DE3D79C38ACCB807 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll
.
[-] 2008-04-14 . 8DBCEA7B495024A29FEF59B5FE709DAC . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[-] 2008-04-14 . 8DBCEA7B495024A29FEF59B5FE709DAC . 19456 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wshtcpip.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LoadPowerProfile"="powrprof.dll" [2008-04-14 17408]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 196608]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"RTHDCPL"="RTHDCPL.EXE" [2010-11-16 19722344]
"HPUsageTrackingLEDM"="c:\program files\HP\HP UT LEDM\bin\hppusg.exe" [2009-10-15 30264]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-09-22 4411952]
"LGODDFU"="c:\program files\lg_fwupdate\lgfw.exe" [2012-09-21 27760]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Security Toolbar Service"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [20.7.2013 0:50 60216]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [20.7.2013 0:51 246072]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [10.7.2013 0:32 39224]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [20.7.2013 0:50 208184]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [1.3.2013 9:32 22328]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [20.7.2013 0:50 171320]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [21.3.2013 2:08 182072]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [8.11.2012 17:43 37664]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [23.7.2013 18:09 283136]
R2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [15.10.2009 10:13 136192]
R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [29.1.2012 16:06 99896]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [7.12.2012 17:27 167424]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [26.11.2010 23:55 398176]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5.8.2013 17:26 22856]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [4.7.2013 14:53 4939312]
S2 gupdate1caa5828e1060d0;Služba Google Update (gupdate1caa5828e1060d0);c:\program files\Google\Update\GoogleUpdate.exe [4.2.2010 11:12 133104]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5.8.2013 17:26 701512]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [27.12.2010 20:02 1691480]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [27.4.2010 18:00 36608]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [27.5.2013 17:44 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [7.12.2012 17:27 21248]
S3 mvusbews;USB EWS Device;c:\windows\system32\drivers\mvusbews.sys [29.1.2012 16:06 17408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
c:\windows\SYSTEM\ie4uinit.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4395}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-10-18 19:50 1185744 ----a-w- c:\program files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 10:12]
.
2013-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 10:12]
.
2013-10-28 c:\windows\Tasks\User_Feed_Synchronization-{0198F379-F605-4197-A939-63656352C983}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: csob.cz\bb24
Trusted Zone: csob.cz\ib24
TCP: DhcpNameServer = 10.0.0.138
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: GEMINI IBS 31 RZB Applet Security - hxxps://ibs.rb.cz/IB/bin/IBS31-RZB-aplsec-3.3.0.0.cab
DPF: GEMINI IBS 32 GEMB Applet Security - hxxps://ib.internetbanka.cz/ibs31/bin/IBS32-GEMB-aplsec-3.3.0.0.cab
DPF: GEMINI IBS 32 GEMB Applet Utilities - hxxps://ib.internetbanka.cz/ibs31/bin/IBS32-GEMB-aplutil-99.99.99.99.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab
DPF: {1AE23F24-D3E4-4C57-8468-6618B9B8B70F} - hxxps://ib24.csob.cz/comp/IcaSignerCZ.cab
DPF: {461A37E7-17B3-40E3-B6BB-7CAEC732C9E4} - hxxps://ib24.csob.cz/comp/CSOBEnroll.dll
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.fotostar.cz/snadno-vlozit-fotografie/fs/FotoStarPhotoUploader.dll
DPF: {8DB83558-B5E6-4449-8E59-B91126580A99} - hxxps://ib24.csob.cz/comp/ICAHsmEngine.dll
DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} - hxxp://asp.photoprintit.de/microsite/11466/defaults/activex/ips/IPSUploader4.cab
FF - ProfilePath - c:\documents and settings\Junková\Data aplikací\Mozilla\Firefox\Profiles\s98147at.default\
FF - prefs.js: browser.search.selectedEngine - Slunečnice
.
.
------- Asociace souborů -------
.
inifile=c:\windows\NOTEPAD.EXE %1
txtfile=c:\windows\NOTEPAD.EXE %1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{7D688A77-C613-11D0-999B-00C04FD655E1} - (no file)
HKCU-Run-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
HKLM-Run-Family Tree Builder Update - c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
HKLM_ActiveSetup-AppletsPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-FontsPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-MmoptRegisterPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-MotownAvivideoPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-MotownMmsysPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-MotownMPlayPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-MotownRecPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUserOldLinks - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Base - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Calc_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_CDPlayer_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_CVT_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_DCC_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Dialer_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_ICW_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_LinkBar_URLs - c:\windows\COMMAND\sulfnbk.exe
HKLM_ActiveSetup-PerUser_Msinfo - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Msinfo2 - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_MSWordPad_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Paint_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_RNA_Inis - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_Vol - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_winapps_Links - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-PerUser_winbase_Links - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-SetupcPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-Shell2PerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-ShellPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-TapiPerUser - rundll.exe c:\windows\SYSTEM\setupx.dll
HKLM_ActiveSetup-{89820200-ECBD-11cf-8B85-00AA005B4383} - c:\windows\SYSTEM\ie4uinit.exe
HKLM_ActiveSetup-{89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\windows\SYSTEM\Rundll32.exe
HKLM_ActiveSetup-{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - c:\windows\SYSTEM\updcrl.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-10-28 14:56
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2013-10-28 15:00:09
ComboFix-quarantined-files.txt 2013-10-28 14:00
.
Před spuštěním: Volných bajtů: 132 868 997 120
Po spuštění: Volných bajtů: 134 456 324 096
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 9F4D33D2AE0E262E669817C363061FA4
8F558EB6672622401DA993E1E865C861

Přesuňte ComboFix na kořenový adresář c:\. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte rovněž na kořenový adresář c:\ jako CFSript.txt. Pak jej myší (v průzkumníku windows, nebo jiném souobrovém manažeru) přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

úprava provedena pořád stejný stav

Oprava systému se zdá být nezbytná. Vložte instal médium do mechaniky, nastartujte PC z disku CD (jako první bootovací pořadí zvolte opt. mechaniku). Pak sledujte dolní lištu instalátoru a až se podruhé objeví "R-opravit", stiskněte "R" a pokračujte v instalaci. Proběhne jakoby instalace, ale instalátor pouze přepíše původní soubory novými z instal. média. Nastavení systému zůstane zachováno. Pokud se toto nezdaří, zbývá reinstal.

Děkuji za ochotu - o víkendu skusím opravu systému