Log z Combofix

[Vojta11]

Dobrý den všem !
Měl jsem poslední dobou pár problémů s notebookem právě kvůli existenci spyware a malware v mém počítači. Vyčistil jsem to několikery programy + dnes jsem použil program Combofix. Jde jasně poznat, že po jeho vyčištění počítače je vše svižnější, nemám rozjetých tolik procesů, a obnovila se mi funkce některých programů (např. i správného fungování Awastu, který mi dotyčny malware vypínal). Přesto si však nemůže být člověk nikdy jistý, proto Vám tady posílám pro posouzení můj log. Děkuji za Vaše názory a připomínky! Snad už bude zase systém fungovat, tak jak má, bez zbytečných chybných hlášení.

ComboFix 15-02-09.01 - MoRF 10.02.2015 11:19:46.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4030.1654 [GMT 1:00]
Spuštěný z: c:\users\MoRF\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome.manifest
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\constants.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\convertvideo.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\convertvideodlg.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\events.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\savetomp3popup.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\tbcore.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\weather.js
c:\program files (x86)\Mozilla Firefox\extensions\mp3tubetoolbar@mp3tubetoolbar.com\chrome\content\weatherLoc.js
c:\program files (x86)\Mp3Tube Toolbar
c:\program files (x86)\Mp3Tube Toolbar\ffmpeg.exe
c:\program files (x86)\Mp3Tube Toolbar\Mp3TubeSvc.exe
c:\program files (x86)\Mp3Tube Toolbar\mp3tubetb.dll
c:\program files (x86)\Mp3Tube Toolbar\Mp3TubeVideoToMp3.exe
c:\program files (x86)\Mp3Tube Toolbar\ShowMsg.exe
c:\program files (x86)\Mp3Tube Toolbar\uninstall.exe
c:\program files (x86)\unoisales
c:\program files (x86)\unoisales\sTBOXntxRPXiRt.dat
c:\program files (x86)\unoisales\sTBOXntxRPXiRt.exe
c:\program files (x86)\unoisales\sTBOXntxRPXiRt.tlb
c:\program files (x86)\youtubeadblocker
c:\program files (x86)\youtubeadblocker\fWZW1C8YZa53yf.dat
c:\program files (x86)\YoutubeAdblocker\fWZW1C8YZa53yf.exe
c:\program files (x86)\YoutubeAdblocker\fWZW1C8YZa53yf.tlb
c:\programdata\1fd70115f41e5da91697d54769109026_c
c:\programdata\9334916038622345492
c:\programdata\9334916038622345492\cd5b15e575e1c3d0ea3d6825d7b56115.ini
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek\123\A.js
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek\123\background.html
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek\123\content.js
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek\123\lsdb.js
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmfcfjopbfmekonldgghddhkphapbpek\123\manifest.json
c:\users\MoRF\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\MoRF\AppData\Roaming\chrtmp
c:\users\MoRF\AppData\Roaming\inst.exe
c:\users\MoRF\AppData\Roaming\vso_ts_preview.xml
c:\windows\msdownld.tmp
c:\windows\SysWow64\tmpD6C0.tmp
c:\windows\SysWow64\tmpD70F.tmp
c:\windows\Tasks\DLL-files.com Fixer_UPDATES.job
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Mp3Tube Toolbar Service
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-01-10 do 2015-02-10 )))))))))))))))))))))))))))))))
.
.
2015-02-10 10:40 . 2015-02-10 10:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-02-07 15:41 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2015-02-07 15:41 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2015-02-07 15:16 . 2015-02-07 15:37 -------- d-----w- c:\program files (x86)\Tom Clancy's Ghost Recon Future Soldier
2015-02-06 22:07 . 2015-02-06 22:07 -------- d-----w- c:\users\MoRF\AppData\Local\storage
2015-02-06 15:30 . 2015-02-06 15:30 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{78A98055-4976-48DA-98D4-5F339D73223A}\offreg.dll
2015-02-06 15:09 . 2014-12-15 03:13 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{78A98055-4976-48DA-98D4-5F339D73223A}\mpengine.dll
2015-02-06 14:48 . 2015-02-06 14:48 -------- d-s---w- c:\windows\system32\CompatTel
2015-02-06 14:48 . 2015-02-06 14:48 -------- d-----w- c:\windows\system32\appraiser
2015-02-04 18:36 . 2015-02-04 19:04 5070512 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-02-02 19:46 . 2015-02-02 19:46 -------- d-----w- C:\TML-Studios
2015-02-02 18:51 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2015-02-02 18:51 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2015-02-02 18:51 . 2014-10-18 02:05 861696 ----a-w- c:\windows\system32\oleaut32.dll
2015-02-02 18:51 . 2014-10-18 01:33 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-02-02 18:51 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2015-02-02 18:51 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2015-02-01 19:50 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2015-02-01 19:50 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2015-02-01 18:57 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
2015-02-01 18:57 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2015-02-01 18:57 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
2015-02-01 18:57 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
2015-02-01 18:57 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
2015-02-01 18:57 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2015-02-01 18:56 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2015-02-01 18:56 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-01-30 19:39 . 2015-01-30 19:38 364512 ----a-w- c:\windows\system32\aswBoot.exe
2015-01-30 19:38 . 2015-01-30 19:38 43152 ----a-w- c:\windows\avastSS.scr
2015-01-29 09:49 . 2014-01-24 02:37 1684928 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-01-28 17:57 . 2015-01-28 17:57 -------- d-----w- c:\programdata\Emsisoft
2015-01-28 16:14 . 2015-01-28 16:14 -------- d-----w- c:\program files (x86)\Redmine Issues Checker
2015-01-28 16:13 . 2015-01-28 16:13 -------- d-----w- c:\program files (x86)\unaissales
2015-01-28 16:13 . 2015-01-28 16:13 -------- d-----w- c:\programdata\baekhlfkblckjecopnnhmffmkagfhehp
2015-01-28 16:13 . 2015-01-28 16:13 -------- d-----w- c:\program files (x86)\uneiSaoleSu
2015-01-28 16:13 . 2015-01-28 16:13 -------- d-----w- c:\programdata\icjpkdjolgfehjmkkmgogebpmkmkenke
2015-01-28 16:10 . 2015-02-10 10:50 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2015-01-28 16:01 . 2015-02-10 10:45 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2015-01-28 11:05 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-01-28 11:05 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-01-28 11:05 . 2014-10-14 02:13 683520 ----a-w- c:\windows\system32\termsrv.dll
2015-01-28 11:05 . 2014-10-14 02:07 681984 ----a-w- c:\windows\system32\adtschema.dll
2015-01-28 11:05 . 2014-10-14 01:46 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
2015-01-28 11:05 . 2014-10-14 02:09 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-01-28 11:05 . 2014-10-14 01:47 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2015-01-28 11:04 . 2014-12-11 17:47 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-01-28 11:04 . 2014-12-06 04:17 303616 ----a-w- c:\windows\system32\nlasvc.dll
2015-01-28 11:04 . 2014-12-06 03:50 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll
2015-01-28 11:04 . 2014-12-06 03:50 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2015-01-28 11:04 . 2014-03-26 14:44 2002432 ----a-w- c:\windows\system32\msxml6.dll
2015-01-28 11:04 . 2014-03-26 14:41 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-01-28 11:04 . 2014-03-26 14:27 1389056 ----a-w- c:\windows\SysWow64\msxml6.dll
2015-01-28 11:04 . 2014-03-26 14:25 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2015-01-28 11:04 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2015-01-28 11:04 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2015-01-28 11:02 . 2014-03-04 09:44 722944 ----a-w- c:\windows\system32\objsel.dll
2015-01-28 11:01 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2015-01-28 11:00 . 2014-08-29 02:07 44032 ----a-w- c:\windows\system32\tsgqec.dll
2015-01-28 10:59 . 2014-06-25 02:05 14175744 ----a-w- c:\windows\system32\shell32.dll
2015-01-28 10:59 . 2014-12-12 05:35 5553592 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-01-28 10:59 . 2014-12-12 05:11 3971512 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-01-28 10:59 . 2014-12-12 05:11 3916728 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-01-28 10:59 . 2014-12-12 05:31 503808 ----a-w- c:\windows\system32\srcore.dll
2015-01-28 10:59 . 2014-12-12 05:31 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-01-28 10:59 . 2014-12-12 05:31 50176 ----a-w- c:\windows\system32\srclient.dll
2015-01-28 10:59 . 2014-11-08 03:16 2048 ----a-w- c:\windows\system32\tzres.dll
2015-01-28 10:59 . 2014-11-08 02:45 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2015-01-28 10:57 . 2014-10-10 00:57 3198976 ----a-w- c:\windows\system32\win32k.sys
2015-01-28 10:29 . 2015-01-28 10:29 -------- d-----w- c:\users\MoRF\AppData\Roaming\Enigma Software Group
2015-01-28 10:28 . 2015-01-28 10:28 -------- d-----w- C:\sh4ldr
2015-01-28 10:26 . 2015-01-28 10:26 22704 ----a-w- c:\windows\system32\drivers\EsgScanner.sys
2015-01-28 10:25 . 2015-01-28 10:25 -------- d-----w- c:\program files\Enigma Software Group
2015-01-27 22:06 . 2015-01-27 22:43 -------- d-----w- C:\AdwCleaner
2015-01-27 21:56 . 2015-01-27 21:56 -------- d-----w- c:\users\MoRF\AppData\Roaming\SUPERAntiSpyware.com
2015-01-27 21:55 . 2015-01-28 10:05 -------- d-----w- c:\program files\SUPERAntiSpyware
2015-01-27 21:55 . 2015-01-27 21:55 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2015-01-27 21:33 . 2015-01-28 10:03 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2015-01-27 21:33 . 2015-01-27 21:33 -------- d-----w- c:\programdata\Malwarebytes
2015-01-24 21:02 . 2015-01-28 09:56 -------- d-----w- C:\R.G. Catalyst
2015-01-23 22:01 . 2015-01-23 22:01 -------- d-----w- c:\users\MoRF\AppData\Local\Dovetail_Games
2015-01-23 20:44 . 2014-06-11 10:18 295736 ----a-w- c:\windows\SysWow64\mintcastnetworks.dll
2015-01-23 20:42 . 2015-01-23 20:42 -------- d-----w- c:\program files (x86)\Hahomedia
2015-01-23 20:39 . 2015-01-23 20:39 -------- d-----w- c:\users\MoRF\AppData\Roaming\WinRARPasswordCracker.com
2015-01-23 20:38 . 2015-01-23 20:41 -------- d-----w- c:\users\MoRF\AppData\Local\WinRARPasswordCracker.com
2015-01-23 20:37 . 2015-01-23 20:37 -------- d-----w- c:\program files (x86)\WinRAR Password Cracker
2015-01-23 20:32 . 2015-01-23 20:32 -------- d-----w- c:\program files (x86)\RAR Password Cracker
2015-01-14 11:59 . 2014-12-12 05:07 43008 ----a-w- c:\windows\SysWow64\srclient.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-09 18:41 . 2012-11-02 13:16 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2015-02-09 18:41 . 2011-10-10 18:40 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2015-02-08 19:06 . 2011-10-10 18:40 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2015-02-04 19:04 . 2012-03-29 21:06 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-04 19:04 . 2011-08-20 09:09 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-30 19:39 . 2014-02-02 17:57 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2015-01-30 19:38 . 2014-08-07 11:07 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-01-30 19:38 . 2014-02-02 17:57 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-01-30 19:38 . 2014-02-02 17:57 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-01-30 19:38 . 2014-02-02 17:57 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-01-30 19:38 . 2014-02-02 17:57 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-01-30 19:38 . 2014-02-02 17:57 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-01-30 19:38 . 2014-02-02 17:57 436624 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-12-31 12:12 . 2011-08-22 21:43 113365784 ----a-w- c:\windows\system32\MRT.exe
2014-12-22 23:41 . 2011-09-01 15:11 298120 ------w- c:\windows\system32\MpSigStub.exe
2014-12-12 18:00 . 2014-12-28 20:22 127488 ----a-w- c:\windows\system32\ff_vfw.dll
2014-12-12 18:00 . 2014-12-28 20:22 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2014-12-02 14:10 . 2014-12-28 20:22 260184 ----a-w- c:\windows\system32\unrar64.dll
2014-12-02 14:10 . 2011-08-20 17:06 218712 ----a-w- c:\windows\SysWow64\unrar.dll
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-16 12:15 . 2014-12-28 20:22 3514368 ----a-w- c:\windows\system32\x264vfw64.dll
2014-11-16 12:15 . 2014-12-28 20:22 3525120 ----a-w- c:\windows\SysWow64\x264vfw.dll
2013-10-04 11:35 . 2014-08-27 19:38 224 ----a-w- c:\program files (x86)\update-F12013.bat
2012-03-22 17:39 . 2012-03-22 17:39 3993600 ----a-w- c:\program files (x86)\GUTCF2A.tmp
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiTrayTools"="c:\program files (x86)\Ray Adams\ATI Tray Tools\atitray.exe" [2011-10-29 929792]
"BackgroundContainer"="c:\users\MoRF\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll" [2013-11-06 319264]
"uTorrent"="c:\users\MoRF\AppData\Roaming\uTorrent\uTorrent.exe" [2015-01-20 1374032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-01-28 299576]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-27 336384]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-01-30 5227112]
.
c:\users\MoRF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-02-03 22:09 75360 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
"SafeQ Client"="c:\program files (x86)\Y Soft\SafeQ Client\Client\SafeQ Client.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"HPConnectionManager"=c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe"
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"DTRun"=c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe;c:\program files (x86)\Xobni\XobniService.exe [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 EsgScanner;EsgScanner;c:\windows\system32\DRIVERS\EsgScanner.sys;c:\windows\SYSNATIVE\DRIVERS\EsgScanner.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena Classic\safedrv.sys;c:\program files (x86)\Garena Classic\safedrv.sys [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys;c:\windows\SYSNATIVE\DRIVERS\ewdcsc.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RivaTuner64;RivaTuner64;c:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys;c:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 QipGuard;QipGuard;c:\program files (x86)\QipGuard\QipGuard.exe;c:\program files (x86)\QipGuard\QipGuard.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 MfeEpePc;MfeEpePc; [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 a2AntiMalware;Emsisoft Protection Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
S2 mintcastnetworks;mintcastnetworks;c:\program files (x86)\Hahomedia\Hahomedia\mintcastnetworks.exe;c:\program files (x86)\Hahomedia\Hahomedia\mintcastnetworks.exe [x]
S2 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\program files\Enigma Software Group\SpyHunter\SH4Service.exe;c:\program files\Enigma Software Group\SpyHunter\SH4Service.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [x]
S2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S2 VersionUpdService;VersionUpdService;c:\program files (x86)\Hahomedia\Hahomedia\VersionUpdaterService.exe;c:\program files (x86)\Hahomedia\Hahomedia\VersionUpdaterService.exe [x]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2015-02-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 19:04]
.
2015-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-17 13:42]
.
2015-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-17 13:42]
.
2015-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1641611244-1653284353-1354606049-1001Core.job
- c:\users\MoRF\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-01 20:06]
.
2015-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1641611244-1653284353-1354606049-1001UA.job
- c:\users\MoRF\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-01 20:06]
.
2015-02-03 c:\windows\Tasks\HPCeeScheduleForMORF-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2015-02-06 c:\windows\Tasks\HPCeeScheduleForMoRF.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-01-30 19:38 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-01-07 615584]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-01-07 379040]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-27 835072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-25 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-25 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-25 418840]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"AutoKMS"="c:\windows\AutoKMS.exe" [2014-03-02 615936]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uStart Page = https://www.seznam.cz/?clid=22668
uLocal Page = c:\windows\system32\blank.htm
mStart Page = https://www.seznam.cz/?clid=22668
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
mSearch Bar = https://www.seznam.cz/?clid=22668
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files (x86)\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files (x86)\Verdict Free\etnxp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\MoRF\AppData\Roaming\Mozilla\Firefox\Profiles\vkta5wec.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/?clid=22668
FF - prefs.js: keyword.URL - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF - prefs.js: network.proxy.ftp - cache34.ics.muni.cz
FF - prefs.js: network.proxy.ftp_port - 5555
FF - prefs.js: network.proxy.http - cache34.ics.muni.cz
FF - prefs.js: network.proxy.http_port - 5555
FF - prefs.js: network.proxy.socks - cache34.ics.muni.cz
FF - prefs.js: network.proxy.socks_port - 5555
FF - prefs.js: network.proxy.ssl - cache34.ics.muni.cz
FF - prefs.js: network.proxy.ssl_port - 5555
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
URLSearchHooks-{96f454ea-9d38-474f-b504-56193e00c1a5} - (no file)
Toolbar-{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{46897C77-E7A6-4c33-BFFB-E9C2E2718942} - (no file)
Toolbar-{96f454ea-9d38-474f-b504-56193e00c1a5} - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - (no file)
WebBrowser-{96F454EA-9D38-474F-B504-56193E00C1A5} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Homepage Protection Service - c:\program files (x86)\Mp3Tube Toolbar\uninstall.exe
AddRemove-IspAssistant-Mp3Tube - c:\program files (x86)\Mp3Tube Toolbar\uninstall.exe
AddRemove-Mp3Tube Toolbar - c:\program files (x86)\Mp3Tube Toolbar\uninstall.exe
AddRemove-PolarClock3 - c:\windows\system32\PolarClock3.scr
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\program files (x86)\youtubeadblocker\fWZW1C8YZa53yf.exe
AddRemove-{4CEE92A3-9F0C-51AB-ADC0-34EC24AD7B7E} - c:\program files (x86)\unoisales\sTBOXntxRPXiRt.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
AddRemove-QipGuard - c:\users\MoRF\AppData\Roaming\QipGuard\QipGuard.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1641611244-1653284353-1354606049-1001\Software\SecuROM\License information*]
"datasecu"=hex:4b,ee,05,ac,35,f4,c8,94,eb,46,2b,7d,50,1e,68,9d,2a,4d,19,71,33,
2e,8d,4a,17,8d,c1,39,a4,bb,66,91,dd,80,09,d8,8a,9f,d9,af,c2,36,45,b3,7d,8f,\
"rkeysecu"=hex:1e,aa,7a,e2,90,87,8c,f0,dc,79,71,50,cf,ac,f3,b6
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hahomedia\Hahomedia\InjectorServiceProject.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\PANDORA.TV\PanService\PanProcess.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\SysWOW64\Rundll32.exe
c:\program files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2015-02-10 12:03:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-02-10 11:03
.
Před spuštěním: Volných bajtů: 21 521 145 856
Po spuštění: Volných bajtů: 21 121 204 224
.
- - End Of File - - FCB2289A700FFAA56170EC591CA13278

[JaRon]

ahoj,
v SK bol znamy Lojzo cistic, Ty asi budes Samocistic
ach
citat:
Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte
•

•
Stahnete a spustte DelFix - https://toolslib.net/downloads/viewdownload/2-delfix/
• Oznacte jen moznost "Remove disinfection tools"
• kliknete na Run

[Vojta11]

Díky za reakci!. Provedl jsem tedy kontrolu skrze ty dva programy, a zde zasílám logy z obou programů.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by MoRF on Łt 10.02.2015 at 15:18:39,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440}
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant
Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?

Value Name Type Value Data
========================================================================================
BackgroundContainer REG_SZ "C:\windows\SysWOW64\Rundll32.exe" "C:\Users\MoRF\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun




~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Toolbar.CT2475029
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Toolbar.CT3289075
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2475029
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3289075
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ApnStub_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ApnStub_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskPartnerCobrandingTool_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskPartnerCobrandingTool_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\MyBabylonTB_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\MyBabylonTB_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ApnStub_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ApnStub_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskPartnerCobrandingTool_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskPartnerCobrandingTool_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\MyBabylonTB_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\MyBabylonTB_RASMANCS
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Successfully deleted: [Registry Key] "hkey_classes_root\genericasktoolbar.toolbarwnd"
Successfully deleted: [Registry Key] "hkey_classes_root\genericasktoolbar.toolbarwnd.1"
Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"
Successfully deleted: [Registry Key] "hkey_current_user\software\apn"
Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\asktoolbar"
Successfully deleted: [Registry Key] "hkey_current_user\software\ask.com"
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
Successfully deleted: [Registry Key] "hkey_current_user\software\pip"
Successfully deleted: [Registry Key] "hkey_local_machine\software\apn"
Successfully deleted: [Registry Key] "hkey_local_machine\software\asktoolbar"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\appid\genericasktoolbar.dll"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\appid\{9b0cb95c-933a-4b8c-b6d4-edcd19a43874}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\interface\{ac71b60e-94c9-4ede-ba46-e146747bb67e}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\typelib\{2996f0e7-292b-4cae-893f-47b8b1c05b56}"
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0F7986D5-B47F-4F01-B8C2-8521EC28FF1B}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{15C4DF55-4B67-495A-A3D3-A497C4A49EE0}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6ec4f611-80be-459a-b08f-2cc20594dc99}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E9F1CAFA-75D7-4B14-A1F7-7E4AF464CEC4}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{15C4DF55-4B67-495A-A3D3-A497C4A49EE0}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}



~~~ Files

Successfully deleted: [File] "C:\Users\MoRF\AppData\Roaming\microsoft\internet explorer\qipsearchbar.dll"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\ProgramData\babylonupdater"
Successfully deleted: [Folder] "C:\ProgramData\bandoo"
Successfully deleted: [Folder] "C:\ProgramData\conduit"
Successfully deleted: [Folder] "C:\Users\MoRF\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\MoRF\AppData\Roaming\bandoo"
Successfully deleted: [Folder] "C:\Users\MoRF\AppData\Roaming\dll-files.com"
Successfully deleted: [Folder] "C:\Users\MoRF\AppData\Roaming\opencandy"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\local\babylon"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\local\ilivid player"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\locallow\bandoo"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\locallow\mp3tube toolbar"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\locallow\myashampoo"
Successfully deleted: [Folder] "C:\Program Files (x86)\bandoo"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\daemon tools toolbar"
Successfully deleted: [Folder] "C:\Program Files (x86)\dll-files.com fixer"
Failed to delete: [Folder] "C:\Program Files (x86)\ilivid"
Successfully deleted: [Folder] "C:\Program Files (x86)\myashampoo"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uniblue"
Successfully deleted: [Folder] "C:\Users\MoRF\appdata\locallow\asktoolbar"
Successfully deleted: [Folder] "C:\Program Files (x86)\ask.com"
Successfully deleted: [Folder] "C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\MoRF\AppData\Roaming\mozilla\firefox\profiles\vkta5wec.default\conduitcommon
Successfully deleted: [Folder] C:\Users\MoRF\AppData\Roaming\mozilla\firefox\profiles\vkta5wec.default\searchqutoolbar
Successfully deleted the following from C:\Users\MoRF\AppData\Roaming\mozilla\firefox\profiles\vkta5wec.default\prefs.js

user_pref("CT2475029..clientLogIsEnabled", false);
user_pref("CT2475029..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
user_pref("CT2475029..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
user_pref("CT2475029.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
user_pref("CT2475029.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
user_pref("CT2475029.BrowserCompStateIsOpen_129781019473889442", true);
user_pref("CT2475029.BrowserCompStateIsOpen_1359634297000", true);
user_pref("CT2475029.CT2475029", "CT2475029");
user_pref("CT2475029.CT2481020.CommunityChanged", true);
user_pref("CT2475029.CT2481020.alertChannelId", "874426");
user_pref("CT2475029.CT2481024.CommunityChanged", true);
user_pref("CT2475029.CT2481024.alertChannelId", "874430");
user_pref("CT2475029.CT2481025.CommunityChanged", true);
user_pref("CT2475029.CT2481025.alertChannelId", "874431");
user_pref("CT2475029.CT2481029.CommunityChanged", true);
user_pref("CT2475029.CT2481029.alertChannelId", "874435");
user_pref("CT2475029.CT2481031.CommunityChanged", true);
user_pref("CT2475029.CT2481031.alertChannelId", "874437");
user_pref("CT2475029.CT2481032.CommunityChanged", true);
user_pref("CT2475029.CT2481032.alertChannelId", "874438");
user_pref("CT2475029.CT2481033.CommunityChanged", true);
user_pref("CT2475029.CT2481033.alertChannelId", "874439");
user_pref("CT2475029.CT2481034.CommunityChanged", true);
user_pref("CT2475029.CT2481034.alertChannelId", "874440");
user_pref("CT2475029.CT2481035.CommunityChanged", true);
user_pref("CT2475029.CT2481035.alertChannelId", "874441");
user_pref("CT2475029.CT2481037.CommunityChanged", true);
user_pref("CT2475029.CT2481037.alertChannelId", "874443");
user_pref("CT2475029.CommunitiesChangesLastCheckTime", "Wed Mar 06 2013 19:58:21 GMT+0100");
user_pref("CT2475029.CommunitiesChangesLastUrl", "hxxp://grouping.services.conduit.com/GroupingRequest.ctp?type=ToolbarsInfo&ctids=CT2481020,CT2481024,CT2481025,CT2481029,CT24
user_pref("CT2475029.CommunityChanged", true);
user_pref("CT2475029.CurrentServerDate", "6-3-2013");
user_pref("CT2475029.DSChangedManually", false);
user_pref("CT2475029.DSProtectChoice", true);
user_pref("CT2475029.DSProtectCount", 1);
user_pref("CT2475029.DialogsAlignMode", "LTR");
user_pref("CT2475029.DialogsGetterLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.DownloadDomainsCheckInterval", "168");
user_pref("CT2475029.DownloadDomainsListLastCheckTime", "Wed Mar 06 2013 19:58:26 GMT+0100");
user_pref("CT2475029.DownloadDomainsListLastServerUpdateTime", "1201069983");
user_pref("CT2475029.DownloadReferralCookieData", "");
user_pref("CT2475029.EMailNotifierPollDate", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedLastCount129133095456874337", 400);
user_pref("CT2475029.FeedPollDate129132307482029379", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129132307482029381", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129132307482029382", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129133095459686870", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129133095459686871", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129137437659687146", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129137437659687147", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedPollDate129137437659687148", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.FeedTTL129132307482029379", 40);
user_pref("CT2475029.FeedTTL129132307482029381", 40);
user_pref("CT2475029.FeedTTL129132307482029382", 40);
user_pref("CT2475029.FeedTTL129133095459686870", 40);
user_pref("CT2475029.FeedTTL129133095459686871", 40);
user_pref("CT2475029.FeedTTL129137437659687146", 40);
user_pref("CT2475029.FeedTTL129137437659687147", 40);
user_pref("CT2475029.FeedTTL129137437659687148", 40);
user_pref("CT2475029.FirstServerDate", "20-9-2011");
user_pref("CT2475029.FirstTime", true);
user_pref("CT2475029.FirstTimeFF3", true);
user_pref("CT2475029.FixPageNotFoundErrors", true);
user_pref("CT2475029.GroupingLastCheckTime", "Wed Mar 06 2013 19:58:21 GMT+0100");
user_pref("CT2475029.GroupingLastErrorCode", "");
user_pref("CT2475029.GroupingLastResponse", true);
user_pref("CT2475029.GroupingLastServerUpdateTime", "130070396798630000");
user_pref("CT2475029.GroupingServerCheckInterval", 1440);
user_pref("CT2475029.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
user_pref("CT2475029.HPChangedManually", true);
user_pref("CT2475029.HPProtectChoice", true);
user_pref("CT2475029.HPProtectCount", 1);
user_pref("CT2475029.HasUserGlobalKeys", true);
user_pref("CT2475029.HomePageProtectorEnabled", false);
user_pref("CT2475029.HomepageBeforeUnload", "hxxp://search.babylon.com/?babsrc=HP_Prot");
user_pref("CT2475029.Initialize", true);
user_pref("CT2475029.InitializeCommonPrefs", true);
user_pref("CT2475029.InstallationAndCookieDataSentCount", 3);
user_pref("CT2475029.InstallationType", "Unknown");
user_pref("CT2475029.InstalledDate", "Tue Sep 20 2011 19:41:47 GMT+0200");
user_pref("CT2475029.InvalidateCache", false);
user_pref("CT2475029.IsAlertDBUpdated", true);
user_pref("CT2475029.IsGrouping", true);
user_pref("CT2475029.IsInitSetupIni", true);
user_pref("CT2475029.IsMulticommunity", true);
user_pref("CT2475029.IsOpenThankYouPage", true);
user_pref("CT2475029.IsOpenUninstallPage", true);
user_pref("CT2475029.IsProtectorsInit", true);
user_pref("CT2475029.LanguagePackLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.LanguagePackReloadIntervalMM", 1440);
user_pref("CT2475029.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
user_pref("CT2475029.LastLogin_3.6.0.10", "Tue Oct 04 2011 00:31:27 GMT+0200");
user_pref("CT2475029.LastLogin_3.7.0.6", "Mon Nov 07 2011 20:36:14 GMT+0100");
user_pref("CT2475029.LastLogin_3.8.0.8", "Fri Dec 23 2011 19:18:00 GMT+0100");
user_pref("CT2475029.LastLogin_3.8.1.0", "Fri Jan 13 2012 12:55:39 GMT+0100");
user_pref("CT2475029.LastLogin_3.9.0.3", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.LatestVersion", "3.18.0.7");
user_pref("CT2475029.Locale", "en");
user_pref("CT2475029.MCDetectTooltipHeight", "83");
user_pref("CT2475029.MCDetectTooltipShow", true);
user_pref("CT2475029.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
user_pref("CT2475029.MCDetectTooltipWidth", "295");
user_pref("CT2475029.MyStuffEnabledAtInstallation", true);
user_pref("CT2475029.OriginalFirstVersion", "3.6.0.10");
user_pref("CT2475029.RadioIsPodcast", false);
user_pref("CT2475029.RadioLastCheckTime", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CT2475029.RadioLastUpdateIPServer", "3");
user_pref("CT2475029.RadioLastUpdateServer", "129054397178370000");
user_pref("CT2475029.RadioMediaID", "13098944");
user_pref("CT2475029.RadioMediaType", "Media Player");
user_pref("CT2475029.RadioMenuSelectedID", "EBRadioMenu_CT247502913098944");
user_pref("CT2475029.RadioShrinkedFromSetup", false);
user_pref("CT2475029.RadioStationName", "Mellesleg%20-%20Rapp");
user_pref("CT2475029.RadioStationURL", "hxxp://195.228.254.168:8060/");
user_pref("CT2475029.SavedHomepage", "www.seznam.cz");
user_pref("CT2475029.SearchBoxWidth", 150);
user_pref("CT2475029.SearchEngineBeforeUnload", "Search the web (Babylon)");
user_pref("CT2475029.SearchFromAddressBarIsInit", true);
user_pref("CT2475029.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q=");
user_pref("CT2475029.SearchInNewTabEnabled", true);
user_pref("CT2475029.SearchInNewTabIntervalMM", 1440);
user_pref("CT2475029.SearchInNewTabLastCheckTime", "Wed Mar 06 2013 19:58:21 GMT+0100");
user_pref("CT2475029.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");
user_pref("CT2475029.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
user_pref("CT2475029.SearchProtectorEnabled", false);
user_pref("CT2475029.SearchProtectorToolbarDisabled", false);
user_pref("CT2475029.ServiceMapLastCheckTime", "Wed Mar 06 2013 19:58:25 GMT+0100");
user_pref("CT2475029.SettingsLastCheckTime", "Wed Mar 06 2013 19:58:21 GMT+0100");
user_pref("CT2475029.SettingsLastUpdate", "1362557676");
user_pref("CT2475029.ThirdPartyComponentsInterval", 504);
user_pref("CT2475029.ThirdPartyComponentsLastCheck", "Wed Mar 06 2013 19:58:21 GMT+0100");
user_pref("CT2475029.ThirdPartyComponentsLastUpdate", "1331805997");
user_pref("CT2475029.ToolbarShrinkedFromSetup", false);
user_pref("CT2475029.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2475029");
user_pref("CT2475029.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com
user_pref("CT2475029.UserID", "UN06918346052642244");
user_pref("CT2475029.ValidationData_Toolbar", 2);
user_pref("CT2475029.WeatherNetwork", "");
user_pref("CT2475029.WeatherPollDate", "Wed Mar 06 2013 19:58:23 GMT+0100");
user_pref("CT2475029.WeatherUnit", "C");
user_pref("CT2475029.alertChannelId", "868510");
user_pref("CT2475029.backendstorage.cbcountry_000", "435A");
user_pref("CT2475029.backendstorage.cbfirsttime", "5475652041707220313020323031322031353A34333A313720474D542B30323030");
user_pref("CT2475029.backendstorage.facebook_mode", "32");
user_pref("CT2475029.backendstorage.facebook_user_locale", "656E");
user_pref("CT2475029.backendstorage.shoppingapp.gk.exipres", "546875204D617920333120323031322031303A35363A333120474D542B30323030");
user_pref("CT2475029.backendstorage.shoppingapp.gk.geolocation", "637A6563682072657075626C6963");
user_pref("CT2475029.backendstorage.url_history0001", "68747470733A2F2F7777772E66616365626F6F6B2E636F6D2F4D307246693A3A3A636C69636B68616E646C65723A3A3A313333343836393230393838
user_pref("CT2475029.components.1000034", true);
user_pref("CT2475029.components.1000234", true);
user_pref("CT2475029.globalFirstTimeInfoLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.homepageProtectorEnableByLogin", true);
user_pref("CT2475029.initDone", true);
user_pref("CT2475029.isAppTrackingManagerOn", true);
user_pref("CT2475029.isFirstRadioInstallation", false);
user_pref("CT2475029.myStuffEnabled", true);
user_pref("CT2475029.myStuffPublihserMinWidth", 400);
user_pref("CT2475029.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
user_pref("CT2475029.myStuffServiceIntervalMM", 1440);
user_pref("CT2475029.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
user_pref("CT2475029.oldAppsList", "200,129053524177369346,129053524177525597,111,129584873345514033,129469742085082050,129582128742751739,129464711670143239,12905428179373828
user_pref("CT2475029.revertSettingsEnabled", true);
user_pref("CT2475029.searchProtectorDialogDelayInSec", 10);
user_pref("CT2475029.searchProtectorEnableByLogin", true);
user_pref("CT2475029.testingCtid", "");
user_pref("CT2475029.toolbarAppMetaDataLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.toolbarContextMenuLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CT2475029.usagesFlag", 2);
user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13");
user_pref("CommunityToolbar.ConduitSearchList", "MyAshampoo Customized Web Search");
user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "wNaokyQn90mMItP1sym06A==");
user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "V3ke+ogt4ejn0sB1xPR3nw==");
user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "bM8wQLfFAEKgVLVF/G5zig==");
user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "FqddrIU7eyJgaaLyHDeVMQ==");
user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\MoRF\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\vkta5wec.default\\conduitCommon\\modules\\3.9.0.3");
user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.9.0.3");
user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
user_pref("CommunityToolbar.ToolbarsList", "CT2475029");
user_pref("CommunityToolbar.ToolbarsList2", "CT2475029");
user_pref("CommunityToolbar.ToolbarsList4", "CT2475029");
user_pref("CommunityToolbar.globalUserId", "6dc74906-b130-44d5-8562-4bac31ae8c30");
user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2475029");
user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Mar 06 2013 19:58:27 GMT+0100");
user_pref("CommunityToolbar.notifications.alertEnabled", true);
user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);
user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Tue Jul 10 2012 21:06:20 GMT+0200");
user_pref("CommunityToolbar.notifications.clientsServerUrl", "");
user_pref("CommunityToolbar.notifications.firstTimeAlertShown", true);
user_pref("CommunityToolbar.notifications.locale", "");
user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);
user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Mar 06 2013 19:58:22 GMT+0100");
user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");
user_pref("CommunityToolbar.notifications.messageShowTimeSec", 0);
user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 0);
user_pref("CommunityToolbar.notifications.userId", "dc3a83c6-dc15-4713-a331-6f2e90fd03db");
user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_34655603.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_759251.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Wed Mar 06 2013 19:58:24 GMT+0100");
user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
user_pref("browser.search.defaulturl", "hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&");
user_pref("browser.search.searchengine.alias", "mystartsearch");
user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/favicon.ico");
user_pref("browser.search.searchengine.name", "mystartsearch");
user_pref("browser.search.searchengine.ptid", "wpc");
user_pref("browser.search.searchengine.uid", "WDCXWD6400BPVT-60HXZT1_WD-WX41A41T5138T5138");
user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}"
user_pref("extensions.BabylonToolbar.aflt", "babsst");
user_pref("extensions.BabylonToolbar.babTrack", "affID=100842");
user_pref("extensions.BabylonToolbar.bbDpng", 26);
user_pref("extensions.BabylonToolbar.dfltLng", "en");
user_pref("extensions.BabylonToolbar.id", "5071a0a600000000000068a3c4621cf5");
user_pref("extensions.BabylonToolbar.instlDay", "15286");
user_pref("extensions.BabylonToolbar.instlRef", "sst");
user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=5071a0a600000000000068a3c4621cf5&tlver=1.4.35.10&affID=100842
user_pref("extensions.BabylonToolbar.lastDP", 26);
user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.4.35.1010:07:55");
user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "6.0");
user_pref("extensions.BabylonToolbar.newTab", true);
user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
user_pref("extensions.BabylonToolbar.propectorlck", 76582745);
user_pref("extensions.BabylonToolbar.prtkDS", 1);
user_pref("extensions.BabylonToolbar.prtkHmpg", 1);
user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
user_pref("extensions.BabylonToolbar.ptch_0717", true);
user_pref("extensions.BabylonToolbar.smplGrp", "azb");
user_pref("extensions.BabylonToolbar.srcExt", "ss");
user_pref("extensions.BabylonToolbar.srchPrvdr", "Search the web (Babylon)");
user_pref("extensions.BabylonToolbar.tlbrId", "base");
user_pref("extensions.BabylonToolbar.vrsn", "1.4.35.10");
user_pref("extensions.BabylonToolbar.vrsnTs", "1.4.35.1010:07:55");
user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");
user_pref("extensions.asktb.abar-war-regex", "conduit\\.com");
user_pref("extensions.asktb.abar-war-timeout", "4000");
user_pref("extensions.asktb.apn_dbr", "ff_6.0");
user_pref("extensions.asktb.autofill-competitor-query-enabled", true);
user_pref("extensions.asktb.autofill-text-highlight-enabled", true);
user_pref("extensions.asktb.cbid", "S3");
user_pref("extensions.asktb.config-updated", false);
user_pref("extensions.asktb.crumb", "2011.08.31+13.34.13-toolbar004iad-CZ-VHJpbmVjLEN6ZWNoIFJlcHVibGlj");
user_pref("extensions.asktb.default-channel-url-mask", "hxxp://eu.ask.com/web?qsrc={qsrc}&o={o}&l={l}&q={query}&dm=all");
user_pref("extensions.asktb.displaybehavior", "");
user_pref("extensions.asktb.displaytext", "");
user_pref("extensions.asktb.dtid", "YYYYYYYYCZ");
user_pref("extensions.asktb.dyn-weather-do-locid-lookup-weatherWidget", true);
user_pref("extensions.asktb.fresh-install", false);
user_pref("extensions.asktb.guid", "3606e9de-ce33-4ecc-a194-cb07c15013ec");
user_pref("extensions.asktb.if", "first");
user_pref("extensions.asktb.keyword-toggled-in-session", false);
user_pref("extensions.asktb.l", "dis");
user_pref("extensions.asktb.last-config-req", "1362596297444");
user_pref("extensions.asktb.last-search-timestamp", "1322852354203");
user_pref("extensions.asktb.locale", "en_EU");
user_pref("extensions.asktb.location", "Trinec,Czech Republic");
user_pref("extensions.asktb.lstation", "");
user_pref("extensions.asktb.new-tab-enabled", true);
user_pref("extensions.asktb.new-tab-opt-out", true);
user_pref("extensions.asktb.o", "13157");
user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
user_pref("extensions.asktb.pstate", "");
user_pref("extensions.asktb.qsrc", "2871");
user_pref("extensions.asktb.r", "19");
user_pref("extensions.asktb.sa", "NO");
user_pref("extensions.asktb.search-history-queries", "opera");
user_pref("extensions.asktb.search-suggestions-enabled", true);
user_pref("extensions.asktb.silent-upgrade", true);
user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
user_pref("extensions.asktb.socialmini-first", true);
user_pref("extensions.asktb.socialmini-interval", "1200000");
user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
user_pref("extensions.asktb.socialmini-max-items", "30");
user_pref("extensions.asktb.socialmini-native-on", true);
user_pref("extensions.asktb.socialmini-speed", "5000");
user_pref("extensions.asktb.socialmini-transition-first-open", false);
user_pref("extensions.asktb.themeid", "");
user_pref("extensions.asktb.timeinstalled", "31.8.2011 22:34:36");
user_pref("extensions.asktb.to", "");
user_pref("extensions.asktb.v", "3.14.1.100013");
user_pref("extensions.asktb.volume", "");
user_pref("extensions.btgLGLnkF3AX9qd6.url", "hxxp://superiend.info/sync2/?q=hfZ9oflKAfqZBylHrGhEAen0rHn8pchTB6lKDzt4okqAtNtVh7n0rjkErjs5rjgFrHn9tMFHhd9FqjaFrTYGrdkHqdrMDMlGoj
user_pref("extensions.y1aKuY8iAXi3ENoD.url", "hxxp://winnerhomecompletezip.net/sync2/?q=hfZ9ofV9CShEAen0rHn8pchTB6lKDzt4okqAtNtVh7n0rjkErjs5rjgFqdsHtMFHhd9FqjaFrTYGrdkHqdrMDMl
user_pref("keyword.URL", "hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&");
Emptied folder: C:\Users\MoRF\AppData\Roaming\mozilla\firefox\profiles\vkta5wec.default\minidumps [11 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\MoRF\appdata\local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 10.02.2015 at 15:41:18,81
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


a nyní z druhého programu:

# DelFix v10.8 - Logfile created 10/02/2015 at 15:42:57
# Updated 29/07/2014 by Xplode
# Username : MoRF - MORF-HP
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\Qoobox
Deleted : C:\Combofix
Deleted : C:\AdwCleaner
Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hijackthis
Deleted : C:\Program Files (x86)\Trend Micro\Hijackthis
Deleted : C:\ComboFix.txt
Deleted : C:\LOGFILE.TXT
Deleted : C:\Users\MoRF\Desktop\JRT.txt
Deleted : C:\Users\MoRF\Desktop\HijackThis.lnk
Deleted : C:\Users\MoRF\Downloads\ComboFix.exe
Deleted : C:\Users\MoRF\Downloads\JRT.exe
Deleted : C:\Users\MoRF\Downloads\hijackthis.exe
Deleted : C:\windows\grep.exe
Deleted : C:\windows\PEV.exe
Deleted : C:\windows\NIRCMD.exe
Deleted : C:\windows\MBR.exe
Deleted : C:\windows\SED.exe
Deleted : C:\windows\SWREG.exe
Deleted : C:\windows\SWSC.exe
Deleted : C:\windows\SWXCACLS.exe
Deleted : C:\windows\Zip.exe
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

########## - EOF - ##########

Doufám, že to bude nějak nápomocno Teď jdu zrestartovat počítač

[JaRon]

ak nie su problemy, tak hotovo