preventivní kontrola

Zpráva

honnza · #1 Příspěvek od **honnza** » 02 zář 2012 09:52

Dobrý den, mohli by jste se mi prosím podívat na log? Zdá se mi, že mám pomalejší pc. Nespěcháto,... Díky moc.

Log MWAV:

Objekt "grokster Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "cws.tapicfg Browser Hijacker" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Privacy Center Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "winlink Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Smitfraud Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "AutoStartup Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "XP Police Antivirus Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "XP Police Antivirus Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Spyware.TupInsight Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Soubor D:\Instalacky\OOOOOOO\Software\keyfinder.exe je infikovaný virem Application.Findkeyxp.F (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor D:\Instalacky\OOOOOOO\Zabezpeceni\RSIT\RSIT.exe je infikovaný virem Autolt.Corrupted !! Provedené akce: Ponecháno, neodstraněno!.
Soubor D:\Programy\Pidgin\pidgin-uninst.exe je infikovaný virem Gen:Trojan.Heur.P.bK4@fiv5Cib (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor D:\AUTORUN.INF je infikovaný virem Fujack !! Provedené akce: No Action Taken.

LOG ERSIT:
Logfile of random's system information tool 1.09 (written by random/random)
Run by honza at 2012-09-02 10:36:22
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 14 GB (16%) free of 90 GB
Total RAM: 4074 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:36:25, on 2.9.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16448)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
D:\Programy\servant salamander\salamand.exe
C:\Program Files (x86)\PSPad editor\PSPad.exe
C:\Program Files\trend micro\honza.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=112060 ... 2f689d5326
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = zelena:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Programy\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Programy\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - D:\Programy\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: Služba Acronis Scheduler2 (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Služba Acronis Nonstop Backup (afcdpsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Program Files\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\PSIA.exe
O23 - Service: Secunia Update Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\sua.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - D:\Programy\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14523 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe"
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
crypserv.exe
"C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {736C31FD-C202-4E0E-ABCB-FDCC79F95B91}
"C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe"
ATKOSD.exe
KBFiltr.exe
WDC.exe
C:\Windows\system32\HPSIsvc.exe
"C:\Program Files\Citrix\Secure Access Client\nsverctl.exe"
"C:\Program Files (x86)\Secunia\PSI\PSIA.exe" --start-service
"C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"
C:\Windows\System32\snmp.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe"
"C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SF3
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"
"C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe"
"C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
"C:\Program Files (x86)\Secunia\PSI\sua.exe" --start-service
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=6120.21e746a0.1564081741 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 6120 "\\.\pipe\gecko-crash-server-pipe.6120" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe" --proxy-stub-channel=Flash5844.6DEBA168.41 --host-broker-channel=Flash5844.6DEBA168.18467 --host-pid=5844 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe" --channel=3496.004FF64C.1102194295 --proxy-stub-channel=Flash5844.6DEBA168.41 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll" --host-npapi-version=27 --type=renderer
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\Windows\splwow64.exe 12288
"D:\Programy\servant salamander\salamand.exe"
"C:\Program Files (x86)\PSPad editor\PSPad.exe" "C:\Users\honza\Desktop\Nový textový dokument.txt"
"D:\Downloads\RSITx64(1).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Citrix.com/npagee,version=9.2.50.4002]
"Description"=Citrix Access Gateway Endpoint Analysis for 64-bit Windows
"Path"=C:\Program Files\Citrix\Secure Access Client\npagee.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.5.1]
"Description"=
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nokia.com/EnablerPlugin]
"Description"=Nokia Suite Enabler Plugin
"Path"=C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Citrix.com/npagee64,version=9.2.50.4002]
"Description"=Citrix Access Gateway Endpoint Analysis for 64-bit Windows
"Path"=C:\Program Files\Citrix\Secure Access Client\npagee64.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.5.1]
"Description"=
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL

C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
IICAClient.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
CCMSDK.dll
cgpcfg.dll
CgpCore.dll
confmgr.dll
ctxlogging.dll
ctxmui.dll
ICAClObj.class
icafile.dll
icalogon.dll
np-mswmp.dll
npicaN.dll
nppdf32.dll
sslsdk_b.dll
TcpPServ.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default\extensions\
foxmarks@kei.com
staged
zotero@chnm.gmu.edu
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

C:\Users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default\searchplugins\
BabylonMngr.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-08-27 545192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2012-08-13 5749952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-08-27 193456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-08-28 453104]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13 60576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - D:\Programy\Toolbars\Internet Explorer\skypeieplugin.dll [2012-08-13 4120256]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-08-28 157680]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2011-05-17 2226280]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2010-12-13 2587944]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-03-13 617120]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-03-13 379552]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2012-03-11 9569096]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-05-17 11855976]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 1271168]
"Služba Acronis Scheduler2"=C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [2010-12-17 391144]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-17 3671872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [2012-05-16 1084840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SAOB Monitor]
C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe [2010-11-16 2536752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-17 252296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [2010-12-17 5566176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Secunia PSI Tray.lnk]
C:\PROGRA~2\Secunia\PSI\psi_tray.exe [2012-07-25 572000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^honza^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk]
C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE [2010-12-21 227712]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17 5732992]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [2010-10-07 170624]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
""= []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\system32\guard64.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"HideSCAHealth"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=95

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"mixer5"=wdmaud.drv
"VIDC.FFDS"=ff_vfw.dll
"wave6"=wdmaud.drv
"mixer6"=wdmaud.drv
"midi3"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.txt - open - "C:\Program Files (x86)\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 1 month======

2012-09-02 00:14:19 ----AD---- C:\Windows\VDLL.DLL
2012-09-02 00:14:19 ----AD---- C:\Windows\SYSWOW64\runouce.exe
2012-09-02 00:14:19 ----AD---- C:\Windows\rundll16.exe
2012-09-02 00:14:19 ----AD---- C:\Windows\RUNDL132.EXE
2012-09-02 00:14:19 ----AD---- C:\Windows\logo1_.exe
2012-09-02 00:14:19 ----AD---- C:\Windows\logo_1.exe
2012-09-02 00:09:04 ----A---- C:\Windows\SYSWOW64\msvcr80.dll
2012-09-02 00:09:03 ----A---- C:\Windows\SYSWOW64\msvcp80.dll
2012-09-02 00:09:02 ----A---- C:\Windows\SYSWOW64\eEmpty.exe
2012-09-02 00:08:54 ----D---- C:\ProgramData\MicroWorld
2012-09-01 20:12:25 ----A---- C:\Windows\system32\drivers\afcdp.sys
2012-09-01 20:12:20 ----A---- C:\Windows\system32\drivers\tdrpm273.sys
2012-09-01 20:12:19 ----A---- C:\Windows\system32\drivers\timntr.sys
2012-09-01 20:12:15 ----A---- C:\Windows\system32\drivers\snapman.sys
2012-09-01 20:11:50 ----D---- C:\Program Files (x86)\Acronis
2012-09-01 20:10:44 ----D---- C:\Users\honza\AppData\Roaming\Acronis
2012-09-01 20:10:44 ----D---- C:\ProgramData\Acronis
2012-08-28 10:32:57 ----A---- C:\Windows\SYSWOW64\javaws.exe
2012-08-28 10:32:50 ----A---- C:\Windows\SYSWOW64\javaw.exe
2012-08-28 10:32:50 ----A---- C:\Windows\SYSWOW64\java.exe
2012-08-27 23:16:33 ----D---- C:\Program Files\Wireshark
2012-08-27 23:12:58 ----A---- C:\Windows\system32\javaws.exe
2012-08-27 23:12:50 ----A---- C:\Windows\system32\javaw.exe
2012-08-27 23:12:50 ----A---- C:\Windows\system32\java.exe
2012-08-27 23:08:17 ----D---- C:\Program Files (x86)\Secunia
2012-08-27 20:03:16 ----D---- C:\videooutput
2012-08-27 20:03:06 ----D---- C:\Program Files (x86)\Smallvideosoft
2012-08-27 20:03:06 ----A---- C:\Windows\SYSWOW64\xvidvfw.dll
2012-08-27 20:03:06 ----A---- C:\Windows\SYSWOW64\xvidcore.dll
2012-08-27 20:03:06 ----A---- C:\Windows\SYSWOW64\NCMedia2.dll
2012-08-26 22:09:15 ----D---- C:\Program Files (x86)\Skype
2012-08-22 23:26:12 ----D---- C:\sporic
2012-08-15 14:02:13 ----A---- C:\Windows\system32\drivers\bthport.sys
2012-08-15 14:00:56 ----D---- C:\Windows\PCHEALTH
2012-08-15 14:00:02 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-08-15 14:00:02 ----A---- C:\Windows\system32\mshtmled.dll
2012-08-15 14:00:01 ----A---- C:\Windows\SYSWOW64\url.dll
2012-08-15 14:00:01 ----A---- C:\Windows\system32\url.dll
2012-08-15 14:00:01 ----A---- C:\Windows\system32\iertutil.dll
2012-08-15 14:00:00 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-08-15 14:00:00 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-08-15 14:00:00 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-08-15 14:00:00 ----A---- C:\Windows\system32\urlmon.dll
2012-08-15 13:59:59 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2012-08-15 13:59:59 ----A---- C:\Windows\system32\ieUnatt.exe
2012-08-15 13:59:59 ----A---- C:\Windows\system32\ieui.dll
2012-08-15 13:59:58 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-08-15 13:59:58 ----A---- C:\Windows\system32\jscript9.dll
2012-08-15 13:59:57 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-08-15 13:59:57 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-08-15 13:59:57 ----A---- C:\Windows\system32\wininet.dll
2012-08-15 13:59:57 ----A---- C:\Windows\system32\jsproxy.dll
2012-08-15 13:59:57 ----A---- C:\Windows\system32\jscript.dll
2012-08-15 13:59:56 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-08-15 13:59:56 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-08-15 13:59:54 ----A---- C:\Windows\system32\mshtml.dll
2012-08-15 13:59:53 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-08-15 13:59:53 ----A---- C:\Windows\system32\ieframe.dll
2012-08-15 08:14:13 ----A---- C:\Windows\SYSWOW64\srclient.dll
2012-08-15 08:14:13 ----A---- C:\Windows\system32\srcore.dll
2012-08-15 08:14:12 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2012-08-15 08:14:12 ----A---- C:\Windows\system32\win32spl.dll
2012-08-15 08:14:12 ----A---- C:\Windows\system32\spoolsv.exe
2012-08-15 08:14:11 ----A---- C:\Windows\SYSWOW64\netapi32.dll
2012-08-15 08:14:11 ----A---- C:\Windows\SYSWOW64\browcli.dll
2012-08-15 08:14:11 ----A---- C:\Windows\system32\netapi32.dll
2012-08-15 08:14:11 ----A---- C:\Windows\system32\browser.dll
2012-08-15 08:14:11 ----A---- C:\Windows\system32\browcli.dll
2012-08-15 08:14:11 ----A---- C:\Windows\splwow64.exe
2012-08-15 08:14:10 ----A---- C:\Windows\system32\win32k.sys
2012-08-15 08:14:08 ----A---- C:\Windows\system32\localspl.dll
2012-08-14 21:09:15 ----D---- C:\Program Files\AudioCoder x64
2012-08-14 20:15:18 ----D---- C:\Users\honza\AppData\Roaming\Broad Intelligence
2012-08-12 22:40:09 ----A---- C:\user.js
2012-08-12 22:39:52 ----D---- C:\Users\honza\AppData\Roaming\Babylon
2012-08-12 22:39:52 ----D---- C:\ProgramData\Babylon
2012-08-12 22:31:07 ----D---- C:\Program Files (x86)\RM Converter
2012-08-12 19:06:32 ----D---- C:\Users\honza\AppData\Roaming\Real
2012-08-12 19:05:00 ----D---- C:\Program Files (x86)\Easy RM to MP3 Converter
2012-08-12 18:47:05 ----D---- C:\Users\honza\AppData\Roaming\Boilsoft
2012-08-11 22:48:21 ----A---- C:\Windows\SYSWOW64\XAudio2_7.dll
2012-08-11 22:48:21 ----A---- C:\Windows\SYSWOW64\XAPOFX1_5.dll
2012-08-11 22:48:21 ----A---- C:\Windows\SYSWOW64\xactengine3_7.dll
2012-08-11 22:48:21 ----A---- C:\Windows\system32\XAudio2_7.dll
2012-08-11 22:48:21 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2012-08-11 22:48:21 ----A---- C:\Windows\system32\xactengine3_7.dll
2012-08-11 22:48:20 ----A---- C:\Windows\SYSWOW64\d3dx11_43.dll
2012-08-11 22:48:20 ----A---- C:\Windows\SYSWOW64\d3dcsx_43.dll
2012-08-11 22:48:20 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2012-08-11 22:48:20 ----A---- C:\Windows\system32\d3dx11_43.dll
2012-08-11 22:48:20 ----A---- C:\Windows\system32\d3dcsx_43.dll
2012-08-11 22:48:20 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2012-08-11 22:48:19 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2012-08-11 22:48:19 ----A---- C:\Windows\SYSWOW64\d3dx10_43.dll
2012-08-11 22:48:19 ----A---- C:\Windows\system32\D3DX9_43.dll
2012-08-11 22:48:19 ----A---- C:\Windows\system32\d3dx10_43.dll
2012-08-11 22:48:18 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2012-08-11 22:48:18 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2012-08-11 22:48:18 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2012-08-11 22:48:18 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2012-08-11 22:48:18 ----A---- C:\Windows\system32\XAudio2_6.dll
2012-08-11 22:48:18 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2012-08-11 22:48:18 ----A---- C:\Windows\system32\xactengine3_6.dll
2012-08-11 22:48:18 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2012-08-11 22:48:17 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2012-08-11 22:48:17 ----A---- C:\Windows\system32\XAudio2_5.dll
2012-08-11 22:48:16 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2012-08-11 22:48:16 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2012-08-11 22:48:16 ----A---- C:\Windows\system32\xactengine3_5.dll
2012-08-11 22:48:16 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\system32\d3dx11_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\system32\d3dx10_42.dll
2012-08-11 22:48:15 ----A---- C:\Windows\system32\d3dcsx_42.dll
2012-08-11 22:48:14 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2012-08-11 22:48:14 ----A---- C:\Windows\system32\D3DX9_42.dll
2012-08-11 22:48:14 ----A---- C:\Windows\system32\d3dx10_41.dll
2012-08-11 22:48:14 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2012-08-11 22:48:13 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2012-08-11 22:48:13 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2012-08-11 22:48:13 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2012-08-11 22:48:13 ----A---- C:\Windows\system32\D3DX9_41.dll
2012-08-11 22:48:12 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2012-08-11 22:48:12 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2012-08-11 22:48:12 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2012-08-11 22:48:12 ----A---- C:\Windows\system32\XAudio2_4.dll
2012-08-11 22:48:12 ----A---- C:\Windows\system32\xactengine3_4.dll
2012-08-11 22:48:12 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2012-08-11 22:48:11 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2012-08-11 22:48:11 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2012-08-11 22:48:11 ----A---- C:\Windows\system32\d3dx10_40.dll
2012-08-11 22:48:11 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2012-08-11 22:48:10 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2012-08-11 22:48:10 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2012-08-11 22:48:10 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2012-08-11 22:48:10 ----A---- C:\Windows\system32\XAudio2_3.dll
2012-08-11 22:48:10 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2012-08-11 22:48:10 ----A---- C:\Windows\system32\D3DX9_40.dll
2012-08-11 22:48:09 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2012-08-11 22:48:09 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2012-08-11 22:48:09 ----A---- C:\Windows\system32\xactengine3_3.dll
2012-08-11 22:48:09 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2012-08-11 22:48:08 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2012-08-11 22:48:08 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2012-08-11 22:48:08 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2012-08-11 22:48:08 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2012-08-11 22:48:08 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2012-08-11 22:48:08 ----A---- C:\Windows\system32\XAudio2_2.dll
2012-08-11 22:48:08 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2012-08-11 22:48:08 ----A---- C:\Windows\system32\xactengine3_2.dll
2012-08-11 22:48:08 ----A---- C:\Windows\system32\d3dx10_39.dll
2012-08-11 22:48:08 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2012-08-11 22:48:07 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2012-08-11 22:48:07 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2012-08-11 22:48:07 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2012-08-11 22:48:07 ----A---- C:\Windows\system32\XAudio2_1.dll
2012-08-11 22:48:07 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2012-08-11 22:48:07 ----A---- C:\Windows\system32\D3DX9_39.dll
2012-08-11 22:48:06 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2012-08-11 22:48:06 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2012-08-11 22:48:06 ----A---- C:\Windows\system32\xactengine3_1.dll
2012-08-11 22:48:06 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2012-08-11 22:48:05 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2012-08-11 22:48:05 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2012-08-11 22:48:05 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2012-08-11 22:48:05 ----A---- C:\Windows\system32\D3DX9_38.dll
2012-08-11 22:48:05 ----A---- C:\Windows\system32\d3dx10_38.dll
2012-08-11 22:48:05 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2012-08-11 22:48:04 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2012-08-11 22:48:04 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2012-08-11 22:48:04 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2012-08-11 22:48:04 ----A---- C:\Windows\system32\XAudio2_0.dll
2012-08-11 22:48:04 ----A---- C:\Windows\system32\xactengine3_0.dll
2012-08-11 22:48:04 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2012-08-11 22:48:03 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2012-08-11 22:48:03 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2012-08-11 22:48:03 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2012-08-11 22:48:03 ----A---- C:\Windows\system32\D3DX9_37.dll
2012-08-11 22:48:03 ----A---- C:\Windows\system32\d3dx10_37.dll
2012-08-11 22:48:03 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2012-08-11 22:48:02 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2012-08-11 22:48:02 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2012-08-11 22:48:02 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2012-08-11 22:48:02 ----A---- C:\Windows\system32\xactengine2_10.dll
2012-08-11 22:48:02 ----A---- C:\Windows\system32\d3dx10_36.dll
2012-08-11 22:48:02 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2012-08-11 22:48:01 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2012-08-11 22:48:01 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2012-08-11 22:48:01 ----A---- C:\Windows\system32\xactengine2_9.dll
2012-08-11 22:48:01 ----A---- C:\Windows\system32\d3dx9_36.dll
2012-08-11 22:48:00 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2012-08-11 22:48:00 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2012-08-11 22:48:00 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2012-08-11 22:48:00 ----A---- C:\Windows\system32\d3dx9_35.dll
2012-08-11 22:48:00 ----A---- C:\Windows\system32\d3dx10_35.dll
2012-08-11 22:48:00 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2012-08-11 22:47:59 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2012-08-11 22:47:59 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2012-08-11 22:47:59 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2012-08-11 22:47:59 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2012-08-11 22:47:59 ----A---- C:\Windows\system32\xactengine2_8.dll
2012-08-11 22:47:59 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2012-08-11 22:47:59 ----A---- C:\Windows\system32\d3dx10_34.dll
2012-08-11 22:47:59 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2012-08-11 22:47:58 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2012-08-11 22:47:58 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2012-08-11 22:47:58 ----A---- C:\Windows\system32\xinput1_3.dll
2012-08-11 22:47:58 ----A---- C:\Windows\system32\d3dx9_34.dll
2012-08-11 22:47:57 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2012-08-11 22:47:57 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2012-08-11 22:47:57 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2012-08-11 22:47:57 ----A---- C:\Windows\system32\xactengine2_7.dll
2012-08-11 22:47:57 ----A---- C:\Windows\system32\d3dx10_33.dll
2012-08-11 22:47:57 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2012-08-11 22:47:56 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2012-08-11 22:47:56 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2012-08-11 22:47:56 ----A---- C:\Windows\system32\xactengine2_6.dll
2012-08-11 22:47:56 ----A---- C:\Windows\system32\d3dx9_33.dll
2012-08-11 22:47:55 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2012-08-11 22:47:55 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2012-08-11 22:47:55 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2012-08-11 22:47:55 ----A---- C:\Windows\system32\xactengine2_5.dll
2012-08-11 22:47:55 ----A---- C:\Windows\system32\d3dx9_32.dll
2012-08-11 22:47:55 ----A---- C:\Windows\system32\d3dx10.dll
2012-08-11 22:47:54 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2012-08-11 22:47:54 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2012-08-11 22:47:54 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2012-08-11 22:47:54 ----A---- C:\Windows\system32\xactengine2_4.dll
2012-08-11 22:47:54 ----A---- C:\Windows\system32\x3daudio1_1.dll
2012-08-11 22:47:54 ----A---- C:\Windows\system32\d3dx9_31.dll
2012-08-11 22:47:53 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2012-08-11 22:47:53 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2012-08-11 22:47:53 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2012-08-11 22:47:53 ----A---- C:\Windows\system32\xinput1_2.dll
2012-08-11 22:47:53 ----A---- C:\Windows\system32\xactengine2_3.dll
2012-08-11 22:47:53 ----A---- C:\Windows\system32\xactengine2_2.dll
2012-08-11 22:47:52 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2012-08-11 22:47:52 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2012-08-11 22:47:52 ----A---- C:\Windows\system32\xinput1_1.dll
2012-08-11 22:47:52 ----A---- C:\Windows\system32\xactengine2_1.dll
2012-08-11 22:47:49 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2012-08-11 22:47:49 ----A---- C:\Windows\system32\d3dx9_30.dll
2012-08-11 22:47:48 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2012-08-11 22:47:48 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2012-08-11 22:47:48 ----A---- C:\Windows\system32\xactengine2_0.dll
2012-08-11 22:47:48 ----A---- C:\Windows\system32\x3daudio1_0.dll
2012-08-11 22:47:47 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2012-08-11 22:47:47 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2012-08-11 22:47:47 ----A---- C:\Windows\system32\d3dx9_29.dll
2012-08-11 22:47:47 ----A---- C:\Windows\system32\d3dx9_28.dll
2012-08-11 22:47:46 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2012-08-11 22:47:46 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2012-08-11 22:47:46 ----A---- C:\Windows\system32\d3dx9_26.dll
2012-08-11 22:47:46 ----A---- C:\Windows\system32\d3dx9_25.dll
2012-08-11 22:47:45 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2012-08-11 22:47:45 ----A---- C:\Windows\system32\d3dx9_24.dll
2012-08-11 22:45:53 ----D---- C:\Windows\SYSWOW64\directx
2012-08-11 21:42:03 ----D---- C:\Users\honza\AppData\Roaming\BonkEnc

======List of files/folders modified in the last 1 month======

2012-09-02 10:36:25 ----D---- C:\Windows\Prefetch
2012-09-02 10:36:24 ----D---- C:\Program Files\trend micro
2012-09-02 10:35:41 ----D---- C:\Windows\Temp
2012-09-02 10:26:04 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-09-02 09:30:08 ----D---- C:\Windows\System32
2012-09-02 09:30:08 ----D---- C:\Windows\inf
2012-09-02 09:30:08 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-09-02 09:27:04 ----D---- C:\Windows\tracing
2012-09-02 01:45:53 ----D---- C:\Windows\system32\config
2012-09-02 01:00:03 ----D---- C:\Windows
2012-09-02 00:14:19 ----D---- C:\Windows\SysWOW64
2012-09-02 00:08:56 ----D---- C:\Program Files (x86)\Common Files
2012-09-02 00:08:54 ----HD---- C:\ProgramData
2012-09-02 00:03:29 ----D---- C:\Users\honza\AppData\Roaming\DAEMON Tools Lite
2012-09-02 00:03:28 ----D---- C:\Users\honza\AppData\Roaming\uTorrent
2012-09-02 00:03:27 ----D---- C:\Windows\ModemLogs
2012-09-02 00:03:26 ----D---- C:\Windows\Logs
2012-09-02 00:03:26 ----D---- C:\Windows\debug
2012-09-01 20:19:13 ----D---- C:\ProgramData\NVIDIA
2012-09-01 20:12:49 ----SHD---- C:\Windows\Installer
2012-09-01 20:12:25 ----D---- C:\Windows\system32\drivers
2012-09-01 20:12:18 ----D---- C:\Windows\system32\DriverStore
2012-09-01 20:12:18 ----D---- C:\Windows\system32\catroot
2012-09-01 20:11:50 ----RD---- C:\Program Files (x86)
2012-09-01 18:50:05 ----D---- C:\Users\honza\AppData\Roaming\.purple
2012-08-31 08:25:11 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2012-08-29 22:30:44 ----D---- C:\Program Files (x86)\Oracle
2012-08-29 22:29:49 ----D---- C:\Program Files (x86)\Java
2012-08-29 22:29:19 ----D---- C:\Program Files\Java
2012-08-29 22:28:56 ----D---- C:\Program Files\Oracle
2012-08-29 20:38:32 ----D---- C:\Users\honza\AppData\Roaming\Skype
2012-08-29 19:39:30 ----D---- C:\Users\honza\AppData\Roaming\vlc
2012-08-28 17:12:09 ----D---- C:\Windows\winsxs
2012-08-28 10:50:24 ----D---- C:\Windows\pss
2012-08-28 09:52:26 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-08-28 09:46:49 ----D---- C:\Program Files (x86)\Adobe
2012-08-27 23:18:22 ----D---- C:\Program Files (x86)\Opera
2012-08-27 23:17:04 ----D---- C:\Program Files (x86)\MSXML 4.0
2012-08-27 23:16:33 ----RD---- C:\Program Files
2012-08-26 22:09:18 ----D---- C:\ProgramData\Skype
2012-08-15 23:37:08 ----RSD---- C:\Windows\Fonts
2012-08-15 23:37:08 ----D---- C:\Windows\SYSWOW64\migration
2012-08-15 23:37:08 ----D---- C:\Windows\system32\migration
2012-08-15 23:37:08 ----D---- C:\Program Files\Internet Explorer
2012-08-15 23:37:08 ----D---- C:\Program Files (x86)\Internet Explorer
2012-08-15 14:02:18 ----D---- C:\Windows\system32\catroot2
2012-08-15 14:02:12 ----D---- C:\ProgramData\Microsoft Help
2012-08-15 14:02:11 ----A---- C:\Windows\vbaddin.ini
2012-08-15 13:53:55 ----A---- C:\Windows\system32\MRT.exe
2012-08-13 22:02:21 ----D---- C:\Windows\system32\NDF
2012-08-12 23:36:35 ----D---- C:\Program Files (x86)\NetSetMan
2012-08-12 23:29:46 ----D---- C:\Program Files (x86)\DsNET Corp
2012-08-12 23:29:14 ----RSD---- C:\Windows\assembly
2012-08-12 23:24:15 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-08-12 23:24:08 ----SD---- C:\ProgramData\Microsoft
2012-08-12 23:17:12 ----D---- C:\Windows\SYSWOW64\1033
2012-08-12 23:14:40 ----D---- C:\Program Files (x86)\Microsoft.NET
2012-08-12 23:11:42 ----D---- C:\Program Files (x86)\Microsoft Office
2012-08-12 23:04:08 ----D---- C:\Program Files\Microsoft SQL Server
2012-08-12 23:04:08 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2012-08-12 22:59:43 ----D---- C:\Program Files (x86)\Google
2012-08-12 19:08:58 ----D---- C:\Temp
2012-08-11 10:46:22 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2012-08-06 16:04:13 ----D---- C:\Users\honza\AppData\Roaming\XnView

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-09-13 437272]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-03-20 203888]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2012-09-01 277088]
R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273); C:\Windows\system32\DRIVERS\tdrpm273.sys [2012-09-01 1263200]
R0 timounter;Acronis Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2012-09-01 970336]
R1 ATKWMIACPIIO;ATKWMIACPI Driver; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2012-03-11 577824]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2012-03-11 43248]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-20 283200]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-12-19 93200]
R1 NetworkX;NetworkX; C:\Windows\syswow64\ckldrv.sys []
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2010-04-12 91568]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2011-12-15 230864]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
R2 cag;Citrix cag plugin for Access Gateway; \??\C:\Program Files\Common Files\Deterministic Networks\Common Files\cag.sys [2010-08-04 96384]
R3 afcdp;afcdp; C:\Windows\system32\DRIVERS\afcdp.sys [2012-09-01 285280]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-06-27 2753536]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 ctxva51;Citrix Virtual Adapter; C:\Windows\system32\DRIVERS\ctxva51.sys [2011-02-14 45720]
R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne64x.sys [2008-11-16 157968]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2010-12-13 138024]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-05-17 2872680]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 15416]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-03-03 174184]
R3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
S0 vmci;VMware VMCI Bus Driver; C:\Windows\system32\DRIVERS\vmci.sys []
S3 ASUSProcObsrv;ASUS Process Creation/Termination Observer; \??\I:\I386\AsPrOb64.sys []
S3 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool64.sys [2006-11-10 30720]
S3 azvusb;Virtual USB Hub; C:\Windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfoX64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 emAudio;PCTV EMP Audio Device; C:\Windows\system32\drivers\emAudio64.sys [2012-02-04 77824]
S3 MonitorFunction;Driver for Monitor; C:\Windows\system32\DRIVERS\TVMonitor.sys [2011-01-12 16376]
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2011-05-05 20480]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2012-01-09 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2012-01-09 27136]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35344]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-04-22 25600]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 PORTMON;PORTMON; \??\D:\Instalacky\_SysinternalsSuite\PORTMSYS.SYS [2012-02-23 28656]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUVStor.sys [2010-08-03 290920]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2012-01-09 9216]
S3 USB28xxBGA;PCTV 320e Device; C:\Windows\system32\DRIVERS\emBDA64.sys [2011-12-17 576640]
S3 USB28xxOEM;USB 28xx OEM Filter; C:\Windows\system32\DRIVERS\emOEM64.sys [2011-12-17 54528]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-21 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2012-01-09 9216]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Služba Acronis Scheduler2; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [2010-12-17 1112664]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
R2 afcdpsrv;Služba Acronis Nonstop Backup; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2012-09-01 3246040]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2012-03-11 2815496]
R2 Crypkey License;Crypkey License; C:\Windows\system32\crypserv.exe [2008-05-08 122880]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 HP LaserJet Service;HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-06-24 136704]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2010-04-07 127800]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-03-26 12600]
R2 nsverctl;Citrix Secure Access Client Service; C:\Program Files\Citrix\Secure Access Client\nsverctl.exe [2011-02-14 154776]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-04-10 993896]
R2 Secunia PSI Agent;Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [2012-07-25 1326176]
R2 Secunia Update Agent;Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [2012-07-25 681056]
R2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
R2 SNMP;@%SystemRoot%\system32\snmp.exe,-3; C:\Windows\System32\snmp.exe [2010-11-21 49664]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-10 378472]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2012-07-16 2416040]
R2 TeamViewer7;TeamViewer 7; C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 136176]
S2 SkypeUpdate;Skype Updater; D:\Programy\Updater\Updater.exe [2012-06-14 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 250568]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2012-02-01 77944]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 136176]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-30 114144]
S3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2010-06-25 117264]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2012-04-22 720936]
S3 SQLBrowser;SQL Server Browser; C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2010-04-03 267616]
S3 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2010-04-03 146272]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 02 zář 2012 21:52

Zdravim

MWAV uz je davno mrtvy a neschopny detekce

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

Provedte aktualizaci
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

honnza · #3 Příspěvek od **honnza** » 03 zář 2012 17:32

Diky za reakci a info, program nic nenasel. Jen detekoval key finder.

3.9.2012 15:49:36
mbam-log-2012-09-03 (17-46-01).txt

Typ: Úplná kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 472877
Uplynulý čas: 1 hodin, 54 minut, 5 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
D:\Instalacky\OOOOOOO\Software\keyfinder.exe (RiskWare.Tool.CK) -> Žádná instrukce nebyla provedena.

(konec)

#4 Příspěvek od **vyosek** » 03 zář 2012 17:33

A ten keyfinder pouzivate prosim k cemu?

honnza · #5 Příspěvek od **honnza** » 03 zář 2012 18:03

Při reinstalaci pc, vypíše licenční klíče windows, office, atd...

#6 Příspěvek od **vyosek** » 03 zář 2012 19:38

OK, pro jistotu ale pustime CF, neco se mi tam nelibi

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

honnza · #7 Příspěvek od **honnza** » 04 zář 2012 07:39

Provedl jsem, přikládám log:

ComboFix 12-09-03.07 - honza 03.09.2012 23:42:32.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4074.2367 [GMT 2:00]
Spuštěný z: c:\users\honza\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\honza\AppData\Local\assembly\tmp
c:\windows\ST6UNST.000
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-08-03 do 2012-09-03 )))))))))))))))))))))))))))))))
.
.
2012-09-03 06:55 . 2012-09-03 06:55 -------- d-----w- c:\users\honza\AppData\Roaming\Malwarebytes
2012-09-03 06:52 . 2012-09-03 06:52 -------- d-----w- c:\programdata\Malwarebytes
2012-09-03 06:52 . 2012-09-03 06:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-03 06:52 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-03 06:40 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6AB06EFF-7827-438C-B03D-267B0DDD3EB3}\mpengine.dll
2012-09-01 23:35 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\VDLL.DLL
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\SysWow64\runouce.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\rundll16.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\RUNDL132.EXE
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\logo1_.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\logo_1.exe
2012-09-01 22:09 . 2012-09-01 22:09 632064 ----a-w- c:\windows\SysWow64\msvcr80.dll
2012-09-01 22:09 . 2012-09-01 22:09 554240 ----a-w- c:\windows\SysWow64\msvcp80.dll
2012-09-01 22:09 . 2012-09-01 22:09 34048 ----a-w- c:\windows\SysWow64\eEmpty.exe
2012-09-01 22:08 . 2012-09-01 22:08 -------- d-----w- c:\program files (x86)\Common Files\MicroWorld
2012-09-01 22:08 . 2012-09-01 22:08 -------- d-----w- c:\programdata\MicroWorld
2012-09-01 18:12 . 2012-09-01 18:12 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2012-09-01 18:12 . 2012-09-01 18:12 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2012-08-30 20:25 . 2012-08-30 20:25 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2012-08-28 08:32 . 2012-08-28 08:32 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-08-27 21:16 . 2012-08-27 21:16 -------- d-----w- c:\program files\Wireshark
2012-08-27 21:12 . 2012-08-27 21:12 268720 ----a-w- c:\windows\system32\javaws.exe
2012-08-27 21:12 . 2012-08-27 21:12 189360 ----a-w- c:\windows\system32\javaw.exe
2012-08-27 21:12 . 2012-08-27 21:12 188840 ----a-w- c:\windows\system32\java.exe
2012-08-27 21:08 . 2012-08-27 21:08 -------- d-----w- c:\users\honza\AppData\Local\Secunia PSI
2012-08-27 21:08 . 2012-08-27 21:08 -------- d-----w- c:\program files (x86)\Secunia
2012-08-27 18:03 . 2012-08-27 18:03 -------- d-----w- C:\videooutput
2012-08-27 18:03 . 2012-08-27 18:03 -------- d-----w- c:\program files (x86)\Smallvideosoft
2012-08-27 18:03 . 2009-06-04 11:17 8676883 ----a-w- c:\windows\SysWow64\NCMedia2.dll
2012-08-27 18:03 . 2009-05-19 16:32 758018 ----a-w- c:\windows\SysWow64\xvidcore.dll
2012-08-27 18:03 . 2008-12-04 19:46 180224 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2012-08-27 18:03 . 2008-10-08 08:16 139264 ----a-w- c:\windows\SysWow64\xvid.ax
2012-08-26 20:09 . 2012-08-26 20:09 -------- d-----w- c:\program files (x86)\Skype
2012-08-22 21:26 . 2012-08-23 08:55 -------- d-----w- C:\sporic
2012-08-15 12:02 . 2012-07-06 20:07 552960 ----a-w- c:\windows\system32\drivers\bthport.sys
2012-08-15 11:59 . 2012-06-29 05:02 754784 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2012-08-15 06:14 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
2012-08-15 06:14 . 2012-05-05 07:46 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2012-08-15 06:14 . 2012-02-11 06:43 751104 ----a-w- c:\windows\system32\win32spl.dll
2012-08-15 06:14 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2012-08-15 06:14 . 2012-02-11 05:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2012-08-15 06:14 . 2012-07-04 22:16 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-08-15 06:14 . 2012-07-04 22:13 59392 ----a-w- c:\windows\system32\browcli.dll
2012-08-15 06:14 . 2012-07-04 22:13 136704 ----a-w- c:\windows\system32\browser.dll
2012-08-15 06:14 . 2012-07-04 21:14 41984 ----a-w- c:\windows\SysWow64\browcli.dll
2012-08-15 06:14 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2012-08-15 06:14 . 2012-07-18 18:15 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-08-15 06:14 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
2012-08-14 19:09 . 2012-09-02 12:16 -------- d-----w- c:\program files\AudioCoder x64
2012-08-14 18:15 . 2012-09-02 12:16 -------- d-----w- c:\users\honza\AppData\Roaming\Broad Intelligence
2012-08-13 11:35 . 2012-08-13 11:35 5115584 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-08-12 20:40 . 2012-08-12 20:40 319 ----a-w- C:\user.js
2012-08-12 20:39 . 2012-08-12 20:39 -------- d-----w- c:\users\honza\AppData\Roaming\Babylon
2012-08-12 20:39 . 2012-08-12 20:39 -------- d-----w- c:\programdata\Babylon
2012-08-12 20:31 . 2012-08-12 20:45 -------- d-----w- c:\program files (x86)\RM Converter
2012-08-12 20:29 . 2007-11-05 19:15 421888 ----a-w- c:\windows\SysWow64\rmsp.ax
2012-08-12 17:05 . 2012-08-12 20:48 -------- d-----w- c:\program files (x86)\Easy RM to MP3 Converter
2012-08-12 16:47 . 2012-08-12 16:47 -------- d-----w- c:\users\honza\AppData\Roaming\Boilsoft
2012-08-11 20:47 . 2007-10-22 01:37 17928 ----a-w- c:\windows\SysWow64\X3DAudio1_2.dll
2012-08-11 19:44 . 2005-02-27 19:48 356352 ----a-w- c:\windows\SysWow64\RealMediaSplitter.ax
2012-08-11 19:42 . 2012-08-11 19:42 -------- d-----w- c:\users\honza\AppData\Roaming\BonkEnc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-28 07:52 . 2012-05-30 21:00 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-28 07:52 . 2011-11-01 19:06 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-15 11:53 . 2011-11-01 15:38 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-07-20 08:14 . 2012-07-20 08:14 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-06-25 14:04 . 2012-06-25 14:04 1394248 ----a-w- c:\windows\SysWow64\msxml4.dll
2012-06-09 05:43 . 2012-07-11 19:32 14172672 ----a-w- c:\windows\system32\shell32.dll
2012-06-06 06:49 . 2012-06-06 06:49 1070152 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2012-06-06 06:06 . 2012-07-11 19:32 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-06-06 06:06 . 2012-07-11 19:32 1881600 ----a-w- c:\windows\system32\msxml3.dll
2012-06-06 06:02 . 2012-07-11 19:32 1133568 ----a-w- c:\windows\system32\cdosys.dll
2012-06-06 05:05 . 2012-07-11 19:32 1390080 ----a-w- c:\windows\SysWow64\msxml6.dll
2012-06-06 05:05 . 2012-07-11 19:32 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2012-06-06 05:03 . 2012-07-11 19:32 805376 ----a-w- c:\windows\SysWow64\cdosys.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
"ScanSoft OmniPage 16-reminder"="c:\program files (x86)\ScanSoft\OmniPage16\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\OmniPage 16\Ereg\Ereg.ini"
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
.
R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 136176]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
R2 SkypeUpdate;Skype Updater;d:\programy\Updater\Updater.exe [2012-06-14 160944]
R2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2012-07-16 2416040]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 250568]
R3 ASUSProcObsrv;ASUS Process Creation/Termination Observer;i:\i386\AsPrOb64.sys [x]
R3 azvusb;Virtual USB Hub;c:\windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 136176]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MonitorFunction;Driver for Monitor;c:\windows\system32\DRIVERS\TVMonitor.sys [2011-01-12 16376]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-30 114144]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2011-05-05 20480]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 PORTMON;PORTMON;d:\instalacky\_SysinternalsSuite\PORTMSYS.SYS [2012-02-23 28656]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-01 1255736]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2012-03-11 577824]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2012-03-11 43248]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-20 283200]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 cag;Citrix cag plugin for Access Gateway;c:\program files\Common Files\Deterministic Networks\Common Files\cag.sys [2010-08-04 96384]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-06-24 136704]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-07 127800]
S2 nsverctl;Citrix Secure Access Client Service;c:\program files\Citrix\Secure Access Client\nsverctl.exe [2011-02-14 154776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-10 378472]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
S3 ctxva51;Citrix Virtual Adapter;c:\windows\system32\DRIVERS\ctxva51.sys [2011-02-14 45720]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-12-13 138024]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-03-03 174184]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-09-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-30 07:52]
.
2012-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 14:45]
.
2012-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 14:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-05-17 2226280]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-17 11855976]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\guard64.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.babylon.com/?affID=112060&tt=120812_bandext_3212_2&babsrc=HP_ss&mntrId=f8c81155000000000000162f689d5326
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = zelena:8080
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default\
FF - prefs.js: network.proxy.http - 10.0.0.90
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112060&tt=120812_bandext_3212_2
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - f8c81155000000000000162f689d5326
FF - user.js: extensions.BabylonToolbar.instlDay - 15564
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.622:40
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
.
.
------- Asociace souborů -------
.
txtfile="c:\program files (x86)\PSPad editor\PSPad.exe" "%1"
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
ShellIconOverlayIdentifiers-{B00DFEC8-C278-40FD-8832-76A9409991F3} - (no file)
ShellIconOverlayIdentifiers-{2022959D-8296-427A-9D9F-E59CC016F006} - (no file)
ShellIconOverlayIdentifiers-{B2483E28-1631-4E80-AA62-29B35EFEC7F0} - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*‰ţGh]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*‰ţGh\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*˙Gh]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*˙Gh\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-09-03 23:49:38
ComboFix-quarantined-files.txt 2012-09-03 21:49
.
Před spuštěním: Volných bajtů: 14 218 772 480
Po spuštění: Volných bajtů: 14 470 701 056
.
- - End Of File - - 617B987B58687DA4906BFB3BAE13967F

#8 Příspěvek od **vyosek** » 04 zář 2012 20:32

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Folder::
c:\users\honza\AppData\Roaming\Babylon
c:\programdata\Babylon

Driver::
gupdate
gupdatem

File::
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

DDS::
uStart Page = hxxp://search.babylon.com/?affID=112060 ... 2f689d5326

Firefox::
FF - ProfilePath - c:\users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default\
FF - prefs.js: network.proxy.http - 10.0.0.90
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112060&tt=120812_bandext_3212_2
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - f8c81155000000000000162f689d5326
FF - user.js: extensions.BabylonToolbar.instlDay - 15564
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.622:40
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false

RegLock::
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

honnza · #9 Příspěvek od **honnza** » 05 zář 2012 17:22

Díky za návod, spustil jsem:

Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4074.2664 [GMT 2:00]
Spuštěný z: c:\users\honza\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\honza\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Babylon
c:\users\honza\AppData\Roaming\Babylon
c:\users\honza\AppData\Roaming\Babylon\log_file.txt
c:\windows\SysWow64\wpcap.dll
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-08-05 do 2012-09-05 )))))))))))))))))))))))))))))))
.
.
2012-09-05 16:04 . 2012-09-05 16:04 -------- d-----w- c:\users\peta\AppData\Local\temp
2012-09-05 16:04 . 2012-09-05 16:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-04 16:34 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8D941EA8-1FA1-4A91-A472-98E4E2AD7995}\mpengine.dll
2012-09-03 06:55 . 2012-09-03 06:55 -------- d-----w- c:\users\honza\AppData\Roaming\Malwarebytes
2012-09-03 06:52 . 2012-09-03 06:52 -------- d-----w- c:\programdata\Malwarebytes
2012-09-03 06:52 . 2012-09-03 06:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-03 06:52 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-03 06:40 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\VDLL.DLL
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\SysWow64\runouce.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\rundll16.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\RUNDL132.EXE
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\logo1_.exe
2012-09-01 22:14 . 2012-09-01 22:14 -------- d---a-w- c:\windows\logo_1.exe
2012-09-01 22:09 . 2012-09-01 22:09 632064 ----a-w- c:\windows\SysWow64\msvcr80.dll
2012-09-01 22:09 . 2012-09-01 22:09 554240 ----a-w- c:\windows\SysWow64\msvcp80.dll
2012-09-01 22:09 . 2012-09-01 22:09 34048 ----a-w- c:\windows\SysWow64\eEmpty.exe
2012-09-01 22:08 . 2012-09-01 22:08 -------- d-----w- c:\program files (x86)\Common Files\MicroWorld
2012-09-01 22:08 . 2012-09-01 22:08 -------- d-----w- c:\programdata\MicroWorld
2012-09-01 18:12 . 2012-09-01 18:12 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2012-09-01 18:12 . 2012-09-01 18:12 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2012-08-30 20:25 . 2012-08-30 20:25 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2012-08-28 08:32 . 2012-08-28 08:32 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-08-27 21:16 . 2012-08-27 21:16 -------- d-----w- c:\program files\Wireshark
2012-08-27 21:12 . 2012-08-27 21:12 268720 ----a-w- c:\windows\system32\javaws.exe
2012-08-27 21:12 . 2012-08-27 21:12 189360 ----a-w- c:\windows\system32\javaw.exe
2012-08-27 21:12 . 2012-08-27 21:12 188840 ----a-w- c:\windows\system32\java.exe
2012-08-27 21:08 . 2012-08-27 21:08 -------- d-----w- c:\users\honza\AppData\Local\Secunia PSI
2012-08-27 21:08 . 2012-08-27 21:08 -------- d-----w- c:\program files (x86)\Secunia
2012-08-27 18:03 . 2012-08-27 18:03 -------- d-----w- C:\videooutput
2012-08-27 18:03 . 2012-08-27 18:03 -------- d-----w- c:\program files (x86)\Smallvideosoft
2012-08-27 18:03 . 2009-06-04 11:17 8676883 ----a-w- c:\windows\SysWow64\NCMedia2.dll
2012-08-27 18:03 . 2009-05-19 16:32 758018 ----a-w- c:\windows\SysWow64\xvidcore.dll
2012-08-27 18:03 . 2008-12-04 19:46 180224 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2012-08-27 18:03 . 2008-10-08 08:16 139264 ----a-w- c:\windows\SysWow64\xvid.ax
2012-08-26 20:09 . 2012-08-26 20:09 -------- d-----w- c:\program files (x86)\Skype
2012-08-22 21:26 . 2012-08-23 08:55 -------- d-----w- C:\sporic
2012-08-15 12:02 . 2012-07-06 20:07 552960 ----a-w- c:\windows\system32\drivers\bthport.sys
2012-08-15 11:59 . 2012-06-29 05:02 754784 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2012-08-15 06:14 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
2012-08-15 06:14 . 2012-05-05 07:46 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2012-08-15 06:14 . 2012-02-11 06:43 751104 ----a-w- c:\windows\system32\win32spl.dll
2012-08-15 06:14 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2012-08-15 06:14 . 2012-02-11 05:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2012-08-15 06:14 . 2012-07-04 22:16 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-08-15 06:14 . 2012-07-04 22:13 59392 ----a-w- c:\windows\system32\browcli.dll
2012-08-15 06:14 . 2012-07-04 22:13 136704 ----a-w- c:\windows\system32\browser.dll
2012-08-15 06:14 . 2012-07-04 21:14 41984 ----a-w- c:\windows\SysWow64\browcli.dll
2012-08-15 06:14 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2012-08-15 06:14 . 2012-07-18 18:15 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-08-15 06:14 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
2012-08-14 19:09 . 2012-09-02 12:16 -------- d-----w- c:\program files\AudioCoder x64
2012-08-14 18:15 . 2012-09-02 12:16 -------- d-----w- c:\users\honza\AppData\Roaming\Broad Intelligence
2012-08-13 11:35 . 2012-08-13 11:35 5115584 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-08-12 20:40 . 2012-08-12 20:40 319 ----a-w- C:\user.js
2012-08-12 20:31 . 2012-08-12 20:45 -------- d-----w- c:\program files (x86)\RM Converter
2012-08-12 20:29 . 2007-11-05 19:15 421888 ----a-w- c:\windows\SysWow64\rmsp.ax
2012-08-12 17:05 . 2012-08-12 20:48 -------- d-----w- c:\program files (x86)\Easy RM to MP3 Converter
2012-08-12 16:47 . 2012-08-12 16:47 -------- d-----w- c:\users\honza\AppData\Roaming\Boilsoft
2012-08-11 20:47 . 2007-10-22 01:37 17928 ----a-w- c:\windows\SysWow64\X3DAudio1_2.dll
2012-08-11 19:44 . 2005-02-27 19:48 356352 ----a-w- c:\windows\SysWow64\RealMediaSplitter.ax
2012-08-11 19:42 . 2012-08-11 19:42 -------- d-----w- c:\users\honza\AppData\Roaming\BonkEnc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-28 07:52 . 2012-05-30 21:00 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-28 07:52 . 2011-11-01 19:06 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-15 11:53 . 2011-11-01 15:38 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-07-20 08:14 . 2012-07-20 08:14 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-06-25 14:04 . 2012-06-25 14:04 1394248 ----a-w- c:\windows\SysWow64\msxml4.dll
2012-06-09 05:43 . 2012-07-11 19:32 14172672 ----a-w- c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-09-03_21.47.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2012-09-05 06:11 35610 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2012-09-03 06:34 35610 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-11-01 14:52 . 2012-09-05 06:11 17674 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4097343020-4191218015-1573909682-1000_UserData.bin
+ 2011-11-01 21:22 . 2012-09-05 16:05 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-11-01 21:22 . 2012-09-03 06:29 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-11-01 21:22 . 2012-09-03 06:29 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-11-01 21:22 . 2012-09-05 16:05 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-05 16:05 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-03 06:29 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-11-01 15:21 . 2012-09-05 16:04 5777 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
- 2011-11-01 15:21 . 2012-09-02 20:32 5777 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
- 2012-09-03 06:29 . 2012-09-03 06:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-09-05 16:05 . 2012-09-05 16:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-09-05 16:05 . 2012-09-05 16:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-09-03 06:29 . 2012-09-03 06:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-03 13:58 . 2012-09-05 15:13 448668 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2011-11-03 19:28 . 2012-09-04 03:50 314726 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2012-09-05 15:16 685562 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-09-03 15:42 685562 c:\windows\system32\perfh009.dat
+ 2011-04-12 08:34 . 2012-09-05 15:16 700208 c:\windows\system32\perfh005.dat
- 2011-04-12 08:34 . 2012-09-03 15:42 700208 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2012-09-05 15:16 136824 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-09-03 15:42 136824 c:\windows\system32\perfc009.dat
- 2011-04-12 08:34 . 2012-09-03 15:42 156198 c:\windows\system32\perfc005.dat
+ 2011-04-12 08:34 . 2012-09-05 15:16 156198 c:\windows\system32\perfc005.dat
+ 2009-07-14 05:01 . 2012-09-05 16:04 467952 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-09-02 20:32 467952 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-11-01 19:46 . 2012-09-05 16:04 60174612 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4097343020-4191218015-1573909682-1000-12288.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
"ScanSoft OmniPage 16-reminder"="c:\program files (x86)\ScanSoft\OmniPage16\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\OmniPage 16\Ereg\Ereg.ini"
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
.
R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;d:\programy\Updater\Updater.exe [2012-06-14 160944]
R2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2012-07-16 2416040]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 250568]
R3 ASUSProcObsrv;ASUS Process Creation/Termination Observer;i:\i386\AsPrOb64.sys [x]
R3 azvusb;Virtual USB Hub;c:\windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MonitorFunction;Driver for Monitor;c:\windows\system32\DRIVERS\TVMonitor.sys [2011-01-12 16376]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-30 114144]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2011-05-05 20480]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PORTMON;PORTMON;d:\instalacky\_SysinternalsSuite\PORTMSYS.SYS [2012-02-23 28656]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-01 1255736]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2012-03-11 577824]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2012-03-11 43248]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-20 283200]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 cag;Citrix cag plugin for Access Gateway;c:\program files\Common Files\Deterministic Networks\Common Files\cag.sys [2010-08-04 96384]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-06-24 136704]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-07 127800]
S2 nsverctl;Citrix Secure Access Client Service;c:\program files\Citrix\Secure Access Client\nsverctl.exe [2011-02-14 154776]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-10 378472]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
S3 ctxva51;Citrix Virtual Adapter;c:\windows\system32\DRIVERS\ctxva51.sys [2011-02-14 45720]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-12-13 138024]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-03-03 174184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-03 14:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-05-17 2226280]
"ETDCtrl"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-17 11855976]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
"combofix"="c:\combofix\CF24893.3XE" [2010-11-21 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\guard64.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = zelena:8080
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\honza\AppData\Roaming\Mozilla\Firefox\Profiles\v00h4x0c.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
ShellIconOverlayIdentifiers-{B00DFEC8-C278-40FD-8832-76A9409991F3} - (no file)
ShellIconOverlayIdentifiers-{2022959D-8296-427A-9D9F-E59CC016F006} - (no file)
ShellIconOverlayIdentifiers-{B2483E28-1631-4E80-AA62-29B35EFEC7F0} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*‰ţGh]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*‰ţGh\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*˙Gh]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-4097343020-4191218015-1573909682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*˙Gh\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\crypserv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
.
**************************************************************************
.
Celkový čas: 2012-09-05 18:14:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-09-05 16:14
ComboFix2.txt 2012-09-03 21:49
.
Před spuštěním: Volných bajtů: 14 559 739 904
Po spuštění: Volných bajtů: 14 180 548 608
.
- - End Of File - - AA56B1414B8D5373C83D83DFDEC1E8C9

#10 Příspěvek od **vyosek** » 05 zář 2012 20:15

Jak se chova PC

honnza · #11 Příspěvek od **honnza** » 07 zář 2012 08:12

Omlouvám se že píšu až teď, nechal jsem si čas na pozorování, PC se chová dobře, moc děkuju za pomoc.

#12 Příspěvek od **vyosek** » 07 zář 2012 21:21

Tak jeste uklidime

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

honnza · #13 Příspěvek od **honnza** » 13 zář 2012 20:31

Tak všechno jsem provedl, děkuju moc!

#14 Příspěvek od **vyosek** » 13 zář 2012 22:06

Nemate zac, rad jsem pomohl

Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat

VIRY.CZ

preventivní kontrola

preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola

Re: preventivní kontrola