Adobe arkalis.exe Vyřešeno

[Zajda]

Po spuštění RogueKilleru mi to následně shodilo celý PC, něco ve smyslu "System has been shutdown to pervent damage"
Jdu to zkusit znovu.

[Reklama]

[jerabina]

Proveď to v nouzovém režimu.

[Zajda]

Na druhý pokus to vyšlo i bez nouzového režimu, přikládám log:

RogueKiller V10.11.0.0 (x64) [Oct 12 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : user [Práva správce]
Started from : C:\Users\user\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 10/15/2015 18:12:32

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 9 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ESEADriver2 (\??\C:\Users\user\AppData\Local\Temp\ESEADriver2.sys) -> Nalezeno
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESEADriver2 (\??\C:\Users\user\AppData\Local\Temp\ESEADriver2.sys) -> Nalezeno
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ESEADriver2 (\??\C:\Users\user\AppData\Local\Temp\ESEADriver2.sys) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 23 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] static3.cdn.ubi.com
[C:\Windows\System32\drivers\etc\hosts] ubisoft-orbit.s3.amazonaws.com
[C:\Windows\System32\drivers\etc\hosts] onlineconfigservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] orbitservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] ubisoft-orbit-savegames.s3.amazonaws.com
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.se # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 http://www.easyanticheat.se # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.com # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 http://www.easyanticheat.com # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.info # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 http://www.easyanticheat.info # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.org # misleading site
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 http://www.easyanticheat.org # misleading site
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 static3.cdn.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit.s3.amazonaws.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 onlineconfigservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 orbitservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 static3.cdn.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit.s3.amazonaws.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 onlineconfigservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 orbitservice.ubi.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST9500420AS ATA Device +++++
--- User ---
[MBR] 2aff65163a81fdfc83685008ca881629
[BSP] c9214f278b86a064d72ac6389c0dec9e : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 476838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[Orcus]

Ten hosts máš upravený schválně?

[Zajda]

Ano, smazal jsem tam pár stránek - konkrétně 6(12 řádků), které bych si rád ponechal v soukromí...

[jerabina]

Jasný, odškrtej si tam co chceš ponechat, my nevidíme do toho, co uživatel má nastavený schválně a co ne, takže tak ..

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka) - co si chceš ponechat, tak neoznačovat
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;


klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[Zajda]

RogueKiller log:

RogueKiller V10.11.0.0 (x64) [Oct 12 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : user [Práva správce]
Started from : C:\Users\user\Desktop\RogueKillerX64.exe
Mód : Smazat -- Datum : 10/15/2015 20:48:44

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 6 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9F2152D1-5D5A-42D1-95C7-A21D4368F54E} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 23 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] static3.cdn.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] ubisoft-orbit.s3.amazonaws.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] onlineconfigservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] orbitservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] ubisoft-orbit-savegames.s3.amazonaws.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.se # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 www.easyanticheat.se # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.com # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 www.easyanticheat.com # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.info # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 www.easyanticheat.info # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 easyanticheat.org # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 255.255.255.255 www.easyanticheat.org # misleading siteSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 static3.cdn.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit.s3.amazonaws.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 onlineconfigservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 orbitservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 static3.cdn.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit.s3.amazonaws.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 onlineconfigservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 orbitservice.ubi.comSmazáno
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.comSmazáno

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST9500420AS ATA Device +++++
--- User ---
[MBR] 2aff65163a81fdfc83685008ca881629
[BSP] c9214f278b86a064d72ac6389c0dec9e : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 476838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[jaro3]

Ještě Combofix.

[Zajda]

Zoek zde, combox udělám možná až zítra, nevím jak mi to vyjde s časem

Zoek.exe v5.0.0.1 Updated 14-October-2015
Tool run by user on źt 15.10.2015 at 21:05:52,03.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\user\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

15.10.2015 21:09:49 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\Activision deleted successfully
C:\PROGRA~2\Runtime Software deleted successfully
C:\Program Files\ATI Technologies deleted successfully
C:\PROGRA~3\Alwil Software deleted successfully
C:\PROGRA~3\AVAST Software deleted successfully
C:\PROGRA~3\BlazeVideo deleted successfully
C:\PROGRA~3\regid.1986-12.com.adobe deleted successfully
C:\PROGRA~3\Symantec deleted successfully
C:\PROGRA~3\TamoSoft deleted successfully
C:\Users\user\AppData\Roaming\HMYGSetting deleted successfully
C:\Users\user\AppData\Roaming\Publish Providers deleted successfully
C:\Users\user\AppData\Roaming\Solveig Multimedia deleted successfully
C:\Users\user\AppData\Roaming\Windows Live Writer deleted successfully
C:\Windows\serviceprofiles\Localservice\AppData\Roaming\Xfire deleted successfully
C:\Users\user\AppData\Local\Razer deleted successfully
C:\Users\user\AppData\Local\WMTools Downloaded Files deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-4086649008-2257900480-963630289-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2FE45939-736F-443E-9BFA-DDEC600806D9} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WtuSystemSupport deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WtuSystemSupport deleted successfully

==== Deleting Files \ Folders ======================

C:\PROGRA~2\AV Vcs 7.0 not found
C:\PROGRA~2\Activision not found
C:\PROGRA~2\Runtime Software not found
C:\windows\SysNative\Tasks\0915wtUpdateInfo deleted
C:\Users\user\AppData\Local\AVG Web TuneUp deleted
C:\Users\user\.android deleted
C:\PROGRA~2\AVG Web TuneUp deleted
C:\PROGRA~2\COMMON~1\Wondershare deleted
C:\user.js deleted
C:\install.exe deleted
C:\Users\user\AppData\Roaming\Wondershare deleted
C:\PROGRA~3\AVG Web TuneUp deleted
C:\PROGRA~3\InstallMate deleted
C:\PROGRA~3\{65AB91D4-DDD0-48D4-804D-C24E1FC90D44} deleted
C:\Users\user\AppData\Local\Unity deleted
C:\Users\user\AppData\Local\Wondershare deleted
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk deleted
C:\Users\user\AppData\LocalLow\Unity deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AskToolbar deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\BabylonToolbar deleted
C:\Windows\tasks\0915wtUpdateInfo.job deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Users\user\AppData\Roaming\gy84i.exe deleted
"C:\Users\user\AppData\Local\{CB471C44-4859-4478-9840-65D931F1357B}" deleted
"C:\PROGRA~3\Package Cache" deleted

==== Fake Chromium Profiles Check ======================

Fake profile C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome deleted

==== Chromium Look ======================

Google Chrome Version: 46.0.2490.71

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
noebaifjopccondbkcieccphcpijhdne - C:\Users\user\AppData\Local\Temp\ccex.crx[]

SIH - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl
Facebook Customizer (by Adblock Plus) - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm
Block site - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiimnmioipafcokbfikbljfdeojpcgbh
LoungeDestroyer - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl
AdBlock - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
S.T.H. - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhoahihokddepjlegpenefeaahdkojog
Další informace - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifkeibmggfaajjabkkdbpeoiielmnjd
Dingit Infinite HD App - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\llnhnfikffkjbdnfallfpgikamegbbag
Enhanced Steam - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\okadibdjfemgnhjiembecghcbfknbfhg

==== Chromium Fix ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_partner.support.services.microsoft.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.freelogoservices.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_deals.razerzone.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhoahihokddepjlegpenefeaahdkojog deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lhoahihokddepjlegpenefeaahdkojog_0 deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
"Search Bar"="http://www.google.com/ie"
"Default_Search_URL"="http://www.google.com/ie"
"Default_Page_URL"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
@="http://www.google.com/search?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.google.com"
"Default_Search_URL"="http://www.google.com/ie"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{1CB8822C-3047-418F-83C2-AD88E7772FB2} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_13415"
{4C7D999B-540A-4AA4-86B4-8DBBCBF1385C} Novinky.cz Url="http://www.novinky.cz/hledej?w={searchTerms}&sourceid=QuickSearch_13415"
{51B9C20D-BA09-4708-BB7F-832E92D30060} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_13415"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7PRFA_csCZ418"
{77D917EA-76E6-4599-8A73-DC7BAFC5CF38} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_13415"
{87E0A5E1-F9BF-4924-A4D9-2999E0299A70} Firmy.cz Url="http://www.firmy.cz/?q={searchTerms}&sourceid=QuickSearch_13415"
{9E11799C-8715-4BAC-A3D4-8635365CF942} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_13415"
{B3D11C1F-86B1-4A2D-A631-422D38D9A574} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_13415"
{E3D0900A-2294-461D-A840-102C302311DC} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_13415"
{E6521AF9-AE29-4213-95DC-E73C69D81233} WebHledani Url="http://www.webhledani.cz/results.aspx?i=39&tp=ie&q={searchTerms}"

==== Reset Google Chrome ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences.bad was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\noebaifjopccondbkcieccphcpijhdne deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Web TuneUp deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Any Wallpaper deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESL Wire deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Finder deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Overwolf deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=634 folders=426 799527870 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\user\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\user\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on źt 15.10.2015 at 21:42:50,71 ======================

[Zajda]

Log z ComboxFixu se sem nevešel celý, bude to rozdělený:

ComboFix 15-10-15.01 - user 15.10.2015 22:24:44.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4092.2487 [GMT 2:00]
Spuštěný z: c:\users\user\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {4D41356F-32AD-7C42-C820-63775EE4F413}
SP: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {F620D48B-1497-73CC-F290-58052563BEAE}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 12 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Local\assembly\tmp
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Run
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-15 do 2015-10-15 )))))))))))))))))))))))))))))))
.
.
2015-10-15 19:30 . 2015-10-15 19:05 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-15 18:54 . 2015-10-15 19:27 -------- d-----w- C:\zoek_backup
2015-10-15 15:41 . 2015-10-15 18:07 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-15 15:41 . 2015-10-15 16:24 -------- d-----w- c:\programdata\RogueKiller
2015-10-15 10:48 . 2015-10-15 14:55 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-15 10:47 . 2015-10-05 07:50 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-15 10:47 . 2015-10-05 07:50 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-15 10:47 . 2015-10-05 07:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-15 10:47 . 2015-10-15 10:47 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2015-10-15 10:43 . 2015-10-15 11:39 -------- d-----w- C:\AdwCleaner
2015-10-14 13:04 . 2015-08-06 18:04 14176768 ----a-w- c:\windows\system32\shell32.dll
2015-10-14 13:03 . 2015-09-29 03:16 5569472 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-14 13:00 . 2015-10-01 18:06 692672 ----a-w- c:\windows\system32\winload.efi
2015-10-14 13:00 . 2015-10-01 18:04 616360 ----a-w- c:\windows\system32\winresume.efi
2015-10-14 13:00 . 2015-10-01 18:00 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-10-14 13:00 . 2015-10-01 18:00 59392 ----a-w- c:\windows\system32\appidapi.dll
2015-10-14 13:00 . 2015-10-01 18:00 32768 ----a-w- c:\windows\system32\appidsvc.dll
2015-10-14 13:00 . 2015-10-01 18:00 17920 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-10-14 13:00 . 2015-10-01 18:00 147456 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-10-14 13:00 . 2015-10-01 17:50 50688 ----a-w- c:\windows\SysWow64\appidapi.dll
2015-10-14 13:00 . 2015-10-01 17:00 61440 ----a-w- c:\windows\system32\drivers\appid.sys
2015-10-13 15:09 . 2015-10-13 15:09 110336 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2015-10-13 15:09 . 2015-10-13 15:09 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
2015-10-13 15:07 . 2015-10-13 15:15 -------- d-----w- c:\programdata\Wondershare
2015-10-13 15:07 . 2015-10-13 16:31 -------- d--h--w- c:\program files (x86)\DrFoneAndroid_Temp
2015-10-12 17:36 . 2015-10-12 17:36 -------- d-----w- c:\program files\ESEA
2015-10-12 16:50 . 2015-10-12 16:50 -------- d-----w- c:\programdata\ATI
2015-10-12 13:53 . 2015-10-12 13:53 -------- d-----w- c:\program files (x86)\AMD AVT
2015-10-12 13:53 . 2015-10-12 13:53 -------- d-----w- c:\program files (x86)\AMD APP
2015-10-12 13:53 . 2015-10-12 13:53 -------- d-----w- c:\program files\Common Files\ATI Technologies
2015-10-12 13:53 . 2015-10-12 13:53 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2015-10-12 13:52 . 2015-10-12 13:52 -------- d-----w- c:\program files\ATI
2015-10-12 13:32 . 2015-10-12 13:34 -------- d-----w- c:\program files\AMD
2015-10-12 13:18 . 2015-10-12 13:21 -------- d-----w- C:\$Windows.~BT
2015-10-08 14:14 . 2015-10-08 14:14 -------- d-----w- c:\program files (x86)\Mojang
2015-10-08 14:09 . 2015-10-08 14:09 -------- d-----w- c:\programdata\Caphyon
2015-10-08 14:09 . 2015-10-12 15:11 -------- d-----w- c:\program files (x86)\Adobe Arkalis
2015-10-08 14:07 . 2015-10-08 14:07 -------- d-----w- c:\users\user\AppData\Roaming\Mojang
2015-10-03 12:34 . 2015-10-12 17:10 -------- d-----w- c:\users\user\AppData\Roaming\.minecraft
2015-09-27 09:12 . 2015-09-27 09:12 22200 ----a-w- c:\windows\SysWow64\drivers\DrvAgent64.SYS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-14 16:37 . 2011-02-16 13:16 143481208 ----a-w- c:\windows\system32\MRT.exe
2015-10-14 14:36 . 2014-02-23 08:08 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-10-14 14:36 . 2014-02-23 08:08 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-09-29 02:58 . 2015-10-14 13:03 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-09-15 18:11 . 2015-10-14 13:03 342016 ----a-w- c:\windows\system32\schannel.dll
2015-09-15 17:36 . 2015-10-14 13:03 248832 ----a-w- c:\windows\SysWow64\schannel.dll
2015-09-02 03:04 . 2015-09-09 13:09 41984 ----a-w- c:\windows\system32\lpk.dll
2015-09-02 03:04 . 2015-09-09 13:09 100864 ----a-w- c:\windows\system32\fontsub.dll
2015-09-02 03:04 . 2015-09-09 13:09 14336 ----a-w- c:\windows\system32\dciman32.dll
2015-09-02 03:04 . 2015-09-09 13:09 46080 ----a-w- c:\windows\system32\atmlib.dll
2015-09-02 02:48 . 2015-09-09 13:09 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2015-09-02 02:48 . 2015-09-09 13:09 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2015-09-02 02:48 . 2015-09-09 13:09 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-09-02 02:47 . 2015-09-09 13:09 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2015-09-02 01:51 . 2015-09-09 13:09 3209216 ----a-w- c:\windows\system32\win32k.sys
2015-09-02 01:47 . 2015-09-09 13:09 372736 ----a-w- c:\windows\system32\atmfd.dll
2015-09-02 01:33 . 2015-09-09 13:09 299520 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-08-28 16:09 . 2014-10-15 12:34 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-08-27 18:18 . 2015-09-09 13:11 2004480 ----a-w- c:\windows\system32\msxml6.dll
2015-08-27 18:18 . 2015-09-09 13:11 1887232 ----a-w- c:\windows\system32\msxml3.dll
2015-08-27 18:13 . 2015-09-09 13:11 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-08-27 18:13 . 2015-09-09 13:11 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-08-27 17:58 . 2015-09-09 13:11 1391104 ----a-w- c:\windows\SysWow64\msxml6.dll
2015-08-27 17:58 . 2015-09-09 13:11 1241088 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-08-27 17:51 . 2015-09-09 13:11 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2015-08-27 17:51 . 2015-09-09 13:11 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-08-19 09:53 . 2015-08-19 09:53 297904 ----a-w- c:\windows\system32\drivers\avgidsha.sys
2015-08-19 09:52 . 2015-08-19 09:52 313264 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys
2015-08-05 17:56 . 2015-09-09 13:13 1110016 ----a-w- c:\windows\system32\schedsvc.dll
2015-08-05 17:56 . 2015-09-09 13:13 24576 ----a-w- c:\windows\system32\jnwmon.dll
2015-08-05 17:56 . 2015-09-09 13:13 275456 ----a-w- c:\windows\system32\InkEd.dll
2015-08-05 17:40 . 2015-09-09 13:13 216064 ----a-w- c:\windows\SysWow64\InkEd.dll
2015-08-04 09:32 . 2015-08-04 09:32 300464 ----a-w- c:\windows\system32\drivers\avgtdia.sys
2015-08-04 09:32 . 2015-08-04 09:32 250800 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
2015-07-30 18:06 . 2015-08-12 16:37 1180160 ----a-w- c:\windows\system32\FntCache.dll
2015-07-30 18:06 . 2015-08-12 16:37 1648128 ----a-w- c:\windows\system32\DWrite.dll
2015-07-30 18:06 . 2015-08-12 16:37 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2015-07-30 17:57 . 2015-08-12 16:37 1251328 ----a-w- c:\windows\SysWow64\DWrite.dll
2015-07-30 17:57 . 2015-08-12 16:37 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2015-07-30 13:13 . 2015-08-12 20:53 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-07-30 13:13 . 2015-08-12 20:53 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-07-28 20:09 . 2015-08-10 07:31 17344 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-07-28 20:05 . 2015-08-10 07:31 774656 ----a-w- c:\windows\system32\invagent.dll
2015-07-28 20:05 . 2015-08-10 07:31 743424 ----a-w- c:\windows\system32\generaltel.dll
2015-07-28 20:05 . 2015-08-10 07:31 437760 ----a-w- c:\windows\system32\devinv.dll
2015-07-28 20:05 . 2015-08-10 07:31 1116672 ----a-w- c:\windows\system32\appraiser.dll
2015-07-28 20:05 . 2015-08-10 07:31 69120 ----a-w- c:\windows\system32\acmigration.dll
2015-07-28 20:05 . 2015-08-10 07:31 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-07-28 19:55 . 2015-08-10 07:31 1148416 ----a-w- c:\windows\system32\aeinv.dll
2015-07-23 00:02 . 2015-09-09 13:12 1390592 ----a-w- c:\windows\system32\diagtrack.dll
2015-07-23 00:02 . 2015-09-09 13:12 879104 ----a-w- c:\windows\system32\tdh.dll
2015-07-23 00:02 . 2015-09-09 13:12 879104 ----a-w- c:\windows\system32\advapi32.dll
2015-07-22 17:53 . 2015-09-09 13:12 635392 ----a-w- c:\windows\SysWow64\tdh.dll
2015-07-22 17:53 . 2015-09-09 13:12 641536 ----a-w- c:\windows\SysWow64\advapi32.dll
2015-07-22 16:48 . 2015-09-09 13:12 41984 ----a-w- c:\windows\system32\UtcResources.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))

[Zajda]

.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-11 39408]
"cz.seznam.software.autoupdate"="c:\users\user\AppData\Roaming\Seznam.cz\szninstall.exe" [2013-05-16 1062472]
"cz.seznam.software.szndesktop"="c:\users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2015-05-26 103080]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-09-16 8461224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]
"AVG_UI"="c:\program files (x86)\AVG\AVG2015\avgui.exe" [2015-08-24 3775912]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-08-04 597552]
"WindowsDriverScan86"="c:\program files (x86)\Adobe Arkalis\Arkalis86.lnk" [2014-08-10 1501]
"WindowsDriverScan64"="c:\program files (x86)\Adobe Arkalis\Arkalis.lnk" [2014-08-10 1419]
"StartCCC"="c:\program files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2015-08-04 767176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[Zajda]

.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"301548880"= 504b0304ce5eec795045f9114d07000000300000e269f63d73594f6202c9694280cc96a28bbd63516fd3c2d5f7a2ff87ac3a990c3ec3b2ed7b07716237a0dfb1dfb651f67e31cb2e7649f98d5e55e9b25b1a579794989b176c357bdcc11226bd6ecb7de8a63ea216ab2a6f3bd651da5faa614c3ba48e87cc21c53a1354637b181014af26c92a0adbd1208eb42d8b55201d9d7b98423e41af179ddebe3ef4931015a2fc7b58a77630d30af187efca692a305fca408b0f84a60a0242fe94cf438cb216c9ad12c3969908df6593a382ef2f1fb27a6747d5e0867a216af309d7e397c00933f25264653e8824f1dfa27db2ec64c86f7403dd00d7db84bdd336e4f6ac5c84480b88d554e4a12fbf8d0b1e17061aadf7fa3ebe3e66f6e5193dd47dbe4b6fa2b5f36978356b8ec3fb66fcef4d7e5dd575dab2ed92efb281edf5083fba9393c06bed52f2a0bf7024b8f3ee5fa6e58247a1872dcf32345cc268be7090fc8bca9031ce0eb9835e98cc5da0ddb58b2aa38881d3b649600449633a0d1ea900691ffd79c68431a4a801fd923f9464b2cd1d7cf271b49db22b64bea8d763d7ed10441db4af5af2f14b3e2625806b35dc1e3370e7c9d948450ff997c32b477e51f3503508a858988495c1577c9c771f422ca4a3a34fc40202cab3ec70b9861a4c090fc11b8b97f2eb97c8e63d924903dc305a23c5af9ea18a5b5f2d31b3c93456598012280033381391f3714e6be80461f80a63a2b66a8c624a42d13b0d94d2a552018c2a92a847cb3d063165a6a65a3f6544c3e4eb3745828289dfe27f1709125c65538129efefd347436ec0e568af39425be10bab7d777d5c405b5e9f2a204c189d040050e7dbd8aae22d251c041b5ead104e43a5ec430568d8fa7123096ee44be719039204a44f19c41615dfef33586da39ac570127c6f6a6c593c105dd159f1fe27f684fe31d12e9d141ebbb9bccf1b9e4c709ec75bfdb65f65f59a61ec7f1281e74299e363b0c0b48f5c68b005479c7212b276c937f6e50086ff9fa01aeb3174439c531478633f9bb9710924b2445de3f019b959f073829327e6ec21810d0f75bb04b58e08e3cd2f76208402cc78a1baafee71dc5cd48116fdb03a45d03189b3f41b12430cf44702588cc854a2c01a4c46e0ea07fef803bd82a14f6118c1e15e1a6f3138bbe12b6fa9d040f35381380ab91715090c941ed1168429137b9bdfa5eb1933b2fc172df71dbb33693373709b05c504a50dda99cf6059f54d9bc8b3d578ca2507d1ab9c0331e8b11aa786a465722ef9b10824aecfc7972b670176153ee0342f14247363127c36a946a57610682f9c8294d14f9c11f6b8638510da26e64c255907262fd6b8699c23a4b817ba820461557a935f4f953183050c119291b573f483d4f23e4a76c34f3bd83ec3f4bd0e0af0c336982df6aa91d1f394a713b3f52fdd1a9c1f84bd764805d2b671500addd862b5fd461ca270fc2cebdc60cf12484818177f457e001042a034767f87c0f0f4e3bb561a405e839b327842e9a0902799efaf53ee7aa46f004df217838d944e4908d11c26191832c5bb5a32b62f64821f721538d361a6d2cf2dd96793005522b34f90b1d32e3120450827d3961c3c42cb618651ea41f727454047f1ba936fee2ef93b921add680c1b6888e93faa225b2dbba9265643860ab105ebfd430b381f0903825b75ede1d60bbc286d468bd031a0ad6f5c3bf6f0b92b17a41851fc3fb43773d51a7e07f46a95cced70778a8b5d3cc463242ebd0fe0f63e46f7934c48f27cae082b59476384482044b29e37c8cb1f39baf0d8ee95133c2340205f9daf18b2f9bd64f94bcc83987721b96451f4d8d83e71c916780cfbdb9f03b44dcb380b1a2e0da69ad52ce9c6c7afff2dd41b41c50c3e590bf830458a1fb3c4debf4e43aafd18e6a32cd7bf7aceaae18928629291820cd84f61a8cda2ddcc38a7fc3cda32d6580a36b92a668090931f54b28516eb6014d2e1ff2cb4d48d8cb17bd1e023d78ceeb25e9477205d8ab3501960dca31f1e521a3b35e20f95edc6d5c5806d784c118392608b2ff083a1d338d3266d60d0476c1cce2e7424ed2957529c4a49d5642b1400efe3550f5fad307a9bbb05b3b521b2430add241acb8e6726f03ebf803016643da16571c379841ed7bbef2dace29ae310fb921b7f662ae27dc7f3910a431144f0c14e35a72023a517510320e1b42d942736f05f9899566e8bce12bdda8ac87672e32fa899d56374cf9c2b11e1c1a6aec317965d467ea6f2d0e1a85d91e1ad6d8e6c00df00df68aa0e2cfdd0c85e85a0d5d832f917a4f21480294879e17641e9d752ea256d45f9168c612fc8f34052a9fd080c6a3302c77c558c7ce415d3436477694bd80c428ff160516271e44372e923d2432b8710a8a514fa30066bd5555d64e576be5a823407623749651380c5ce859b6f090a686155a2f2fd804af3bb7fd1ad171205233fa1047842804daf24d99bd0c371cfdfd2223a64d6f1f2af995240df3d62a7172ac416a980ee43ed005282243ce5a48d174192da3f0d1faacc4135685bc5e55afd4e56b03244213a492f88ea0b4a0e8342ecb2635698f193b44a5d16fb7c14fd6e2b41f319d0083cbfd22b0b1c3e193f9a62909ec6e7293ea9707c170a0441150d248a46bc1c
"3212083974"= 504b0304c239b7f8068374bfb511000000400000e269f63d73594f6202c9694280cc96a28bbd63516fe3c2d5f7a2ff87ac3a990c3ec3b2ed7b07716237a0dfb1dfb651f67e31cb2e7649f98d5e55e9b25b1a579794989b176c357bdcc11226bd6ecb7de8a63ea2165f6b31ead6b0a2a96a6e9d04b9b39f194ef52d48b088d4b6597f685a70ff6912914f86d8235681747da26cfd83223d3d248872c51095484634ebf976e4595f734bd35caf42b38dcf9e878af0be0a5e84b22940f721e8bbcdcbaa3e53607359252db16c0d6c38a142261bb4896d12a48c006cc3c21fdf717c155b2af0375d2545ee286c2aecb2955206ef25c82dc686f7eb83bb3072e94e1e59254b11a2e3628e1d98e177375b54e682a1c77f986e1907ffcb784accacb124189751d7ebbafc91d3a127f134a85e27f8c201d9082f621f5fffac09d2aab94a62f90bd74d6c96a8db6d42e4e98316449d202a4e24857673e2a50b7dfd9d5af72a21a19a922acc9675ba933a1c6ad4e0a11470fbb82eed7a79c5ca2dbb0bec5b2b43baa37373d3ef494726d7cf4a4aa8a3d6a5c206ced49148c0100bfa96b707be91b855151d8da8e0723dd1303325011b3951c9df7b10e9b153bced98376c4d7517f2e0e23a986914b2b0f978454441c47b5797d924ce9cd186d74d308099ee52f226e92de6b50e4a0691f75cfa9ce733494b8cafaeb4be4c