PC-HELP.CZ

Zdravím,
prosil bych po čtvrt roce o preventivní kontrolu logu. Se systémem nejsou problémy, snažím se ho udržovat aktualizovaný a zabezpečený. Jen pro jistotu po čtvrt roce bych po prosil o kontrolu logu, zda-li se někde nějaká veteš neválí.

Předem mockrát děkuji !

________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:40:17, on 22.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\V0470Mon.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Razer\Abyssus\razerhid.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Encore\Hoyle Casino Games 2011\Ereg\encore_reg.exe
C:\Program Files\FlashGet Network\FlashGet 3\Flashget3.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files\Razer\Abyssus\razertra.exe
C:\Program Files\Razer\Abyssus\razerofa.exe
C:\Program Files\AIMP2\AIMP2.exe
C:\Program Files\QIP 2010\qip.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\daRWin\Desktop\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\daRWin\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Lišta Centrum.cz Toolbar - {D5D47440-0750-463D-BAEF-A47D02414806} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [V0470Mon.exe] C:\Windows\V0470Mon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Abyssus] C:\Program Files\Razer\Abyssus\razerhid.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [HKLM] C:\Program Files\Windows Update\Winserv.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [20090604] C:\Program Files\Encore\Hoyle Casino Games 2011\Ereg\encore_reg.exe /r "C:\Program Files\Encore\Hoyle Casino Games 2011\Ereg\encore_reg.rpd"
O4 - HKCU\..\Run: [FlashGet 3] "C:\Program Files\FlashGet Network\FlashGet 3\flashget3.exe" -minimize
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Program Files\Windows Update\Winserv.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Program Files\Windows Update\Winserv.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download all by FlashGet3 - C:\Users\daRWin\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Users\daRWin\AppData\Roaming\FlashGetBHO\GetUrl.htm
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O18 - Protocol: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe

--
End of file - 8030 bytes

Odinstaluj:
Deamon Tools Toolbar
GenericAskToolbar

v logu fixni:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

Log z HijackThis už nepotřebuješ ?

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = nešli fixnout, tak jsem je dal ignorovat.

Dr. Web CureIt je čistý.

A zde log z Malwarebytes' Anti-Malware:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4672

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

22.9.2010 19:12:12
mbam-log-2010-09-22 (19-12-12).txt

Typ skenu: Rychlý sken
Skenované objekty: 142303
Uplynulý čas: 3 minuta(y), 47 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{d0i43j28-hu04-mm43-5c8i-7xhgd0w7yu18} (Generic.Bot.H) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujisti se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit nový log z MbAM.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Dodávám z ComboFixu, druhý dodám ráno. Musím odjet předem děkuji !

ComboFix 10-09-22.01 - daRWin 22.09.2010 20:23:52.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3071.2235 [GMT 2:00]
Spuštěný z: c:\users\daRWin\Desktop\Staženo\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet 3\adns.dll
c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.exe
c:\program files\FlashGet Network\FlashGet 3\cd1.ico
c:\program files\FlashGet Network\FlashGet 3\ckcore.dll
c:\program files\FlashGet Network\FlashGet 3\commonlib.dll
c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll
c:\program files\FlashGet Network\FlashGet 3\config\clients.met
c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak
c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat
c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met
c:\program files\FlashGet Network\FlashGet 3\config\known.met
c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met
c:\program files\FlashGet Network\FlashGet 3\config\preferences.dat
c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini
c:\program files\FlashGet Network\FlashGet 3\config\server.met
c:\program files\FlashGet Network\FlashGet 3\config\server_met.old
c:\program files\FlashGet Network\FlashGet 3\config\upload.met
c:\program files\FlashGet Network\FlashGet 3\corestat.dll
c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll
c:\program files\FlashGet Network\FlashGet 3\fg.ico
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml
c:\program files\FlashGet Network\FlashGet 3\FGSoftware.exe
c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi
c:\program files\FlashGet Network\FlashGet 3\FlashGetBHO3.dll
c:\program files\FlashGet Network\FlashGet 3\FlashGetHook.dll
c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll
c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll
c:\program files\FlashGet Network\FlashGet 3\fnsLanguage.dll
c:\program files\FlashGet Network\FlashGet 3\fnslanguage_en.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll
c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll
c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll
c:\program files\FlashGet Network\FlashGet 3\game.ico
c:\program files\FlashGet Network\FlashGet 3\gb2312-unicode.dic
c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll
c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe
c:\program files\FlashGet Network\FlashGet 3\libem.dll
c:\program files\FlashGet Network\FlashGet 3\license.txt
c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin
c:\program files\FlashGet Network\FlashGet 3\P2PCore.dll
c:\program files\FlashGet Network\FlashGet 3\P2SCore.dll
c:\program files\FlashGet Network\FlashGet 3\perf.ini
c:\program files\FlashGet Network\FlashGet 3\pncrt.dll
c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll
c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\bmsgbox_clock.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\bmsgbox_disk.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\Gray\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\storage.dll
c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe
c:\program files\FlashGet Network\FlashGet 3\uninst.exe
c:\program files\FlashGet Network\FlashGet 3\VodCore.dll
c:\program files\FlashGet Network\FlashGet 3\zlib.dll
c:\users\daRWin\AppData\Roaming\BITS
c:\users\daRWin\AppData\Roaming\BITS\BITS.ini
c:\users\daRWin\AppData\Roaming\BITS\DHTTable.dat
c:\users\daRWin\AppData\Roaming\BITS\P2PCfg.ini
c:\users\daRWin\AppData\Roaming\BITS\ProxyList.ini
c:\users\daRWin\AppData\Roaming\BITS\pstat.dat
c:\users\daRWin\AppData\Roaming\BITS\pup.dat
c:\users\daRWin\AppData\Roaming\FlashGetBHO
c:\users\daRWin\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
c:\users\daRWin\AppData\Roaming\FlashGetBHO\FlashGetHook.dll
c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetUrl.htm
c:\windows\system32\secushr.dat
c:\windows\system32\secustat.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-22 do 2010-09-22 )))))))))))))))))))))))))))))))
.

2010-09-22 17:07 . 2010-09-22 17:07 -------- d-----w- c:\users\daRWin\AppData\Roaming\Malwarebytes
2010-09-22 17:07 . 2010-09-22 17:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-22 17:07 . 2010-09-22 17:07 -------- d-----w- c:\programdata\Malwarebytes
2010-09-22 16:48 . 2010-09-22 16:48 -------- d-----w- c:\users\daRWin\DoctorWeb
2010-09-22 14:51 . 2010-09-22 17:58 -------- d-----w- c:\users\daRWin\AppData\Roaming\vlc
2010-09-22 14:19 . 2010-09-22 14:19 -------- d-----w- c:\users\daRWin\AppData\Local\Google
2010-09-22 14:17 . 2010-09-22 14:17 -------- d-----w- c:\program files\VideoLAN
2010-09-22 13:38 . 2010-09-22 13:38 -------- d-----w- c:\program files\MP3 Knife
2010-09-22 11:54 . 2010-09-22 11:54 -------- d-----w- c:\program files\Capcom
2010-09-22 07:21 . 2010-09-22 07:21 -------- d-----w- c:\users\daRWin\AppData\Roaming\Alawar
2010-09-22 07:21 . 2010-09-22 07:21 -------- d-----w- c:\programdata\AlawarWrapper
2010-09-22 07:20 . 2010-09-22 07:20 -------- d-----w- c:\program files\Alawar
2010-09-21 13:03 . 2010-09-21 13:03 -------- d-----w- c:\program files\Bethesda Softworks
2010-09-21 13:02 . 2010-09-21 13:10 -------- d-----w- c:\users\daRWin\AppData\Local\Oblivion
2010-09-21 12:57 . 2010-09-21 12:57 -------- d-----w- c:\program files\PowerISO
2010-09-21 12:34 . 2010-09-21 12:34 -------- d-----w- c:\program files\bitComposer Games
2010-09-19 18:24 . 2010-09-19 18:24 -------- d-----w- c:\users\daRWin\AppData\Roaming\Creative
2010-09-19 16:17 . 2010-09-19 16:17 -------- d-----w- c:\users\daRWin\AppData\Roaming\Hoyle FaceCreator
2010-09-19 16:17 . 2010-09-22 09:01 -------- d-----w- c:\users\daRWin\AppData\Roaming\Hoyle
2010-09-19 16:13 . 2010-09-19 16:13 -------- d-----w- c:\program files\Encore
2010-09-19 11:36 . 2010-09-22 18:11 -------- d-----w- c:\users\daRWin\AppData\Local\ElevatedDiagnostics
2010-09-18 20:56 . 2010-09-18 20:56 -------- d-----w- c:\program files\7-Zip
2010-09-18 12:12 . 2010-09-18 12:12 -------- d-----w- c:\programdata\ATI
2010-09-16 03:53 . 2010-09-16 03:53 -------- d-----w- c:\program files\EA Games
2010-09-16 03:50 . 2010-09-16 03:50 -------- d-----w- c:\windows\E4D153288C89484BB9AAF5BE9EA6D01C.TMP
2010-09-15 16:48 . 2010-09-15 16:48 -------- d-----w- c:\users\daRWin\AppData\Roaming\Avira
2010-09-15 16:40 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-09-15 16:40 . 2010-02-16 12:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-15 16:40 . 2009-05-11 10:49 51992 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-09-15 16:40 . 2009-05-11 10:49 17016 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-09-15 16:40 . 2010-09-15 16:40 -------- d-----w- c:\programdata\Avira
2010-09-15 16:40 . 2010-09-15 16:40 -------- d-----w- c:\program files\Avira
2010-09-15 04:52 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-14 03:45 . 2010-09-14 03:50 36165 ----a-w- c:\windows\DIIUnin.dat
2010-09-14 03:45 . 2010-09-14 03:45 94208 ----a-w- c:\windows\DIIUnin.exe
2010-09-14 03:45 . 2010-09-14 03:45 2829 ----a-w- c:\windows\DIIUnin.pif
2010-09-14 03:44 . 2010-09-18 22:42 -------- d-----w- c:\program files\Diablo II
2010-09-12 12:04 . 2010-09-14 03:45 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-09-12 12:04 . 2010-09-14 03:45 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-09-12 12:04 . 2010-09-14 03:45 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-09-11 22:59 . 2010-09-11 22:59 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-09-11 22:59 . 2010-09-11 22:59 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-09-11 22:59 . 2010-09-11 22:59 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2010-09-11 21:18 . 2010-09-11 21:18 8107 ----a-w- c:\windows\w7dsd.reg
2010-09-11 21:18 . 2010-09-11 21:18 8089 ----a-w- c:\windows\w7dse.reg
2010-09-11 21:18 . 2010-09-11 21:18 233888 ----a-w- c:\windows\system32\DreamScene.dll
2010-09-10 16:53 . 2010-09-10 16:53 -------- d-----w- c:\users\Doma\AppData\Roaming\ICQ
2010-09-10 16:53 . 2010-09-10 16:53 -------- d-----w- c:\users\Doma
2010-09-09 14:49 . 2010-09-09 14:49 -------- d-----w- c:\windows\system32\xlive
2010-09-09 14:49 . 2010-09-09 14:49 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-09-09 14:49 . 2008-07-12 06:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-09-09 14:49 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-09-09 14:49 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-09-09 14:41 . 2010-09-09 14:41 -------- d-----w- c:\program files\Volition Inc
2010-09-09 13:09 . 2010-09-09 13:09 -------- d-----w- c:\users\daRWin\AppData\Local\My Games
2010-09-09 12:57 . 2010-09-09 12:57 36864 ----a-w- c:\users\daRWin\AppData\Roaming\Autodesk\AutoCAD 2011\R18.1\csy\ContextualTabSelectorRules.dll
2010-09-09 12:54 . 2010-09-21 12:46 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-09-09 12:54 . 2010-09-09 12:54 -------- d-----w- c:\programdata\FLEXnet
2010-09-09 12:51 . 2010-09-09 12:51 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-09-09 12:51 . 2010-09-09 12:51 22328 ----a-w- c:\users\daRWin\AppData\Roaming\PnkBstrK.sys
2010-09-09 12:51 . 2010-09-09 12:51 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-09-09 12:50 . 2010-09-09 12:50 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-09-09 12:50 . 2010-09-09 12:50 2250024 ----a-w- c:\windows\system32\pbsvc.exe
2010-09-09 12:44 . 2010-09-09 12:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-09-09 12:40 . 2010-09-09 12:40 -------- d-----w- c:\program files\Ubisoft
2010-09-08 17:23 . 2010-09-08 17:23 -------- d-----w- c:\users\daRWin\AppData\Local\AskToolbar
2010-09-08 17:23 . 2010-03-26 13:53 1286448 ----a-w- c:\programdata\CentrumczToolbar\IEToolbar.dll
2010-09-08 16:12 . 2010-09-08 16:12 -------- d-----w- c:\program files\AnswerWorks 4.0
2010-09-08 16:10 . 2010-09-09 12:57 -------- d-----w- c:\users\daRWin\AppData\Roaming\Autodesk
2010-09-08 16:10 . 2010-09-09 12:41 -------- d-----w- c:\users\daRWin\AppData\Local\Autodesk
2010-09-08 16:05 . 2010-09-09 12:57 -------- d-----w- c:\programdata\Autodesk
2010-09-08 16:04 . 2010-09-09 12:52 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-09-08 16:04 . 2010-09-09 12:41 -------- d-----w- c:\program files\Autodesk
2010-09-08 16:04 . 2010-09-08 16:04 10134 ----a-r- c:\users\daRWin\AppData\Roaming\Microsoft\Installer\{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}\ARPPRODUCTICON.exe
2010-09-08 16:04 . 2010-09-08 16:04 -------- d-----w- c:\program files\Microsoft WSE
2010-09-08 16:03 . 2010-09-22 14:02 -------- d-----w- c:\users\daRWin\AppData\Local\ApplicationHistory
2010-09-08 16:03 . 2010-09-08 16:03 94 ----a-w- c:\users\daRWin\AppData\Local\fusioncache.dat
2010-09-08 16:00 . 2010-09-08 16:00 -------- d-----w- c:\windows\system32\URTTEMP
2010-09-05 11:18 . 2010-09-16 12:38 -------- d-----w- c:\program files\TNod User & Password Finder
2010-09-05 11:18 . 2010-09-05 11:18 -------- d-----w- c:\users\daRWin\AppData\Local\ESET
2010-09-04 20:38 . 2009-11-25 20:03 61952 ----a-w- c:\users\daRWin\AppData\Roaming\Mozilla\Firefox\Profiles\b36nrsc7.default\extensions\allglassv2@ambroos.neowin.net\components\dwmxpcom.dll
2010-09-02 20:04 . 2010-09-02 20:04 -------- d-----w- c:\program files\Team17
2010-09-02 13:56 . 2010-09-02 13:56 -------- d-----w- c:\users\daRWin\AppData\Roaming\IObit
2010-09-02 13:56 . 2010-09-02 13:56 -------- d-----w- c:\program files\IObit
2010-09-02 09:08 . 2010-09-02 09:08 -------- d-----w- c:\users\daRWin\AppData\Local\Microsoft Games
2010-09-01 15:34 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-09-01 15:30 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-09-01 15:28 . 2010-09-01 15:28 -------- d-----w- c:\program files\Microsoft.NET
2010-09-01 15:27 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-09-01 15:27 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-09-01 15:27 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-09-01 15:27 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-09-01 15:27 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-09-01 15:27 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-09-01 15:27 . 2010-09-01 15:27 -------- d-----w- c:\program files\MSXML 4.0
2010-09-01 15:25 . 2009-08-29 06:57 34816 ----a-w- c:\windows\system32\msasn1.dll
2010-09-01 15:23 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll
2010-09-01 15:23 . 2010-02-27 07:32 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-09-01 15:23 . 2010-02-27 07:32 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-09-01 15:23 . 2010-02-27 07:32 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-09-01 15:23 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-09-01 15:23 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-01 15:23 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 15:23 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-09-01 15:23 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-09-01 09:19 . 2010-09-01 09:19 -------- d-----w- c:\users\daRWin\AppData\Roaming\TuneUp Software
2010-09-01 09:19 . 2010-09-01 15:29 -------- d-----w- c:\programdata\TuneUp Software
2010-09-01 09:19 . 2010-09-01 09:19 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-08-31 09:53 . 2010-08-31 09:53 -------- d-----w- c:\users\daRWin\AppData\Roaming\Nero
2010-08-30 09:59 . 2010-08-30 09:59 -------- d-----w- c:\programdata\Futuremark
2010-08-30 09:57 . 2010-08-30 09:57 -------- d-----w- c:\program files\Common Files\Futuremark Shared
2010-08-30 09:57 . 2010-08-30 09:57 -------- d-----w- c:\program files\Futuremark
2010-08-30 09:57 . 2010-08-30 09:57 -------- d-----w- c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2010-08-29 21:51 . 2010-08-29 21:51 -------- d-----w- c:\programdata\Codemasters
2010-08-29 21:48 . 2010-08-29 21:48 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2010-08-29 21:48 . 2010-08-29 21:48 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-08-29 21:48 . 2010-08-29 21:48 -------- d-----w- c:\program files\OpenAL
2010-08-29 21:29 . 2010-08-29 21:29 -------- d-----w- c:\program files\Codemasters
2010-08-29 16:11 . 2010-08-29 16:19 -------- d-----w- c:\program files\Valve
2010-08-29 14:36 . 2010-08-29 14:36 -------- d-----w- c:\users\daRWin\AppData\Local\2K Games
2010-08-29 14:35 . 2010-08-29 14:35 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-29 14:26 . 2010-03-24 08:42 57418 ----a-w- c:\users\daRWin\AppData\Roaming\Mozilla\Firefox\Profiles\b36nrsc7.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashGetXPI.dll
2010-08-29 14:25 . 2010-08-29 14:25 -------- d-----w- c:\program files\2K Games
2010-08-29 14:02 . 2010-08-29 14:02 -------- d-----w- c:\users\daRWin\AppData\Roaming\Zoner
2010-08-29 14:02 . 2010-08-29 14:02 -------- d-----w- c:\users\daRWin\AppData\Local\Zoner

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-22 18:12 . 2010-08-29 10:26 -------- d-----w- c:\users\daRWin\AppData\Roaming\Skype
2010-09-22 18:04 . 2009-07-14 08:44 674400 ----a-w- c:\windows\system32\perfh005.dat
2010-09-22 18:04 . 2009-07-14 08:44 144354 ----a-w- c:\windows\system32\perfc005.dat
2010-09-22 18:01 . 2005-04-08 02:16 228 ---ha-w- c:\users\daRWin\AppData\Roaming\daRWinlog.dat
2010-09-21 13:03 . 2010-08-29 10:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-16 03:50 . 2010-08-29 14:34 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-09-01 15:42 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-08-29 10:21 . 2010-08-29 10:21 -------- d--h--w- c:\program files\Temp
2010-08-29 10:21 . 2010-08-29 10:21 -------- d-----w- c:\program files\Realtek
2010-08-29 10:09 . 2010-08-29 10:04 -------- d-----w- c:\program files\Creative
2010-08-29 10:08 . 2010-08-29 10:04 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-29 10:07 . 2010-08-29 10:07 -------- d-----w- c:\program files\Common Files\muvee Technologies
2010-08-29 10:07 . 2010-08-29 10:07 -------- d-----w- c:\program files\muvee Technologies
2010-08-29 10:06 . 2010-08-29 10:06 -------- d-----w- c:\programdata\muvee Technologies
2010-08-29 10:06 . 2010-08-29 10:06 -------- d-----w- c:\users\daRWin\AppData\Roaming\InstallShield
2010-08-29 10:06 . 2010-08-29 10:06 -------- d-----w- c:\program files\SightSpeed
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Šablony
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Nabídka Start
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Data aplikací
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Plocha
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Oblíbené položky
2010-08-29 09:28 . 2010-08-29 09:28 -------- d-sh--we c:\programdata\Dokumenty
2010-08-29 08:45 . 2010-08-29 08:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-08-26 02:01 . 2010-08-04 01:54 528384 ----a-w- c:\windows\system32\aticfx32.dll
2010-08-26 01:52 . 2010-08-04 01:46 3914240 ----a-w- c:\windows\system32\atidxx32.dll
2010-08-26 01:33 . 2010-08-04 01:28 4032512 ----a-w- c:\windows\system32\atiumdag.dll
2010-08-26 01:27 . 2010-08-04 01:23 65536 ----a-w- c:\windows\system32\coinst.dll
2010-08-26 01:25 . 2010-08-04 01:21 3392000 ----a-w- c:\windows\system32\atiumdva.dll
2010-08-26 01:21 . 2010-08-04 01:16 241664 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-26 01:20 . 2010-08-04 01:15 30208 ----a-w- c:\windows\system32\atiuxpag.dll
2010-08-26 01:19 . 2010-08-04 01:14 28160 ----a-w- c:\windows\system32\atiu9pag.dll
2010-07-29 06:30 . 2010-09-01 15:26 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-09-01 15:26 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-15 12:47 . 2010-07-15 12:47 101904 ----a-w- c:\windows\system32\drivers\AtihdW73.sys
2010-06-30 06:25 . 2010-09-01 15:26 978432 ----a-w- c:\windows\system32\wininet.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-06-10 15:28 1233288 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-08-29 328568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"V0470Mon.exe"="c:\windows\V0470Mon.exe" [2007-04-11 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-29 7625248]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"Abyssus"="c:\program files\Razer\Abyssus\razerhid.exe" [2010-05-10 223744]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]

c:\users\daRWin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Akceler tor spuçtŘnˇ AutoCADu.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)

R3 cpuz130;cpuz130;c:\users\daRWin\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-10-01 27248]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-08-29 691696]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\daRWin\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0.sys [2010-09-11 14416]
S3 Abyssus03;Razer Abyssus USB Filter Driver;c:\windows\system32\Drivers\Abyssus.sys [2009-10-30 9216]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-26 6380032]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-26 221696]
S3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet - adaptér;c:\windows\system32\DRIVERS\l260x86.sys [2009-07-13 29184]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-07-15 101904]
S3 VF0470Vid;Live! Cam Notebook (VF0470);c:\windows\system32\DRIVERS\V0470Vid.sys [2007-04-20 146368]
S3 vHidDev;Razer Gaming Device;c:\windows\system32\DRIVERS\vHidDev.sys [2009-12-21 5760]

.
.
------- Doplňkový sken -------
.
IE: Download all by FlashGet3 - c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?? - c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\daRWin\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
Handler: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - c:\program files\CentrumczToolbar\IEToolbar.dll
FF - ProfilePath - c:\users\daRWin\AppData\Roaming\Mozilla\Firefox\Profiles\b36nrsc7.default\
FF - prefs.js: browser.search.selectedEngine - Centrum.cz Search
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\users\daRWin\AppData\Roaming\Mozilla\Firefox\Profiles\b36nrsc7.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashGetXPI.dll
FF - component: c:\users\daRWin\AppData\Roaming\Mozilla\Firefox\Profiles\b36nrsc7.default\extensions\allglassv2@ambroos.neowin.net\components\dwmxpcom.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\daRWin\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-FlashGet 3 - c:\program files\FlashGet Network\FlashGet 3\flashget3.exe
MSConfigStartUp-TNOD UP - c:\program files\TNod User & Password Finder\TNODUP.exe
ActiveSetup-{D0I43J28-HU04-MM43-5C8I-7XHGD0W7YU18} - c:\program files\Windows Update\Winserv.exe
AddRemove-FlashGet 3.5 - c:\program files\FlashGet Network\FlashGet 3\uninst.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2537884483-3615491979-847161424-1001\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@="c:\\Users\\daRWin\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022

[HKEY_USERS\S-1-5-21-2537884483-3615491979-847161424-1001\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@="c:\\Users\\daRWin\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-09-22 20:29:52
ComboFix-quarantined-files.txt 2010-09-22 18:29

Před spuštěním: Volných bajtů: 93 762 252 800
Po spuštění: Volných bajtů: 93 736 595 456

- - End Of File - - 1B16183463254773274CB9850054A930

Odinstaluj:
TNod User & Password Finder --to už tady nechci vidět...
ESET (pokud ještě máš)

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\w7dsd.reg
c:\windows\w7dse.reg

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.