PC-HELP.CZ

Zdravím všechny odborníky,

kamarád mi dal PC, Win Vista Home, SP2, ale má strašně pomalý start..chtěla jsem vás požádat o kontrolu logu z HJT:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:39:57, on 23.6.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10o_ActiveX.exe -update activex
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - ?p=ZRxdm185YYCZ
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: HP Chytrý výběr - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 10341 bytes

Odinstaluj:
uTorrentBar Toolbar
Conduit Engine
Spybot-S&D

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod



Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

vše provedeno, dle návodu..tady je log:


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Verze databáze: 6930

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

23.6.2011 21:33:12
mbam-log-2011-06-23 (21-33-05).txt

Typ: Rychlá kontrola
Kontrolované objekty: 150769
Uplynulý čas: 2 minut, 56 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 17
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CLASSES_ROOT\Typelib\{AC5AB953-ED25-4F9C-87F0-B086B0178FFA} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160F76A-1992-4B17-A32D-0C706D159105} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FB52AB3-5987-45a2-85E0-F3EC30DDDC29}}_is1 (Adware.DoubleD) -> No action taken.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Users\iva vlčková\local settings\temporary internet files\pse_350_csy.exe (Trojan.Agent) -> No action taken.

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujisti se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit nový log z MbAM.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

tady je log hned po odstranění těch zaškrtnutých nálezů:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Verze databáze: 6930

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

24.6.2011 17:40:26
mbam-log-2011-06-24 (17-40-26).txt

Typ: Rychlá kontrola
Kontrolované objekty: 150598
Uplynulý čas: 2 minut, 39 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 17
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CLASSES_ROOT\Typelib\{AC5AB953-ED25-4F9C-87F0-B086B0178FFA} (Adware.DoubleD) ->

Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6160F76A-1992-4B17-A32D-0C706D159105} (Adware.DoubleD) ->

Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-

4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-

4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-

B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-

8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-

BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-

A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-

E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-

94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-

B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-

9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-

B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-

D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low

Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted

successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss

(Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FB52AB3-5987-45a2

-85E0-F3EC30DDDC29}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\Users\iva vlčková\local settings\temporary internet files\pse_350_csy.exe (Trojan.Agent)

-> Quarantined and deleted successfully.

A tady je pak nový log z MbAM:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Verze databáze: 6930

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

24.6.2011 17:46:48
mbam-log-2011-06-24 (17-46-48).txt

Typ: Rychlá kontrola
Kontrolované objekty: 150778
Uplynulý čas: 3 minut, 43 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Ještě Combofix.

jojo, pracuje se na tom..prave jeste bezi..

Tak ted to dobehlo..tady je log:

ComboFix 11-06-24.02 - Iva Vlčková 24.06.2011 17:52:49.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3071.1820 [GMT 2:00]
Spuštěný z: c:\users\Iva VlŔkovß\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\windows\system32\drivers\sfryrod.sys
c:\windows\system32\zip32.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ovfbbj
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-24 do 2011-06-24 )))))))))))))))))))))))))))))))
.
.
2011-06-24 15:58 . 2011-06-24 15:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-24 15:50 . 2011-06-24 15:50 -------- d-----w- C:\32788R22FWJFW
2011-06-24 15:45 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{610DEF5B-D8C9-48FC-B3B1-CF23F98B9C95}\mpengine.dll
2011-06-24 01:36 . 2011-06-24 01:37 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{AB6CA967-BCEA-4C7E-8DA6-F27FFDDEACAB}
2011-06-24 01:36 . 2011-06-24 01:36 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\ATI
2011-06-24 01:18 . 2011-06-24 01:18 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\Apple
2011-06-24 01:11 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-24 01:11 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-24 01:11 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-23 19:29 . 2011-06-23 19:29 -------- d-----w- c:\users\Iva Vlčková\AppData\Roaming\Malwarebytes
2011-06-23 19:28 . 2011-06-23 19:28 -------- d-----w- c:\programdata\Malwarebytes
2011-06-23 19:28 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-23 19:28 . 2011-06-23 19:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-23 19:28 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-23 17:31 . 2011-06-23 17:31 -------- d-----w- c:\program files\Trend Micro
2011-06-23 16:16 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-23 16:15 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-23 16:15 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-23 16:15 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-23 16:15 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-23 16:15 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-23 16:15 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-23 16:15 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-23 16:15 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-23 16:15 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-23 16:06 . 2011-06-23 16:06 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{DE9C5770-5381-4158-9D11-9510BF616E4F}
2011-06-18 14:49 . 2011-06-18 14:49 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{439F7F00-F6CE-4367-8544-30D5E03E42B3}
2011-06-16 18:56 . 2011-06-16 18:56 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{6D5E7491-A80B-470D-8C94-6C3752500949}
2011-06-16 18:12 . 2011-06-16 18:12 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{9FE18DD0-2C52-4DF8-8001-3953AABDDD03}
2011-06-15 12:28 . 2011-06-15 12:28 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{CE541358-25C5-446C-A3E4-8B338B3AA1F3}
2011-06-15 11:49 . 2011-06-15 11:49 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{7B4982E5-E4B9-4C1A-A69F-CCE2B9D4F2D2}
2011-06-14 19:15 . 2011-06-14 19:15 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{C46524DD-F117-4210-8808-E06C248145E2}
2011-06-13 19:00 . 2011-06-13 19:00 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{A985F716-35B7-4310-91F7-B4AFD07BB6A8}
2011-06-13 18:13 . 2011-06-13 18:13 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{43A66913-B577-4C82-AFAD-6782AEC2C8C8}
2011-06-13 05:17 . 2011-06-13 05:17 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{613B6C6F-F41B-4991-8A4B-7109E58C3E8D}
2011-06-12 04:36 . 2011-06-12 04:36 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{6A0213C4-B47B-4440-849A-81334E3B7439}
2011-06-11 17:46 . 2011-06-11 17:46 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{EE153277-A714-44A7-A633-529E98EB53E2}
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-11 04:46 . 2011-06-11 04:47 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{64C388CC-16D1-4FCD-B5D6-DBB9D170BE7C}
2011-06-10 14:59 . 2011-06-10 14:59 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{57274DD0-E256-45EC-92AB-08AE4D8F18BA}
2011-06-10 02:45 . 2011-06-10 02:45 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{CE2FDEA2-6931-47FC-BEA7-91F909566F0E}
2011-06-08 17:59 . 2011-06-08 17:59 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{2539A146-C4BE-4F52-AAF1-5F0CE09C9A44}
2011-06-07 19:19 . 2011-06-07 19:19 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{A16D5CD4-308A-456A-B2F0-F09D3787F05F}
2011-06-07 17:44 . 2011-06-07 17:45 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{698A9A68-5D04-4273-A97D-8013DD343948}
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-07 05:24 . 2011-06-07 05:24 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{044D1323-2268-4803-B41C-2F2B7F5554D5}
2011-06-06 18:18 . 2011-06-06 18:18 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{8F2BB2AD-838A-4BBE-803A-AF5935F2E1BC}
2011-06-06 17:38 . 2011-06-06 17:38 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{6E0C9091-53C7-40DB-A249-F8B34EFF9D98}
2011-06-06 16:53 . 2011-06-06 16:53 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{5858F6F2-1019-4C60-AE4A-8D3B8C3E76EE}
2011-06-05 19:51 . 2011-06-05 19:52 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{94489EA6-1421-457E-A522-D6EB427AE633}
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-06-05 05:41 . 2011-06-05 05:43 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{F0F94D5F-733F-465A-9734-4F6F99845B16}
2011-06-04 17:12 . 2011-06-04 17:12 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{1697ED9C-3C59-4C70-BA53-5CA8E1F03FFC}
2011-06-04 11:10 . 2011-06-04 11:10 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{F2C70E5B-F410-4FE3-B831-00FC2002A827}
2011-06-03 17:17 . 2011-06-03 17:17 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{B4AC8068-40EB-4403-8BDC-A9B1FF21E825}
2011-06-03 07:21 . 2011-06-03 07:21 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{231C9347-9FFE-4882-BCFA-B5CAEF2BCFFB}
2011-06-02 19:21 . 2011-06-02 19:21 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{A1CEDBA5-7998-4322-B86E-4BACC638BDC3}
2011-06-02 19:02 . 2011-06-02 19:02 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{349BCE86-6C52-4C16-8E16-0A66032AF277}
2011-06-01 17:09 . 2011-06-01 17:09 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{96C70E0A-2FAD-4AFB-84CD-3CB5A3C142B6}
2011-06-01 16:29 . 2011-06-01 16:30 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{9B3AB69D-3A76-4F87-834F-E9492F985F10}
2011-06-01 00:58 . 2011-06-01 00:58 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{01CEC32E-D56C-4C7C-A833-2AB05B3ECF31}
2011-05-31 20:07 . 2011-06-07 18:22 -------- d-----w- C:\Microsoft Bluetooth Enumerator
2011-05-31 20:01 . 2011-05-31 20:01 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{B9901630-CE6F-4890-AB21-E15D9A387237}
2011-05-31 19:18 . 2011-05-31 19:18 -------- d-----w- C:\Zvukové zařízení High Definition Audio
2011-05-31 19:12 . 2004-03-09 14:45 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2011-05-31 19:12 . 2011-05-31 19:12 -------- d-----w- c:\program files\Driver-Soft
2011-05-31 18:27 . 2011-05-31 18:27 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{029FC068-0CBC-4B13-87E8-0E0FF0989C96}
2011-05-30 19:04 . 2011-05-30 19:04 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{B585C55A-8FB7-4741-AB1B-40E967881CAD}
2011-05-30 15:46 . 2011-05-30 15:46 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{8FCA27B8-D5DF-4295-8FAC-74AFB4041377}
2011-05-30 03:43 . 2011-05-30 03:44 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{F7D01206-F44F-4660-B007-77276AC2BFC1}
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-29 10:19 . 2011-05-29 10:19 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{E44FCF63-A190-4E91-AA20-F5AE7FB276F8}
2011-05-28 18:56 . 2011-05-28 18:56 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{D96F61C2-6008-4EBE-9461-6F7A2FB328EB}
2011-05-28 17:21 . 2011-05-28 17:21 -------- d-----w- C:\$WINDOWS.~BT
2011-05-28 17:10 . 2011-05-28 17:10 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{5F75D083-3894-4AEF-8C03-82B32DBD8C0C}
2011-05-27 20:02 . 2011-05-27 20:03 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{87ED70B3-18CA-4C1A-8D83-2C08A2C89F5F}
2011-05-27 19:55 . 2011-05-27 19:55 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{25D83319-91A1-4220-A2C8-F09110EEFF27}
2011-05-27 09:22 . 2011-05-27 09:22 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{CC338C12-8FD6-477A-A293-89A971C1F331}
2011-05-26 19:20 . 2011-05-26 19:20 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{4C6E8EC0-BBBF-40E1-A098-C82DFFC77183}
2011-05-26 17:43 . 2011-05-26 17:43 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{1F51E40B-C986-4C93-8C7A-095F87FDD0F3}
2011-05-26 07:55 . 2011-05-26 07:55 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{603A7CB0-9B89-4F9D-B91D-48C1F0CC8941}
2011-05-26 05:25 . 2011-05-26 05:25 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{C643452C-ABD1-4BB2-8185-DAB93978EC1B}
2011-05-26 03:31 . 2011-05-26 03:31 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{691AD0A7-FD24-43D6-A93E-AF7FD668E3DC}
2011-05-25 17:23 . 2011-05-25 17:23 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\{D9C9E96A-8774-4A1E-B99C-B0F6F28C5BB7}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-24 17:14 . 2009-10-02 18:48 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-14 18:21 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-10 12:10 . 2011-04-11 20:01 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2008-12-23 18:40 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-04-11 20:02 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2008-12-23 18:41 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2008-12-23 18:41 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 11:59 . 2008-12-23 18:41 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2008-12-23 18:40 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 11:59 . 2008-12-23 18:41 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-24 05:50 . 2011-04-24 05:50 161792 ----a-w- c:\windows\system32\msls31.dll
2011-04-24 05:50 . 2011-04-24 05:50 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-04-24 05:50 . 2011-04-24 05:50 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-04-24 05:50 . 2011-04-24 05:50 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-04-24 05:50 . 2011-04-24 05:50 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-04-24 05:50 . 2011-04-24 05:50 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-04-24 05:50 . 2011-04-24 05:50 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-04-24 05:50 . 2011-04-24 05:50 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-04-24 05:50 . 2011-04-24 05:50 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-24 05:50 . 2011-04-24 05:50 367104 ----a-w- c:\windows\system32\html.iec
2011-04-24 05:50 . 2011-04-24 05:50 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-24 05:50 . 2011-04-24 05:50 152064 ----a-w- c:\windows\system32\wextract.exe
2011-04-24 05:50 . 2011-04-24 05:50 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-04-24 05:50 . 2011-04-24 05:50 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-24 05:50 . 2011-04-24 05:50 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-04-24 05:50 . 2011-04-24 05:50 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-04-24 05:50 . 2011-04-24 05:50 11776 ----a-w- c:\windows\system32\mshta.exe
2011-04-24 05:50 . 2011-04-24 05:50 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-04-24 05:50 . 2011-04-24 05:50 101888 ----a-w- c:\windows\system32\admparse.dll
2010-08-23 23:39 . 2010-08-23 23:39 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Center Agent"="c:\program files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe" [2007-07-13 1435648]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-23 30192]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-23 30192]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 PAC207;Webcam 1200;c:\windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 20:02]
.
2011-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 20:02]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: DhcpNameServer = 213.46.172.36 192.168.0.1
FF - ProfilePath - c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Conduit Engine Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/index.php?tool ... m-1.0.0&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
HKLM-Run-hpqSRMon - (no file)
HKLM-Run-pdfSaver3 - (no file)
HKLM-Run-SMail - c:\program files\Seznam\Postak\Postak.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-24 18:03
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
c:\windows\TEMP\_avast_\unp174351612.tmp
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3184)
c:\progra~1\ArcSoft\PHOTOI~1\share\pihook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\ArcSoft\Magic-i 3\uMgiSvr.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2011-06-24 18:11:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-24 16:11
.
Před spuštěním: Volných bajtů: 293 827 653 632
Po spuštění: Volných bajtů: 298 477 166 592
.
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5,8
- - End Of File - - 8F01DF48B38AE695E40E3EE027DC7904

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.

tak tady je log z ComboFixu po čištění:

ComboFix 11-06-24.02 - Iva Vlčková 24.06.2011 19:00:12.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3071.1738 [GMT 2:00]
Spuštěný z: c:\users\Iva Vlčková\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Iva Vlčková\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp"
"c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp"
"c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\TEMP\_avast_\unp174351612.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\32788R22FWJFW
c:\users\Iva Vlčková\AppData\Local\{01CEC32E-D56C-4C7C-A833-2AB05B3ECF31}
c:\users\Iva Vlčková\AppData\Local\{029FC068-0CBC-4B13-87E8-0E0FF0989C96}
c:\users\Iva Vlčková\AppData\Local\{044D1323-2268-4803-B41C-2F2B7F5554D5}
c:\users\Iva Vlčková\AppData\Local\{1697ED9C-3C59-4C70-BA53-5CA8E1F03FFC}
c:\users\Iva Vlčková\AppData\Local\{1F51E40B-C986-4C93-8C7A-095F87FDD0F3}
c:\users\Iva Vlčková\AppData\Local\{231C9347-9FFE-4882-BCFA-B5CAEF2BCFFB}
c:\users\Iva Vlčková\AppData\Local\{2539A146-C4BE-4F52-AAF1-5F0CE09C9A44}
c:\users\Iva Vlčková\AppData\Local\{25D83319-91A1-4220-A2C8-F09110EEFF27}
c:\users\Iva Vlčková\AppData\Local\{349BCE86-6C52-4C16-8E16-0A66032AF277}
c:\users\Iva Vlčková\AppData\Local\{439F7F00-F6CE-4367-8544-30D5E03E42B3}
c:\users\Iva Vlčková\AppData\Local\{43A66913-B577-4C82-AFAD-6782AEC2C8C8}
c:\users\Iva Vlčková\AppData\Local\{4C6E8EC0-BBBF-40E1-A098-C82DFFC77183}
c:\users\Iva Vlčková\AppData\Local\{57274DD0-E256-45EC-92AB-08AE4D8F18BA}
c:\users\Iva Vlčková\AppData\Local\{5858F6F2-1019-4C60-AE4A-8D3B8C3E76EE}
c:\users\Iva Vlčková\AppData\Local\{5F75D083-3894-4AEF-8C03-82B32DBD8C0C}
c:\users\Iva Vlčková\AppData\Local\{603A7CB0-9B89-4F9D-B91D-48C1F0CC8941}
c:\users\Iva Vlčková\AppData\Local\{613B6C6F-F41B-4991-8A4B-7109E58C3E8D}
c:\users\Iva Vlčková\AppData\Local\{64C388CC-16D1-4FCD-B5D6-DBB9D170BE7C}
c:\users\Iva Vlčková\AppData\Local\{691AD0A7-FD24-43D6-A93E-AF7FD668E3DC}
c:\users\Iva Vlčková\AppData\Local\{698A9A68-5D04-4273-A97D-8013DD343948}
c:\users\Iva Vlčková\AppData\Local\{6A0213C4-B47B-4440-849A-81334E3B7439}
c:\users\Iva Vlčková\AppData\Local\{6D5E7491-A80B-470D-8C94-6C3752500949}
c:\users\Iva Vlčková\AppData\Local\{6E0C9091-53C7-40DB-A249-F8B34EFF9D98}
c:\users\Iva Vlčková\AppData\Local\{7B4982E5-E4B9-4C1A-A69F-CCE2B9D4F2D2}
c:\users\Iva Vlčková\AppData\Local\{87ED70B3-18CA-4C1A-8D83-2C08A2C89F5F}
c:\users\Iva Vlčková\AppData\Local\{8F2BB2AD-838A-4BBE-803A-AF5935F2E1BC}
c:\users\Iva Vlčková\AppData\Local\{8FCA27B8-D5DF-4295-8FAC-74AFB4041377}
c:\users\Iva Vlčková\AppData\Local\{94489EA6-1421-457E-A522-D6EB427AE633}
c:\users\Iva Vlčková\AppData\Local\{96C70E0A-2FAD-4AFB-84CD-3CB5A3C142B6}
c:\users\Iva Vlčková\AppData\Local\{9B3AB69D-3A76-4F87-834F-E9492F985F10}
c:\users\Iva Vlčková\AppData\Local\{9FE18DD0-2C52-4DF8-8001-3953AABDDD03}
c:\users\Iva Vlčková\AppData\Local\{A16D5CD4-308A-456A-B2F0-F09D3787F05F}
c:\users\Iva Vlčková\AppData\Local\{A1CEDBA5-7998-4322-B86E-4BACC638BDC3}
c:\users\Iva Vlčková\AppData\Local\{A985F716-35B7-4310-91F7-B4AFD07BB6A8}
c:\users\Iva Vlčková\AppData\Local\{AB6CA967-BCEA-4C7E-8DA6-F27FFDDEACAB}
c:\users\Iva Vlčková\AppData\Local\{B4AC8068-40EB-4403-8BDC-A9B1FF21E825}
c:\users\Iva Vlčková\AppData\Local\{B585C55A-8FB7-4741-AB1B-40E967881CAD}
c:\users\Iva Vlčková\AppData\Local\{B9901630-CE6F-4890-AB21-E15D9A387237}
c:\users\Iva Vlčková\AppData\Local\{C46524DD-F117-4210-8808-E06C248145E2}
c:\users\Iva Vlčková\AppData\Local\{C643452C-ABD1-4BB2-8185-DAB93978EC1B}
c:\users\Iva Vlčková\AppData\Local\{CC338C12-8FD6-477A-A293-89A971C1F331}
c:\users\Iva Vlčková\AppData\Local\{CE2FDEA2-6931-47FC-BEA7-91F909566F0E}
c:\users\Iva Vlčková\AppData\Local\{CE541358-25C5-446C-A3E4-8B338B3AA1F3}
c:\users\Iva Vlčková\AppData\Local\{D96F61C2-6008-4EBE-9461-6F7A2FB328EB}
c:\users\Iva Vlčková\AppData\Local\{D9C9E96A-8774-4A1E-B99C-B0F6F28C5BB7}
c:\users\Iva Vlčková\AppData\Local\{DE9C5770-5381-4158-9D11-9510BF616E4F}
c:\users\Iva Vlčková\AppData\Local\{E44FCF63-A190-4E91-AA20-F5AE7FB276F8}
c:\users\Iva Vlčková\AppData\Local\{EE153277-A714-44A7-A633-529E98EB53E2}
c:\users\Iva Vlčková\AppData\Local\{F0F94D5F-733F-465A-9734-4F6F99845B16}
c:\users\Iva Vlčková\AppData\Local\{F2C70E5B-F410-4FE3-B831-00FC2002A827}
c:\users\Iva Vlčková\AppData\Local\{F7D01206-F44F-4660-B007-77276AC2BFC1}
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\ConduitAutoCompleteSearch.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\ConduitAutoCompleteSearch.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\ConduitToolbar.idl
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\ConduitToolbar.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\ConduitToolbar.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCore.dll
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCore.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\alertSettingsComponent.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\appContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\engineContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\engineSettings.json
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\fbAlert.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\getAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\postAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\toolbarContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults\unsharedAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\chrome.manifest
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\chrome\utorrentbar.jar
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\install.rdf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\lib\xpcom.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF\manifest.mf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF\zigbert.rsa
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF\zigbert.sf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin\conduit.gif
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin\conduit.ico
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin\conduit.PNG
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin\conduit.src
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin\conduit.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\version.txt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\ConduitToolbar.idl
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\ConduitToolbar.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\ConduitToolbar.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\RadioWMPCore.dll
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\RadioWMPCore.xpt
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\alertSettingsComponent.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\appContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\engineContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\engineSettings.json
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\fbAlert.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\getAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\postAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\toolbarContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\defaults\unsharedAppsContextMenu.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\DualPackage\install.rdf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\chrome.manifest
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\chrome\conduitengine.jar
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\install.rdf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\lib\xpcom.js
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\META-INF\manifest.mf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\META-INF\zigbert.rsa
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\META-INF\zigbert.sf
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\searchplugin\conduit.gif
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\searchplugin\conduit.ico
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\searchplugin\conduit.PNG
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\searchplugin\conduit.src
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\searchplugin\conduit.xml
c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\extensions\engine@conduit.com\version.txt
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-24 do 2011-06-24 )))))))))))))))))))))))))))))))
.
.
2011-06-24 17:13 . 2011-06-24 17:17 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\temp
2011-06-24 17:13 . 2011-06-24 17:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-24 15:45 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{610DEF5B-D8C9-48FC-B3B1-CF23F98B9C95}\mpengine.dll
2011-06-24 01:36 . 2011-06-24 01:36 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\ATI
2011-06-24 01:18 . 2011-06-24 01:18 -------- d-----w- c:\users\Iva Vlčková\AppData\Local\Apple
2011-06-24 01:11 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-24 01:11 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-24 01:11 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-23 19:29 . 2011-06-23 19:29 -------- d-----w- c:\users\Iva Vlčková\AppData\Roaming\Malwarebytes
2011-06-23 19:28 . 2011-06-23 19:28 -------- d-----w- c:\programdata\Malwarebytes
2011-06-23 19:28 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-23 19:28 . 2011-06-23 19:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-23 19:28 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-23 17:31 . 2011-06-23 17:31 -------- d-----w- c:\program files\Trend Micro
2011-06-23 16:16 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-23 16:15 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-23 16:15 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-23 16:15 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-23 16:15 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-23 16:15 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-23 16:15 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-23 16:15 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-23 16:15 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-23 16:15 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-05-31 20:07 . 2011-06-07 18:22 -------- d-----w- C:\Microsoft Bluetooth Enumerator
2011-05-31 19:18 . 2011-05-31 19:18 -------- d-----w- C:\Zvukové zařízení High Definition Audio
2011-05-31 19:12 . 2004-03-09 14:45 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2011-05-31 19:12 . 2011-05-31 19:12 -------- d-----w- c:\program files\Driver-Soft
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-28 17:21 . 2011-05-28 17:21 -------- d-----w- C:\$WINDOWS.~BT
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-23 17:31 . 2011-06-23 17:31 388096 ----a-r- c:\users\Iva Vlčková\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-11 15:19 . 2011-06-11 15:19 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BITE11A.tmp
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-06-05 06:17 . 2011-06-05 06:17 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT5F55.tmp
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-29 19:02 . 2011-05-29 19:02 0 ---ha-w- c:\users\Iva Vlčková\AppData\Local\BIT8460.tmp
2011-05-24 17:14 . 2009-10-02 18:48 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-14 18:21 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-10 12:10 . 2011-04-11 20:01 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2008-12-23 18:40 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-04-11 20:02 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2008-12-23 18:41 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2008-12-23 18:41 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 11:59 . 2008-12-23 18:41 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2008-12-23 18:40 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-10 11:59 . 2008-12-23 18:41 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-24 05:50 . 2011-04-24 05:50 161792 ----a-w- c:\windows\system32\msls31.dll
2011-04-24 05:50 . 2011-04-24 05:50 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-04-24 05:50 . 2011-04-24 05:50 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-04-24 05:50 . 2011-04-24 05:50 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-04-24 05:50 . 2011-04-24 05:50 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-04-24 05:50 . 2011-04-24 05:50 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-04-24 05:50 . 2011-04-24 05:50 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-04-24 05:50 . 2011-04-24 05:50 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-04-24 05:50 . 2011-04-24 05:50 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-24 05:50 . 2011-04-24 05:50 367104 ----a-w- c:\windows\system32\html.iec
2011-04-24 05:50 . 2011-04-24 05:50 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-24 05:50 . 2011-04-24 05:50 152064 ----a-w- c:\windows\system32\wextract.exe
2011-04-24 05:50 . 2011-04-24 05:50 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-04-24 05:50 . 2011-04-24 05:50 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-24 05:50 . 2011-04-24 05:50 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-04-24 05:50 . 2011-04-24 05:50 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-04-24 05:50 . 2011-04-24 05:50 11776 ----a-w- c:\windows\system32\mshta.exe
2011-04-24 05:50 . 2011-04-24 05:50 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-04-24 05:50 . 2011-04-24 05:50 101888 ----a-w- c:\windows\system32\admparse.dll
2010-08-23 23:39 . 2010-08-23 23:39 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Center Agent"="c:\program files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe" [2007-07-13 1435648]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-23 30192]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-23 30192]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 PAC207;Webcam 1200;c:\windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: DhcpNameServer = 213.46.172.36 192.168.0.1
FF - ProfilePath - c:\users\Iva Vlčková\AppData\Roaming\Mozilla\Firefox\Profiles\10bklbj2.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-24 19:17
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(840)
c:\progra~1\ArcSoft\PHOTOI~1\share\pihook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\ArcSoft\Magic-i 3\uMgiSvr.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Celkový čas: 2011-06-24 19:23:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-24 17:23
ComboFix2.txt 2011-06-24 16:11
.
Před spuštěním: Volných bajtů: 297 488 023 552
Po spuštění: Volných bajtů: 299 216 920 576
.
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5,8
- - End Of File - - 7710E4215882E1F18E1FE0CE64DF714D

a tady je ještě HJT:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:26:54, on 24.6.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: HP Chytrý výběr - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7662 bytes