Prosím o kontrolu- spustila jsem nějákej balast, od té doby se notebook seká, problém se spuštěním a něják blokuje antivir- nelze spustit.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:03:45, on 18.3.2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16930)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\MissMys\Desktop\hijackthis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\System32\guard32.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 6343 bytes
prosím o kontrolu- nejde spustit antivir Vyřešeno
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
-
memphisto
- Guru Level 13
- Příspěvky: 21113
- Registrován: září 06
- Bydliště: Zlín - České Budějovice
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Reinstal jsi zkoušel?
V logu fixni:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
V logu fixni:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
PRAVIDLA PC-HELP.CZ, PRAVIDLA sekce HijackThis, HijackThis návod, Memtest, CCleaner
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Díky za rychlou odpověď. Antivir už běží. V HJT fixnuto, ATF- vyčištěno. Malwarebytes Anti-Malware- nenanašel nic. Avira mi ale cca každých 10 minut hází okna, že byl nalezen Malware- pokaždé jiné umístění a jiný název. Celý systém se mi nepodaří proscanovat, protože notebook zamrzne.
-
memphisto
- Guru Level 13
- Příspěvky: 21113
- Registrován: září 06
- Bydliště: Zlín - České Budějovice
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
PRAVIDLA PC-HELP.CZ, PRAVIDLA sekce HijackThis, HijackThis návod, Memtest, CCleaner
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Po spuštění combofixu to napsalo že je něco s reboot nebo root (už nevím) a restartoval se notebook, pak už jel combo normálně.
ComboFix 12-03-18.04 - MissMys 19.03.2012 13:16:36.8.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1319 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB51258$
c:\windows\$NtUninstallKB51258$\1341884353\@
c:\windows\$NtUninstallKB51258$\1341884353\cfg.ini
c:\windows\$NtUninstallKB51258$\1341884353\Desktop.ini
c:\windows\$NtUninstallKB51258$\1341884353\L\xadqgnnk
c:\windows\$NtUninstallKB51258$\1341884353\twl.dll
c:\windows\$NtUninstallKB51258$\1341884353\U\00000001.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000002.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000000.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000032.@
c:\windows\$NtUninstallKB51258$\1341884353\version
c:\windows\$NtUninstallKB51258$\2225934518
c:\windows\system32\~.inf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{335F5FCC-696D-4D4A-F52D-2BD12BDC4776}*]
@Allowed: (Read) (RestrictedCode)
"oafpefaphahiihadeonimicgjllgaa"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
"napoooinkjaejfmcjekpmgbckong"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
.
Celkový čas: 2012-03-19 13:41:17
ComboFix-quarantined-files.txt 2012-03-19 12:41
ComboFix2.txt 2011-06-24 22:05
ComboFix3.txt 2011-06-24 19:14
ComboFix4.txt 2011-06-24 16:55
ComboFix5.txt 2012-03-19 11:57
.
Před spuštěním: Volných bajtů: 271 815 229 440
Po spuštění: Volných bajtů: 272 270 409 728
.
- - End Of File - - 24AAAB56A25BDCBA9C44E4CF815FF13B
ComboFix 12-03-18.04 - MissMys 19.03.2012 13:16:36.8.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1319 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB51258$
c:\windows\$NtUninstallKB51258$\1341884353\@
c:\windows\$NtUninstallKB51258$\1341884353\cfg.ini
c:\windows\$NtUninstallKB51258$\1341884353\Desktop.ini
c:\windows\$NtUninstallKB51258$\1341884353\L\xadqgnnk
c:\windows\$NtUninstallKB51258$\1341884353\twl.dll
c:\windows\$NtUninstallKB51258$\1341884353\U\00000001.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000002.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000000.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000032.@
c:\windows\$NtUninstallKB51258$\1341884353\version
c:\windows\$NtUninstallKB51258$\2225934518
c:\windows\system32\~.inf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{335F5FCC-696D-4D4A-F52D-2BD12BDC4776}*]
@Allowed: (Read) (RestrictedCode)
"oafpefaphahiihadeonimicgjllgaa"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
"napoooinkjaejfmcjekpmgbckong"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
.
Celkový čas: 2012-03-19 13:41:17
ComboFix-quarantined-files.txt 2012-03-19 12:41
ComboFix2.txt 2011-06-24 22:05
ComboFix3.txt 2011-06-24 19:14
ComboFix4.txt 2011-06-24 16:55
ComboFix5.txt 2012-03-19 11:57
.
Před spuštěním: Volných bajtů: 271 815 229 440
Po spuštění: Volných bajtů: 272 270 409 728
.
- - End Of File - - 24AAAB56A25BDCBA9C44E4CF815FF13B
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43298
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Kód: Vybrat vše
KillAll::
File::
c:\windows\system32\~.tmp
c:\windows\system32\DRIVERS\eamonm.sys
Driver::
eamonm
RegNull::
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{335F5FCC-696D-4D4A-F52D-2BD12BDC4776}*]
@Allowed: (Read) (RestrictedCode)
"oafpefaphahiihadeonimicgjllgaa"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
"napoooinkjaejfmcjekpmgbckong"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
RegLock::
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{335F5FCC-696D-4D4A-F52D-2BD12BDC4776}*]
@Allowed: (Read) (RestrictedCode)
"oafpefaphahiihadeonimicgjllgaa"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
"napoooinkjaejfmcjekpmgbckong"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
ComboFix 12-03-18.04 - MissMys 19.03.2012 19:17:16.9.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1296 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MissMys\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\~.tmp"
"c:\windows\system32\DRIVERS\eamonm.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAMONM
-------\Service_eamonm
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-19 18:18 . 2012-03-19 18:19 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\offreg.dll
2012-03-19 12:41 . 2012-03-19 18:40 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5060)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Dell\QuickSet\quickset.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2012-03-19 19:46:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-19 18:46
ComboFix2.txt 2012-03-19 12:41
ComboFix3.txt 2011-06-24 22:05
ComboFix4.txt 2011-06-24 19:14
ComboFix5.txt 2012-03-19 18:15
.
Před spuštěním: Volných bajtů: 270 140 035 072
Po spuštění: Volných bajtů: 269 652 959 232
.
- - End Of File - - F7835C6E47B89E37660F4F58BF90B0A4
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1296 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MissMys\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\~.tmp"
"c:\windows\system32\DRIVERS\eamonm.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAMONM
-------\Service_eamonm
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-19 18:18 . 2012-03-19 18:19 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\offreg.dll
2012-03-19 12:41 . 2012-03-19 18:40 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5060)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Dell\QuickSet\quickset.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2012-03-19 19:46:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-19 18:46
ComboFix2.txt 2012-03-19 12:41
ComboFix3.txt 2011-06-24 22:05
ComboFix4.txt 2011-06-24 19:14
ComboFix5.txt 2012-03-19 18:15
.
Před spuštěním: Volných bajtů: 270 140 035 072
Po spuštění: Volných bajtů: 269 652 959 232
.
- - End Of File - - F7835C6E47B89E37660F4F58BF90B0A4
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:55, on 19.3.2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16930)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\Explorer.exe
C:\Users\MissMys\Desktop\hijackthis.exe
C:\Windows\system32\SearchFilterHost.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 5820 bytes
Scan saved at 19:48:55, on 19.3.2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16930)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\Explorer.exe
C:\Users\MissMys\Desktop\hijackthis.exe
C:\Windows\system32\SearchFilterHost.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 5820 bytes
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-19 19:51:56
-----------------------------
19:51:56.504 OS Version: Windows 6.1.7600
19:51:56.504 Number of processors: 2 586 0xE0C
19:51:56.536 ComputerName: MYS UserName:
19:51:58.532 Initialize success
19:52:06.620 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:52:06.620 Disk 0 Vendor: WDC_WD5000BPVT-00HXZT1 01.01A01 Size: 476940MB BusType: 3
19:52:06.667 Disk 0 MBR read successfully
19:52:06.683 Disk 0 MBR scan
19:52:06.683 Disk 0 Windows 7 default MBR code
19:52:06.698 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:52:06.714 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
19:52:06.714 Disk 0 scanning sectors +976771072
19:52:06.761 Disk 0 scanning C:\Windows\system32\drivers
19:52:15.200 Service scanning
19:52:26.526 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
19:52:32.049 Modules scanning
19:52:45.746 Disk 0 trace - called modules:
19:52:45.762 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x84e621f8]<<
19:52:46.277 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85cc1a38]
19:52:46.277 3 CLASSPNP.SYS[8951059e] -> nt!IofCallDriver -> [0x85bc2918]
19:52:46.292 5 ACPI.sys[88d613b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84ea4610]
19:52:46.292 \Driver\atapi[0x85bacc28] -> IRP_MJ_CREATE -> 0x84e621f8
19:52:46.308 Scan finished successfully
19:53:16.635 Disk 0 MBR has been saved successfully to "C:\Users\MissMys\Desktop\MBR.dat"
19:53:16.635 The log file has been saved successfully to "C:\Users\MissMys\Desktop\aswMBR.txt"
Run date: 2012-03-19 19:51:56
-----------------------------
19:51:56.504 OS Version: Windows 6.1.7600
19:51:56.504 Number of processors: 2 586 0xE0C
19:51:56.536 ComputerName: MYS UserName:
19:51:58.532 Initialize success
19:52:06.620 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:52:06.620 Disk 0 Vendor: WDC_WD5000BPVT-00HXZT1 01.01A01 Size: 476940MB BusType: 3
19:52:06.667 Disk 0 MBR read successfully
19:52:06.683 Disk 0 MBR scan
19:52:06.683 Disk 0 Windows 7 default MBR code
19:52:06.698 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:52:06.714 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
19:52:06.714 Disk 0 scanning sectors +976771072
19:52:06.761 Disk 0 scanning C:\Windows\system32\drivers
19:52:15.200 Service scanning
19:52:26.526 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
19:52:32.049 Modules scanning
19:52:45.746 Disk 0 trace - called modules:
19:52:45.762 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x84e621f8]<<
19:52:46.277 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85cc1a38]
19:52:46.277 3 CLASSPNP.SYS[8951059e] -> nt!IofCallDriver -> [0x85bc2918]
19:52:46.292 5 ACPI.sys[88d613b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84ea4610]
19:52:46.292 \Driver\atapi[0x85bacc28] -> IRP_MJ_CREATE -> 0x84e621f8
19:52:46.308 Scan finished successfully
19:53:16.635 Disk 0 MBR has been saved successfully to "C:\Users\MissMys\Desktop\MBR.dat"
19:53:16.635 The log file has been saved successfully to "C:\Users\MissMys\Desktop\aswMBR.txt"
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Notebook už vypadá dobře, stejně tak avira už nic nehlásí.
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43298
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall
Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.
Stáhni si program OTM (by OldTimer)
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE
- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.
Start-Spustit a zadej ComboFix /Uninstall
Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.
Stáhni si program OTM (by OldTimer)
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE
Kód: Vybrat vše
:Processes
explorer.exe
:Services
:Reg
:Files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\WINDOWS\system32\*.tmp.dll
C:\WINDOWS\System32\dllcache\*.tmp
C:\WINDOWS\system32\SET*.tmp
c:\windows\Tasks\*.job
C:\*.tmp
C:\WINDOWS\System32\drivers\*.tmp
C:\Documents and Settings\All Users\Data aplikací\*.tmp
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
-
apurvathea
- Level 2
- Příspěvky: 203
- Registrován: březen 07
- Pohlaví:
- Stav:
Offline
Re: prosím o kontrolu- nejde spustit antivir
Ten MoveIt! nakonci vypsal že vše bylo odstraněno, ale zůstal mi na ploše vyset jen ten program, jinak zmizely ikony, nabídka start, všechno. Tak sem růčo restart a žádný log v umístění C:\_OT..... není.
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 57 hostů