PC-HELP.CZ

Prosím o kontrolu- spustila jsem nějákej balast, od té doby se notebook seká, problém se spuštěním a něják blokuje antivir- nelze spustit.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:03:45, on 18.3.2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16930)
Boot mode: Normal


Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\MissMys\Desktop\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\System32\guard32.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 6343 bytes

Reinstal jsi zkoušel?
V logu fixni:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Díky za rychlou odpověď. Antivir už běží. V HJT fixnuto, ATF- vyčištěno. Malwarebytes Anti-Malware- nenanašel nic. Avira mi ale cca každých 10 minut hází okna, že byl nalezen Malware- pokaždé jiné umístění a jiný název. Celý systém se mi nepodaří proscanovat, protože notebook zamrzne.

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Po spuštění combofixu to napsalo že je něco s reboot nebo root (už nevím) a restartoval se notebook, pak už jel combo normálně.

ComboFix 12-03-18.04 - MissMys 19.03.2012 13:16:36.8.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1319 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB51258$
c:\windows\$NtUninstallKB51258$\1341884353\@
c:\windows\$NtUninstallKB51258$\1341884353\cfg.ini
c:\windows\$NtUninstallKB51258$\1341884353\Desktop.ini
c:\windows\$NtUninstallKB51258$\1341884353\L\xadqgnnk
c:\windows\$NtUninstallKB51258$\1341884353\twl.dll
c:\windows\$NtUninstallKB51258$\1341884353\U\00000001.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000002.@
c:\windows\$NtUninstallKB51258$\1341884353\U\00000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000000.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000004.@
c:\windows\$NtUninstallKB51258$\1341884353\U\80000032.@
c:\windows\$NtUninstallKB51258$\1341884353\version
c:\windows\$NtUninstallKB51258$\2225934518
c:\windows\system32\~.inf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 12:36 . 2012-03-19 12:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{335F5FCC-696D-4D4A-F52D-2BD12BDC4776}*]
@Allowed: (Read) (RestrictedCode)
"oafpefaphahiihadeonimicgjllgaa"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
"napoooinkjaejfmcjekpmgbckong"=hex:69,61,63,6f,6c,69,68,6f,62,68,63,6c,65,67,
65,67,6f,61,00,00
.
Celkový čas: 2012-03-19 13:41:17
ComboFix-quarantined-files.txt 2012-03-19 12:41
ComboFix2.txt 2011-06-24 22:05
ComboFix3.txt 2011-06-24 19:14
ComboFix4.txt 2011-06-24 16:55
ComboFix5.txt 2012-03-19 11:57
.
Před spuštěním: Volných bajtů: 271 815 229 440
Po spuštění: Volných bajtů: 272 270 409 728
.
- - End Of File - - 24AAAB56A25BDCBA9C44E4CF815FF13B

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

ComboFix 12-03-18.04 - MissMys 19.03.2012 19:17:16.9.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1296 [GMT 1:00]
Spuštěný z: c:\users\MissMys\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MissMys\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\~.tmp"
"c:\windows\system32\DRIVERS\eamonm.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAMONM
-------\Service_eamonm
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-19 do 2012-03-19 )))))))))))))))))))))))))))))))
.
.
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\misa\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-03-19 18:34 . 2012-03-19 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-19 18:18 . 2012-03-19 18:19 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\offreg.dll
2012-03-19 12:41 . 2012-03-19 18:40 -------- d-----w- c:\users\MissMys\AppData\Local\temp
2012-03-18 18:04 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57524F7D-B9A0-4B0A-B3E6-27D6F1EA73BD}\mpengine.dll
2012-03-18 12:57 . 2012-03-18 17:58 -------- d-----w- c:\users\MissMys\Adobe Dreamweaver CS5.5
2012-03-18 12:54 . 2012-03-18 12:54 -------- d-----w- c:\users\MissMys\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-03-15 13:49 . 2012-03-15 13:49 -------- d-----w- c:\program files\Common Files\Java
2012-03-11 20:14 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\VirtualBox VMs
2012-03-11 20:08 . 2012-03-11 20:13 -------- d-----w- C:\iFaith
2012-03-11 19:02 . 2012-03-11 20:36 -------- d-----w- c:\users\MissMys\.VirtualBox
2012-03-11 19:00 . 2011-12-19 13:11 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-03-11 19:00 . 2011-12-19 13:11 91440 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-03-11 18:40 . 2012-03-11 18:40 -------- d-----w- c:\program files\Intel Corporation
2012-03-11 12:03 . 2012-03-11 12:03 -------- d-----w- c:\users\MissMys\zalohaiphone
2012-03-11 12:00 . 2012-03-11 12:02 -------- d-----w- c:\users\MissMys\.shsh
2012-03-10 16:49 . 2012-03-10 23:16 -------- d-----w- c:\users\MissMys\AppData\Roaming\BSplayer PRO
2012-03-10 16:49 . 2012-03-10 16:58 -------- d-----w- c:\program files\BSplayerPro
2012-03-09 10:13 . 2012-03-09 10:13 -------- d-----w- c:\users\MissMys\AppData\Local\Facebook
2012-03-08 13:34 . 2012-03-08 13:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-08 11:39 . 2012-03-08 11:39 -------- d-----w- c:\users\MissMys\AppData\Roaming\Synaptics
2012-03-08 11:35 . 2012-03-08 12:33 -------- d-----w- c:\programdata\Synaptics
2012-03-08 11:34 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-03-08 11:34 . 2011-03-31 17:30 173352 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-03-08 11:34 . 2011-03-31 17:30 120104 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-03-08 11:34 . 2011-03-31 17:30 218408 ----a-w- c:\windows\system32\SynCtrl.dll
2012-03-08 11:34 . 2011-03-31 17:32 1335472 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-03-08 11:17 . 2012-03-08 11:18 -------- d-----w- c:\program files\Safari
2012-03-04 13:08 . 2012-03-04 13:08 162664 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-02-29 15:58 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-29 15:58 . 2012-01-04 09:03 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-29 15:58 . 2012-01-03 05:44 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-02-29 15:56 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys
2012-02-22 13:03 . 2012-03-18 17:58 -------- d-----w- c:\users\share
2012-02-22 12:20 . 2012-03-18 17:58 -------- d-----w- c:\users\ipad
2012-02-21 19:27 . 2012-02-21 19:27 -------- d--h--w- c:\programdata\CanonIJEGV
2012-02-20 14:46 . 2012-02-20 14:46 -------- d-----w- c:\users\MissMys\plocha
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 13:48 . 2010-07-26 10:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-08 11:47 . 2012-01-14 10:59 2221273 ----a-w- c:\windows\system32\~.tmp
2012-02-23 08:18 . 2010-07-26 11:10 237072 ----a-w- c:\windows\system32\MpSigStub.exe
2012-02-16 14:53 . 2012-03-08 13:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-09 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2010-7-26 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-03-12 11:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-08 13:22 136176 ----atw- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2011-07-21 22:07 718720 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [2007-11-07 12928]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-26 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-02 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [2010-07-08 815704]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-08-13 47360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-09 10:13]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001Core.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1001UA.job
- c:\users\MissMys\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-08 13:22]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009Core.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-414971957-2290763319-2668887875-1009UA.job
- c:\users\misa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-17 18:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/cse?cx=partner-pu ... &sa=Search
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\B6563797: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D49775C414E4: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8514580E-46BC-42D7-871D-0DE4C4599D69}\D61636865716E676: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\MissMys\AppData\Roaming\Mozilla\Firefox\Profiles\amb2wgw6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.arw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.cs1"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.dcx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.fff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.gif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.j2k"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jfif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.jif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jp2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpe"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.jpeg"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.kdc"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.mef"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.nrw"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pgm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.pic"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.ppm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.pspimage"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rw2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.rwl"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.sr2"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.thm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ZPS130.Document.wbmp"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-414971957-2290763319-2668887875-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Photo Manager 12.xif"
.
[HKEY_USERS\S-1-5-21-414971957-2290763319-2668887875-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5060)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Dell\QuickSet\quickset.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2012-03-19 19:46:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-19 18:46
ComboFix2.txt 2012-03-19 12:41
ComboFix3.txt 2011-06-24 22:05
ComboFix4.txt 2011-06-24 19:14
ComboFix5.txt 2012-03-19 18:15
.
Před spuštěním: Volných bajtů: 270 140 035 072
Po spuštění: Volných bajtů: 269 652 959 232
.
- - End Of File - - F7835C6E47B89E37660F4F58BF90B0A4

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:55, on 19.3.2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16930)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\Explorer.exe
C:\Users\MissMys\Desktop\hijackthis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\MissMys\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5820 bytes

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-19 19:51:56
-----------------------------
19:51:56.504 OS Version: Windows 6.1.7600
19:51:56.504 Number of processors: 2 586 0xE0C
19:51:56.536 ComputerName: MYS UserName:
19:51:58.532 Initialize success
19:52:06.620 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:52:06.620 Disk 0 Vendor: WDC_WD5000BPVT-00HXZT1 01.01A01 Size: 476940MB BusType: 3
19:52:06.667 Disk 0 MBR read successfully
19:52:06.683 Disk 0 MBR scan
19:52:06.683 Disk 0 Windows 7 default MBR code
19:52:06.698 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:52:06.714 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
19:52:06.714 Disk 0 scanning sectors +976771072
19:52:06.761 Disk 0 scanning C:\Windows\system32\drivers
19:52:15.200 Service scanning
19:52:26.526 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
19:52:32.049 Modules scanning
19:52:45.746 Disk 0 trace - called modules:
19:52:45.762 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x84e621f8]<<
19:52:46.277 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85cc1a38]
19:52:46.277 3 CLASSPNP.SYS[8951059e] -> nt!IofCallDriver -> [0x85bc2918]
19:52:46.292 5 ACPI.sys[88d613b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84ea4610]
19:52:46.292 \Driver\atapi[0x85bacc28] -> IRP_MJ_CREATE -> 0x84e621f8
19:52:46.308 Scan finished successfully
19:53:16.635 Disk 0 MBR has been saved successfully to "C:\Users\MissMys\Desktop\MBR.dat"
19:53:16.635 The log file has been saved successfully to "C:\Users\MissMys\Desktop\aswMBR.txt"

Notebook už vypadá dobře, stejně tak avira už nic nehlásí.

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.


Stáhni si program OTM (by OldTimer)
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE


- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.

Ten MoveIt! nakonci vypsal že vše bylo odstraněno, ale zůstal mi na ploše vyset jen ten program, jinak zmizely ikony, nabídka start, všechno. Tak sem růčo restart a žádný log v umístění C:\_OT..... není.