PC-HELP.CZ

Zdravím, potřeboval bych trochu pomoct. Můj noťas nereaguje tak rychle jak bych čekal, často pracuje procesor nad 50% aniž bych věděl na čem pracuje...
projel jsem to ATF-Cleanerem, nenašel jsem žádný malware skrz Malwarebytes takže nevím co s tím je.

tady je muj HiJack pokud bude ještě nejaký scan potřeba napište prosím.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:37, on 25.3.2012
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe
C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe
C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\rundll32.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ondra\Downloads\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {95289393-33EA-4F8D-B952-483415B9C955} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
O4 - HKLM\..\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Ondra\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" -stealth
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Samsung Auto Backup Guage.lnk = ?
O4 - Startup: Samsung Auto Backup Real-Time Daemon.lnk = ?
O4 - Startup: Samsung Auto Backup Scheduler.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files (x86)\QIP Infium\infium.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: IGRS - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo ReadyComm AppSvc - Lenovo Group Limited - C:\Program Files\Lenovo\ReadyComm\AppSvc.exe
O23 - Service: Lenovo ReadyComm ConnSvc - Lenovo Group Limited - C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: SecretZone Assist Service (SZASSIST) - Clarus, Inc. - C:\Program Files (x86)\Clarus\Samsung SecretZone\SZAssistSVC.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12353 bytes


Předem děkuji

Jaktože nevíš, co to vytěžuje? Zapnu správce procesů, nechám si vše zobrazit a hned mám jasno ne?

Fixni:
Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

nemyslel jsem tim ze se neumim podivat do spravce uloh, ale spis to ze kdyz to mam otevrene jede CPU treba na 10% a pak to na chvilku vyskoci na 50-60% a ja ani nezjitim co to je nez to zase zmizi... nejsem si jisty jestli je toto muj problem ale pravdou je ze pc pracuje pomalu (pri zapinani prohlizece, aplikaci i otevirani slozek atd.)

zde je ComboFix log


ComboFix 12-03-22.01 - Ondra 25.03.2012 22:10:02.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2814.1865 [GMT 2:00]
Spuštěný z: c:\users\Ondra\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\FreeRapid
c:\program files\FreeRapid\app.log
c:\program files\FreeRapid\copyright
c:\program files\FreeRapid\doc\changes.txt
c:\program files\FreeRapid\doc\readme.cz.txt
c:\program files\FreeRapid\doc\readme.esp(LA).txt
c:\program files\FreeRapid\doc\readme.esp.txt
c:\program files\FreeRapid\doc\readme.fr.txt
c:\program files\FreeRapid\doc\readme.hr.txt
c:\program files\FreeRapid\doc\readme.ru.txt
c:\program files\FreeRapid\doc\readme.txt
c:\program files\FreeRapid\frd.exe
c:\program files\FreeRapid\frd.ico
c:\program files\FreeRapid\frd.jar
c:\program files\FreeRapid\frd.png
c:\program files\FreeRapid\frd.sh
c:\program files\FreeRapid\lib\appframework.jar
c:\program files\FreeRapid\lib\buttonpanel.jar
c:\program files\FreeRapid\lib\commons-cli-2.0-SNAPSHOT.jar
c:\program files\FreeRapid\lib\commons-codec-1.4.jar
c:\program files\FreeRapid\lib\commons-httpclient-3.1.jar
c:\program files\FreeRapid\lib\commons-logging-1.1.jar
c:\program files\FreeRapid\lib\forms.jar
c:\program files\FreeRapid\lib\ICOReader-1.04.jar
c:\program files\FreeRapid\lib\jai_codec.jar
c:\program files\FreeRapid\lib\jgoodiesbinding.jar
c:\program files\FreeRapid\lib\jlibs-core.jar
c:\program files\FreeRapid\lib\jlibs-xml.jar
c:\program files\FreeRapid\lib\jna.jar
c:\program files\FreeRapid\lib\jpf.jar
c:\program files\FreeRapid\lib\l2fprod-common-buttonbar.jar
c:\program files\FreeRapid\lib\l2fprod-common-directorychooser.jar
c:\program files\FreeRapid\lib\languages.jar
c:\program files\FreeRapid\lib\mina-core-2.0.1-sh.jar
c:\program files\FreeRapid\lib\platform.jar
c:\program files\FreeRapid\lib\slf4j-api-1.6.1.jar
c:\program files\FreeRapid\lib\slf4j-nop-1.6.1.jar
c:\program files\FreeRapid\lib\swingx.jar
c:\program files\FreeRapid\lib\trident.jar
c:\program files\FreeRapid\License
c:\program files\FreeRapid\lookandfeel\JTattoo.jar
c:\program files\FreeRapid\lookandfeel\libquaqua.jnilib
c:\program files\FreeRapid\lookandfeel\libquaqua64.jnilib
c:\program files\FreeRapid\lookandfeel\quaqua.jar
c:\program files\FreeRapid\lookandfeel\squareness.jar
c:\program files\FreeRapid\lookandfeel\substance-lite.jar
c:\program files\FreeRapid\lookandfeel\substance-swingx.jar
c:\program files\FreeRapid\lookandfeel\swing-layout.jar
c:\program files\FreeRapid\plugins\4upload.frp
c:\program files\FreeRapid\plugins\addat.frp
c:\program files\FreeRapid\plugins\adf.frp
c:\program files\FreeRapid\plugins\alfa_files.frp
c:\program files\FreeRapid\plugins\anonym.frp
c:\program files\FreeRapid\plugins\appletrailers.frp
c:\program files\FreeRapid\plugins\ardmediathek.frp
c:\program files\FreeRapid\plugins\badongo.frp
c:\program files\FreeRapid\plugins\bagruj.frp
c:\program files\FreeRapid\plugins\barrandov.frp
c:\program files\FreeRapid\plugins\bbc.frp
c:\program files\FreeRapid\plugins\bebasupload.frp
c:\program files\FreeRapid\plugins\bezvadata.frp
c:\program files\FreeRapid\plugins\bigandfree.frp
c:\program files\FreeRapid\plugins\bigandfree_premium.frp
c:\program files\FreeRapid\plugins\bigflix.frp
c:\program files\FreeRapid\plugins\biggerupload.frp
c:\program files\FreeRapid\plugins\bigshare.frp
c:\program files\FreeRapid\plugins\bitroad.frp
c:\program files\FreeRapid\plugins\bitshare.frp
c:\program files\FreeRapid\plugins\blogspot.frp
c:\program files\FreeRapid\plugins\cbs.frp
c:\program files\FreeRapid\plugins\ceskatelevize.frp
c:\program files\FreeRapid\plugins\co.frp
c:\program files\FreeRapid\plugins\cobrashare.frp
c:\program files\FreeRapid\plugins\container.frp
c:\program files\FreeRapid\plugins\cramit.frp
c:\program files\FreeRapid\plugins\createfile.frp
c:\program files\FreeRapid\plugins\cryptit.frp
c:\program files\FreeRapid\plugins\czshare.frp
c:\program files\FreeRapid\plugins\czshare_profi.frp
c:\program files\FreeRapid\plugins\dailymotion.frp
c:\program files\FreeRapid\plugins\data.frp
c:\program files\FreeRapid\plugins\data_premium.frp
c:\program files\FreeRapid\plugins\dataport.frp
c:\program files\FreeRapid\plugins\dataup.frp
c:\program files\FreeRapid\plugins\depositfiles.frp
c:\program files\FreeRapid\plugins\depositfiles_premium.frp
c:\program files\FreeRapid\plugins\direct.frp
c:\program files\FreeRapid\plugins\disperseit.frp
c:\program files\FreeRapid\plugins\divshare.frp
c:\program files\FreeRapid\plugins\dlfreefr.frp
c:\program files\FreeRapid\plugins\dnbshare.frp
c:\program files\FreeRapid\plugins\duckload.frp
c:\program files\FreeRapid\plugins\easyshare.frp
c:\program files\FreeRapid\plugins\easysharews.frp
c:\program files\FreeRapid\plugins\edisk.frp
c:\program files\FreeRapid\plugins\egoshare.frp
c:\program files\FreeRapid\plugins\enterupload.frp
c:\program files\FreeRapid\plugins\extabit.frp
c:\program files\FreeRapid\plugins\extrashare.frp
c:\program files\FreeRapid\plugins\facebook.frp
c:\program files\FreeRapid\plugins\fastload.frp
c:\program files\FreeRapid\plugins\fdnlinks.frp
c:\program files\FreeRapid\plugins\file2box.frp
c:\program files\FreeRapid\plugins\filebaseto.frp
c:\program files\FreeRapid\plugins\filebeam.frp
c:\program files\FreeRapid\plugins\filebitnet.frp
c:\program files\FreeRapid\plugins\filebox.frp
c:\program files\FreeRapid\plugins\filedropper.frp
c:\program files\FreeRapid\plugins\filefactory.frp
c:\program files\FreeRapid\plugins\filefactory_premium.frp
c:\program files\FreeRapid\plugins\fileflyer.frp
c:\program files\FreeRapid\plugins\filer.frp
c:\program files\FreeRapid\plugins\filerack.frp
c:\program files\FreeRapid\plugins\files.frp
c:\program files\FreeRapid\plugins\filesavr.frp
c:\program files\FreeRapid\plugins\filesdump.frp
c:\program files\FreeRapid\plugins\filesend.frp
c:\program files\FreeRapid\plugins\fileserve.frp
c:\program files\FreeRapid\plugins\fileserve_premium.frp
c:\program files\FreeRapid\plugins\filesflash.frp
c:\program files\FreeRapid\plugins\fileshare.frp
c:\program files\FreeRapid\plugins\fileshost.frp
c:\program files\FreeRapid\plugins\filesmonster.frp
c:\program files\FreeRapid\plugins\filesonic.frp
c:\program files\FreeRapid\plugins\filesonic_premium.frp
c:\program files\FreeRapid\plugins\filestore.frp
c:\program files\FreeRapid\plugins\filestoreua.frp
c:\program files\FreeRapid\plugins\filestube.frp
c:\program files\FreeRapid\plugins\fileupload.frp
c:\program files\FreeRapid\plugins\flickr.frp
c:\program files\FreeRapid\plugins\flickrcollections.frp
c:\program files\FreeRapid\plugins\flyshare.frp
c:\program files\FreeRapid\plugins\flyupload.frp
c:\program files\FreeRapid\plugins\forshared.frp
c:\program files\FreeRapid\plugins\forusto.frp
c:\program files\FreeRapid\plugins\freakshare.frp
c:\program files\FreeRapid\plugins\freefolder.frp
c:\program files\FreeRapid\plugins\freenapster.frp
c:\program files\FreeRapid\plugins\freevideo.frp
c:\program files\FreeRapid\plugins\fsx.frp
c:\program files\FreeRapid\plugins\fsx_premium.frp
c:\program files\FreeRapid\plugins\gametrailers.frp
c:\program files\FreeRapid\plugins\getapp.frp
c:\program files\FreeRapid\plugins\gigapeta.frp
c:\program files\FreeRapid\plugins\gigasize.frp
c:\program files\FreeRapid\plugins\gigaup.frp
c:\program files\FreeRapid\plugins\googlevideo.frp
c:\program files\FreeRapid\plugins\gotupload.frp
c:\program files\FreeRapid\plugins\grooveshark.frp
c:\program files\FreeRapid\plugins\hamstershare.frp
c:\program files\FreeRapid\plugins\hellshare.frp
c:\program files\FreeRapid\plugins\hellshare_full.frp
c:\program files\FreeRapid\plugins\hellspy.frp
c:\program files\FreeRapid\plugins\hollywoodtuna.frp
c:\program files\FreeRapid\plugins\hotfile.frp
c:\program files\FreeRapid\plugins\hotfile_premium.frp
c:\program files\FreeRapid\plugins\hotfilefolder.frp
c:\program files\FreeRapid\plugins\hulkshare.frp
c:\program files\FreeRapid\plugins\hulu.frp
c:\program files\FreeRapid\plugins\hyperfileshare.frp
c:\program files\FreeRapid\plugins\channel4.frp
c:\program files\FreeRapid\plugins\i_filez.frp
c:\program files\FreeRapid\plugins\ifile.frp
c:\program files\FreeRapid\plugins\ifile_login.frp
c:\program files\FreeRapid\plugins\ifolder.frp
c:\program files\FreeRapid\plugins\ilix.frp
c:\program files\FreeRapid\plugins\imagebam.frp
c:\program files\FreeRapid\plugins\imagehaven.frp
c:\program files\FreeRapid\plugins\imageshack.frp
c:\program files\FreeRapid\plugins\imagevenue.frp
c:\program files\FreeRapid\plugins\imzupload.frp
c:\program files\FreeRapid\plugins\indowebster.frp
c:\program files\FreeRapid\plugins\iskladka.frp
c:\program files\FreeRapid\plugins\itv.frp
c:\program files\FreeRapid\plugins\jandown.frp
c:\program files\FreeRapid\plugins\keepfile.frp
c:\program files\FreeRapid\plugins\kewlshare.frp
c:\program files\FreeRapid\plugins\leteckaposta.frp
c:\program files\FreeRapid\plugins\letitbit.frp
c:\program files\FreeRapid\plugins\letitbit_premium.frp
c:\program files\FreeRapid\plugins\linkbee.frp
c:\program files\FreeRapid\plugins\linkblur.frp
c:\program files\FreeRapid\plugins\linkbucks.frp
c:\program files\FreeRapid\plugins\linkdecrypter.frp
c:\program files\FreeRapid\plugins\linksafe.frp
c:\program files\FreeRapid\plugins\linksave.frp
c:\program files\FreeRapid\plugins\lixin.frp
c:\program files\FreeRapid\plugins\loadto.frp
c:\program files\FreeRapid\plugins\mediafire.frp
c:\program files\FreeRapid\plugins\mega1280.frp
c:\program files\FreeRapid\plugins\megashare.frp
c:\program files\FreeRapid\plugins\megashares.frp
c:\program files\FreeRapid\plugins\megasharevn.frp
c:\program files\FreeRapid\plugins\megaupload.frp
c:\program files\FreeRapid\plugins\megaupload_premium.frp
c:\program files\FreeRapid\plugins\megavideo.frp
c:\program files\FreeRapid\plugins\megavideo_premium.frp
c:\program files\FreeRapid\plugins\metacafe.frp
c:\program files\FreeRapid\plugins\metadivx.frp
c:\program files\FreeRapid\plugins\microsoftdownloads.frp
c:\program files\FreeRapid\plugins\mimima.frp
c:\program files\FreeRapid\plugins\miroriii.frp
c:\program files\FreeRapid\plugins\missupload.frp
c:\program files\FreeRapid\plugins\movielibrary.frp
c:\program files\FreeRapid\plugins\multiload.frp
c:\program files\FreeRapid\plugins\multishare.frp
c:\program files\FreeRapid\plugins\multishare_premium.frp
c:\program files\FreeRapid\plugins\multiupload.frp
c:\program files\FreeRapid\plugins\myurl.frp
c:\program files\FreeRapid\plugins\nahrajcz.frp
c:\program files\FreeRapid\plugins\narod.frp
c:\program files\FreeRapid\plugins\nbc.frp
c:\program files\FreeRapid\plugins\netloadin.frp
c:\program files\FreeRapid\plugins\nova.frp
c:\program files\FreeRapid\plugins\novaup.frp
c:\program files\FreeRapid\plugins\o2musicstream.frp
c:\program files\FreeRapid\plugins\odsiebie.frp
c:\program files\FreeRapid\plugins\oron.frp
c:\program files\FreeRapid\plugins\oron_premium.frp
c:\program files\FreeRapid\plugins\paid4share.frp
c:\program files\FreeRapid\plugins\photobucket.frp
c:\program files\FreeRapid\plugins\picasa.frp
c:\program files\FreeRapid\plugins\plunder.frp
c:\program files\FreeRapid\plugins\protectlinks.frp
c:\program files\FreeRapid\plugins\protectmylinks.frp
c:\program files\FreeRapid\plugins\przeklej.frp
c:\program files\FreeRapid\plugins\qshare.frp
c:\program files\FreeRapid\plugins\quickshare.frp
c:\program files\FreeRapid\plugins\quickshare_premium.frp
c:\program files\FreeRapid\plugins\radikalru.frp
c:\program files\FreeRapid\plugins\rajce.frp
c:\program files\FreeRapid\plugins\rapidlibrary.frp
c:\program files\FreeRapid\plugins\rapidshare.frp
c:\program files\FreeRapid\plugins\rapidshare_premium.frp
c:\program files\FreeRapid\plugins\rapidsharede.frp
c:\program files\FreeRapid\plugins\rapidshareuser.frp
c:\program files\FreeRapid\plugins\recaptcha.frp
c:\program files\FreeRapid\plugins\relink.frp
c:\program files\FreeRapid\plugins\remixshare.frp
c:\program files\FreeRapid\plugins\rghost.frp
c:\program files\FreeRapid\plugins\rsmonkey.frp
c:\program files\FreeRapid\plugins\rte.frp
c:\program files\FreeRapid\plugins\rtmp.frp
c:\program files\FreeRapid\plugins\rtve.frp
c:\program files\FreeRapid\plugins\ruutu.frp
c:\program files\FreeRapid\plugins\savefile.frp
c:\program files\FreeRapid\plugins\saveqube.frp
c:\program files\FreeRapid\plugins\sdilej.frp
c:\program files\FreeRapid\plugins\securedin.frp
c:\program files\FreeRapid\plugins\sendspace.frp
c:\program files\FreeRapid\plugins\sendspacepl.frp
c:\program files\FreeRapid\plugins\serienjunkies.frp
c:\program files\FreeRapid\plugins\servupcoil.frp
c:\program files\FreeRapid\plugins\shareapicnet.frp
c:\program files\FreeRapid\plugins\shareator.frp
c:\program files\FreeRapid\plugins\sharebee.frp
c:\program files\FreeRapid\plugins\sharebomb.frp
c:\program files\FreeRapid\plugins\sharelinksbiz.frp
c:\program files\FreeRapid\plugins\shareonline.frp
c:\program files\FreeRapid\plugins\shareplace.frp
c:\program files\FreeRapid\plugins\sharerapid.frp
c:\program files\FreeRapid\plugins\sharingmatrix.frp
c:\program files\FreeRapid\plugins\sharingmatrix_premium.frp
c:\program files\FreeRapid\plugins\slingfile.frp
c:\program files\FreeRapid\plugins\socadvnet.frp
c:\program files\FreeRapid\plugins\soundcloud.frp
c:\program files\FreeRapid\plugins\spankwire.frp
c:\program files\FreeRapid\plugins\speedyshare.frp
c:\program files\FreeRapid\plugins\storage.frp
c:\program files\FreeRapid\plugins\storeplace.frp
c:\program files\FreeRapid\plugins\streamcz.frp
c:\program files\FreeRapid\plugins\superfastfile.frp
c:\program files\FreeRapid\plugins\svtplay.frp
c:\program files\FreeRapid\plugins\teradepot.frp
c:\program files\FreeRapid\plugins\tinyurl.frp
c:\program files\FreeRapid\plugins\titulky.frp
c:\program files\FreeRapid\plugins\toshared.frp
c:\program files\FreeRapid\plugins\tube8.frp
c:\program files\FreeRapid\plugins\tunescoop.frp
c:\program files\FreeRapid\plugins\turbobit.frp
c:\program files\FreeRapid\plugins\turboshare.frp
c:\program files\FreeRapid\plugins\tv6play.frp
c:\program files\FreeRapid\plugins\ugotfile.frp
c:\program files\FreeRapid\plugins\ulozcz.frp
c:\program files\FreeRapid\plugins\ulozisko.frp
c:\program files\FreeRapid\plugins\ulozto.frp
c:\program files\FreeRapid\plugins\ultrashare.frp
c:\program files\FreeRapid\plugins\unibytes.frp
c:\program files\FreeRapid\plugins\up-file.com.frp
c:\program files\FreeRapid\plugins\uploadbox.frp
c:\program files\FreeRapid\plugins\uploadcomua.frp
c:\program files\FreeRapid\plugins\uploadedto.frp
c:\program files\FreeRapid\plugins\uploadhere.frp
c:\program files\FreeRapid\plugins\uploadil.frp
c:\program files\FreeRapid\plugins\uploading.frp
c:\program files\FreeRapid\plugins\uploading_premium.frp
c:\program files\FreeRapid\plugins\uploadjocketredirect.frp
c:\program files\FreeRapid\plugins\uploadjockey.frp
c:\program files\FreeRapid\plugins\uploadking.frp
c:\program files\FreeRapid\plugins\uploadline.frp
c:\program files\FreeRapid\plugins\uploadspace.frp
c:\program files\FreeRapid\plugins\uploadstation.frp
c:\program files\FreeRapid\plugins\uppit.frp
c:\program files\FreeRapid\plugins\urlcash.frp
c:\program files\FreeRapid\plugins\usercash.frp
c:\program files\FreeRapid\plugins\usershare.frp
c:\program files\FreeRapid\plugins\videolectures.frp
c:\program files\FreeRapid\plugins\videoweed.frp
c:\program files\FreeRapid\plugins\vimeo.frp
c:\program files\FreeRapid\plugins\vip-file.frp
c:\program files\FreeRapid\plugins\webshare.frp
c:\program files\FreeRapid\plugins\webshots.frp
c:\program files\FreeRapid\plugins\wiiupload.frp
c:\program files\FreeRapid\plugins\wikiupload.frp
c:\program files\FreeRapid\plugins\wupload.frp
c:\program files\FreeRapid\plugins\x7.frp
c:\program files\FreeRapid\plugins\xtraupload.frp
c:\program files\FreeRapid\plugins\xun6.frp
c:\program files\FreeRapid\plugins\yleareena.frp
c:\program files\FreeRapid\plugins\yourfilehost.frp
c:\program files\FreeRapid\plugins\yourfiles.frp
c:\program files\FreeRapid\plugins\youtube.frp
c:\program files\FreeRapid\plugins\yunfile.frp
c:\program files\FreeRapid\plugins\zhlednito.frp
c:\program files\FreeRapid\plugins\ziddu.frp
c:\program files\FreeRapid\plugins\zippyshare.frp
c:\program files\FreeRapid\plugins\zshare.frp
c:\program files\FreeRapid\readme.txt
c:\program files\FreeRapid\search\freerapid.xml
c:\program files\FreeRapid\search\google.xml
c:\program files\FreeRapid\search\ulozto.xml
c:\program files\FreeRapid\startup.properties
c:\program files\FreeRapid\syscmd.properties
c:\program files\FreeRapid\tools\gocr\gocr.exe
c:\program files\FreeRapid\tools\nircmd\nircmd.exe
c:\program files\FreeRapid\tools\nircmd\NirCmd.chm
c:\program files\FreeRapid\tools\socks\setupproxy.sh
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\s.bat
c:\windows\ST6UNST.000
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-25 do 2012-03-25 )))))))))))))))))))))))))))))))
.
.
2012-03-25 20:25 . 2012-03-25 20:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-25 20:17 . 2012-03-25 20:17 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C56D1712-1160-4AF3-B5B7-B78B9EF36999}\offreg.dll
2012-03-24 14:26 . 2012-03-25 08:42 -------- d-----w- c:\programdata\SecTaskMan
2012-03-24 14:26 . 2012-03-24 14:26 -------- d-----w- c:\program files (x86)\Security Task Manager
2012-03-24 12:52 . 2012-03-24 12:52 -------- d-----w- c:\program files\CCleaner
2012-03-24 12:43 . 2012-03-24 12:45 -------- d-----w- c:\users\Ondra\AppData\Local\Adobe
2012-03-24 11:29 . 2012-03-24 11:29 -------- d-----w- c:\users\Ondra\AppData\Local\ATI
2012-03-24 10:36 . 2012-03-24 10:36 -------- d-----w- c:\users\Ondra\AppData\Local\Apps
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\users\Ondra\AppData\Roaming\Malwarebytes
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\programdata\Malwarebytes
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-24 10:26 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-24 10:06 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C56D1712-1160-4AF3-B5B7-B78B9EF36999}\mpengine.dll
2012-03-15 06:22 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 06:22 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-15 06:22 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 09:17 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 09:17 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 09:17 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 09:17 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-14 09:17 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 09:17 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 09:16 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 09:16 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 09:16 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 09:16 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-27 21:06 . 2012-02-27 21:10 -------- d-----w- c:\users\Ondra\AppData\Roaming\avidemux
2012-02-27 20:59 . 2012-03-24 10:35 -------- d-----w- c:\program files (x86)\Avidemux 2.5
2012-02-27 20:53 . 2012-03-24 11:09 -------- d-----w- c:\program files (x86)\FreeTime
2012-02-27 17:28 . 2012-02-27 17:28 -------- d-----w- c:\users\Ondra\AppData\Local\DDMSettings
2012-02-27 16:32 . 2012-02-28 09:48 -------- d-----w- c:\users\Ondra\AppData\Roaming\DivX
2012-02-27 16:30 . 2012-02-27 16:31 -------- d-----w- c:\program files\DivX
2012-02-27 16:29 . 2012-02-27 16:31 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2012-02-27 16:27 . 2012-02-27 16:32 -------- d-----w- c:\program files (x86)\DivX
2012-02-27 16:26 . 2012-02-27 16:32 -------- d-----w- c:\programdata\DivX
2012-02-27 09:47 . 2003-04-16 00:10 110592 ----a-w- c:\windows\SysWow64\tsccvid.dll
2012-02-27 09:47 . 2012-02-27 09:47 -------- d-----w- c:\program files (x86)\CDVPlayer
2012-02-27 09:47 . 2012-02-27 09:47 466944 ------w- c:\windows\Setup1.exe
2012-02-27 09:47 . 2012-02-27 09:47 73216 ----a-w- c:\windows\ST6UNST.EXE
2012-02-25 00:44 . 2012-03-07 00:02 53080 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-24 12:45 . 2011-11-01 15:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-07 00:15 . 2011-02-21 11:56 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:15 . 2011-02-21 11:56 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-03-07 00:15 . 2011-02-21 11:56 258520 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-07 00:04 . 2011-05-28 08:09 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:04 . 2011-02-21 11:57 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:01 . 2011-02-21 11:56 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2011-02-21 11:56 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2011-02-21 11:57 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2011-02-21 11:53 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 09:07 . 2012-02-16 23:03 1656 ----a-w- c:\windows\system32\ASOROSet.bin
2012-01-20 13:14 . 2012-02-16 22:25 18816 ----a-w- c:\windows\system32\roboot64.exe
2012-01-04 10:44 . 2012-02-15 09:16 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 09:16 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2012-01-04 00:48 . 2012-01-04 00:48 354176 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2012-01-03 13:10 . 2012-01-03 13:10 53656 ----a-w- c:\windows\system32\AdobePDF.dll
2012-01-03 13:10 . 2012-01-03 13:10 24984 ----a-w- c:\windows\system32\AdobePDFUI.dll
2011-12-30 06:26 . 2012-02-15 09:16 515584 ----a-w- c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 09:16 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 09:16 498688 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"="c:\program files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" [2011-06-09 12002664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-13 98304]
"UCam_Menu"="c:\program files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-12-20 634880]
.
c:\users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Auto Backup Guage.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe [2011-10-25 823296]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2011-10-25 65536]
Samsung Auto Backup Scheduler.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe [2011-10-25 102400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 IGRS;IGRS;c:\program files (x86)\Lenovo\ReadyComm\common\IGRS.exe [2009-07-15 38152]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-11-17 575304]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576]
S2 SZASSIST;SecretZone Assist Service;c:\program files (x86)\Clarus\Samsung SecretZone\SZAssistSVC.exe [2011-04-15 90112]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 mdf16;mdf16;c:\program files (x86)\Clarus\Samsung SecretZone\mdf16.sys [2010-08-17 18288]
S3 mvd22;mvd22;c:\program files (x86)\Clarus\Samsung SecretZone\mvd22.sys [2010-08-17 78192]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644185992-1059674713-719569389-1000Core.job
- c:\users\Ondra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 11:53]
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644185992-1059674713-719569389-1000UA.job
- c:\users\Ondra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 11:53]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 135408 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-20 10151968]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-04-20 908320]
"TpShocks"="c:\windows\System32\TpShocks.exe" [2010-03-15 231328]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2010-04-12 4462496]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2010-03-18 7056800]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 77.48.65.3 10.90.31.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-03-25 22:36:39
ComboFix-quarantined-files.txt 2012-03-25 20:36
.
Před spuštěním: Volných bajtů: 160 021 082 112
Po spuštění: Volných bajtů: 159 883 223 040
.
- - End Of File - - AEA731EA7EF17AEC12CEF59940AB27C6

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\roboot64.exe

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
File name: roboot64.exe
Detection ratio: 0 / 43
Analysis date: 2012-03-26 07:39:28 UTC ( 0 minut ago )

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Žádná nákaza..

Stáhni AVP Tools
na svojí plochu.

Zaškrtni :
Hidden startup objects
System Memory
Disk boot sectors
Dokumenty
My email
Počítač
Místní disk C
Místní disk D
Jednotka DVD-Rom (E)
Jednotka BD-ROM (G)
A jiné , např. Flash disky , které máš připojeny.

Pokračuj podle instrukcí.Na konci se objeví textový soubor , který si hned ulož (save log) na svojí plochu pod názvem KAS.txt .Poté sem vlož celý obsah toho logu.

Pokud se Ti log nezobrazí:
Pokud máš AVPtool stále zapnutý, zkus zmáčknout tlačítko Zpráva (Report).
Pokud se Ti zobrazí tabulka, klikni na ní pravým myšítkem a dej Maximalize a měli by se Ti zobrazit výsledky.

http://www.sosej.cz/Download/Kaspersky- ... nload.html

ComboFix


ComboFix 12-03-22.01 - Ondra 26.03.2012 10:03:22.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2814.1603 [GMT 2:00]
Spuštěný z: c:\users\Ondra\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Ondra\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-26 do 2012-03-26 )))))))))))))))))))))))))))))))
.
.
2012-03-26 08:13 . 2012-03-26 08:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-25 20:17 . 2012-03-25 22:49 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C56D1712-1160-4AF3-B5B7-B78B9EF36999}\offreg.dll
2012-03-24 14:26 . 2012-03-25 08:42 -------- d-----w- c:\programdata\SecTaskMan
2012-03-24 14:26 . 2012-03-24 14:26 -------- d-----w- c:\program files (x86)\Security Task Manager
2012-03-24 12:52 . 2012-03-24 12:52 -------- d-----w- c:\program files\CCleaner
2012-03-24 12:43 . 2012-03-24 12:45 -------- d-----w- c:\users\Ondra\AppData\Local\Adobe
2012-03-24 11:29 . 2012-03-24 11:29 -------- d-----w- c:\users\Ondra\AppData\Local\ATI
2012-03-24 10:36 . 2012-03-24 10:36 -------- d-----w- c:\users\Ondra\AppData\Local\Apps
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\users\Ondra\AppData\Roaming\Malwarebytes
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\programdata\Malwarebytes
2012-03-24 10:26 . 2012-03-24 10:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-24 10:26 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-24 10:06 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C56D1712-1160-4AF3-B5B7-B78B9EF36999}\mpengine.dll
2012-03-15 06:22 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-15 06:22 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-15 06:22 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 09:17 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 09:17 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 09:17 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 09:17 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-14 09:17 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 09:17 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 09:16 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 09:16 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 09:16 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 09:16 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-27 21:06 . 2012-02-27 21:10 -------- d-----w- c:\users\Ondra\AppData\Roaming\avidemux
2012-02-27 20:59 . 2012-03-24 10:35 -------- d-----w- c:\program files (x86)\Avidemux 2.5
2012-02-27 20:53 . 2012-03-24 11:09 -------- d-----w- c:\program files (x86)\FreeTime
2012-02-27 17:28 . 2012-02-27 17:28 -------- d-----w- c:\users\Ondra\AppData\Local\DDMSettings
2012-02-27 16:32 . 2012-02-28 09:48 -------- d-----w- c:\users\Ondra\AppData\Roaming\DivX
2012-02-27 16:30 . 2012-02-27 16:31 -------- d-----w- c:\program files\DivX
2012-02-27 16:29 . 2012-02-27 16:31 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2012-02-27 16:27 . 2012-02-27 16:32 -------- d-----w- c:\program files (x86)\DivX
2012-02-27 16:26 . 2012-02-27 16:32 -------- d-----w- c:\programdata\DivX
2012-02-27 09:47 . 2003-04-16 00:10 110592 ----a-w- c:\windows\SysWow64\tsccvid.dll
2012-02-27 09:47 . 2012-02-27 09:47 -------- d-----w- c:\program files (x86)\CDVPlayer
2012-02-27 09:47 . 2012-02-27 09:47 466944 ------w- c:\windows\Setup1.exe
2012-02-27 09:47 . 2012-02-27 09:47 73216 ----a-w- c:\windows\ST6UNST.EXE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-24 12:45 . 2011-11-01 15:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-07 00:15 . 2011-02-21 11:56 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:15 . 2011-02-21 11:56 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-03-07 00:15 . 2011-02-21 11:56 258520 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-07 00:04 . 2011-05-28 08:09 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:04 . 2011-02-21 11:57 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2012-02-25 00:44 53080 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-03-07 00:01 . 2011-02-21 11:56 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2011-02-21 11:56 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2011-02-21 11:57 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2011-02-21 11:53 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 09:07 . 2012-02-16 23:03 1656 ----a-w- c:\windows\system32\ASOROSet.bin
2012-01-20 13:14 . 2012-02-16 22:25 18816 ----a-w- c:\windows\system32\roboot64.exe
2012-01-04 10:44 . 2012-02-15 09:16 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 09:16 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2012-01-04 00:48 . 2012-01-04 00:48 354176 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2012-01-03 13:10 . 2012-01-03 13:10 53656 ----a-w- c:\windows\system32\AdobePDF.dll
2012-01-03 13:10 . 2012-01-03 13:10 24984 ----a-w- c:\windows\system32\AdobePDFUI.dll
2011-12-30 06:26 . 2012-02-15 09:16 515584 ----a-w- c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 09:16 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 09:16 498688 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-25_20.26.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-03-26 07:32 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-03-25 19:58 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-03-25 19:58 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-26 07:32 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-26 07:32 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-03-25 19:58 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2012-03-25 21:24 43982 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-21 11:28 . 2012-03-25 21:24 10158 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1644185992-1059674713-719569389-1000_UserData.bin
- 2012-03-25 09:40 . 2012-03-25 09:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-25 21:20 . 2012-03-25 21:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-25 21:20 . 2012-03-25 21:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-03-25 09:40 . 2012-03-25 09:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-02-23 11:45 . 2012-03-26 07:32 307508 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
- 2009-07-14 02:36 . 2012-03-25 20:00 619146 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-03-26 07:34 619146 c:\windows\system32\perfh009.dat
- 2010-12-07 22:45 . 2012-03-25 20:00 634780 c:\windows\system32\perfh005.dat
+ 2010-12-07 22:45 . 2012-03-26 07:34 634780 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2012-03-26 07:34 107466 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-03-25 20:00 107466 c:\windows\system32\perfc009.dat
- 2010-12-07 22:45 . 2012-03-25 20:00 123338 c:\windows\system32\perfc005.dat
+ 2010-12-07 22:45 . 2012-03-26 07:34 123338 c:\windows\system32\perfc005.dat
- 2009-07-14 05:01 . 2012-03-25 09:39 489036 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-03-25 21:20 489036 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"="c:\program files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" [2011-06-09 12002664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-13 98304]
"UCam_Menu"="c:\program files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-12-20 634880]
.
c:\users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Auto Backup Guage.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe [2011-10-25 823296]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2011-10-25 65536]
Samsung Auto Backup Scheduler.lnk - c:\program files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe [2011-10-25 102400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 IGRS;IGRS;c:\program files (x86)\Lenovo\ReadyComm\common\IGRS.exe [2009-07-15 38152]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-11-17 575304]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576]
S2 SZASSIST;SecretZone Assist Service;c:\program files (x86)\Clarus\Samsung SecretZone\SZAssistSVC.exe [2011-04-15 90112]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 mdf16;mdf16;c:\program files (x86)\Clarus\Samsung SecretZone\mdf16.sys [2010-08-17 18288]
S3 mvd22;mvd22;c:\program files (x86)\Clarus\Samsung SecretZone\mvd22.sys [2010-08-17 78192]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644185992-1059674713-719569389-1000Core.job
- c:\users\Ondra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 11:53]
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644185992-1059674713-719569389-1000UA.job
- c:\users\Ondra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 11:53]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 135408 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-20 10151968]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-04-20 908320]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TpShocks"="c:\windows\System32\TpShocks.exe" [2010-03-15 231328]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2010-04-12 4462496]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2010-03-18 7056800]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 77.48.65.3 10.90.31.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Celkový čas: 2012-03-26 10:24:00
ComboFix-quarantined-files.txt 2012-03-26 08:23
ComboFix2.txt 2012-03-25 20:36
.
Před spuštěním: Volných bajtů: 159 675 133 952
Po spuštění: Volných bajtů: 159 616 004 096
.
- - End Of File - - 21934F75078472C35D6E5BA002FC4C9D

HiJackThis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:25:08, on 26.3.2012
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe
C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Users\Ondra\Downloads\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" -stealth
O4 - Startup: Samsung Auto Backup Guage.lnk = ?
O4 - Startup: Samsung Auto Backup Real-Time Daemon.lnk = ?
O4 - Startup: Samsung Auto Backup Scheduler.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files (x86)\QIP Infium\infium.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: IGRS - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo ReadyComm AppSvc - Lenovo Group Limited - C:\Program Files\Lenovo\ReadyComm\AppSvc.exe
O23 - Service: Lenovo ReadyComm ConnSvc - Lenovo Group Limited - C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: SecretZone Assist Service (SZASSIST) - Clarus, Inc. - C:\Program Files (x86)\Clarus\Samsung SecretZone\SZAssistSVC.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9006 bytes



ten AVP dodam az se dodela vypada to ze to nejakou hodinku trvat bude (edit: pise to 7 hodin :-/)

Jo to bude dlouho trvat , několik hodin...

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.


Pak sem vlož log z AVP.

Stáhni si CrystalDiskInfo
Spusť program a klikni na Úpravy-Kopírovat. Poté sem vlož pomocí Ctrl+V obsah logu.

Stáhni si Memtest:

Do políčka vlož největší velikost Tvé jednotlivé paměti RAM (256,512 nebo 1024,2048) dej Start , nech nejméně 2h běžet , pokud bude po 2h stále 0 errors , jsou v pořádku.

----------------------------------------------------------------------------
CrystalDiskInfo 4.2.0 (C) 2008-2012 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 7 Home Premium Edition SP1 [6.1 Build 7601] (x64)
Date : 2012/03/26 22:27:03

-- Controller Map ----------------------------------------------------------
+ Standardní řadič AHCI 1.0 s rozhraním Serial ATA [ATA]
+ ATA Channel 0 (0)
- WDC WD5000BEVT-24A0RT0 ATA Device
- ATA Channel 1 (1)

-- Disk List ---------------------------------------------------------------
(1) WDC WD5000BEVT-24A0RT0 : 500.1 GB [0-0-0, pd1]

----------------------------------------------------------------------------
(1) WDC WD5000BEVT-24A0RT0
----------------------------------------------------------------------------
Model : WDC WD5000BEVT-24A0RT0
Firmware : 01.01A02
Serial Number : WD-WXM1E40TA708
Disk Size : 500.1 GB (8.4/137.4/500.1)
Buffer Size : 8192 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : 5400 RPM
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ----
Transfer Mode : SATA/300
Power On Hours : 2874 hod.
Power On Count : 1382 krát
Temparature : 35 C (95 F)
Health Status : Dobrý
Features : S.M.A.R.T., APM, AAM, 48bit LBA, NCQ
APM Level : 0080h [ON]
AAM Level : 80FEh [OFF]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000000004 Počet chyb čtení
03 186 184 _21 0000000006A4 Čas na roztočení ploten
04 _99 _99 __0 00000000056A Počet spuštění/zastavení
05 200 200 140 000000000000 Počet přemapovaných sektorů
07 100 253 __0 000000000000 Počet chybných hledání
09 _97 _97 __0 000000000B3A Hodin v činnosti
0A 100 100 _51 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 __0 000000000000 Počet pokusů o překalibrování
0C _99 _99 __0 000000000566 Počet cyklů zapnutí zařízení
C0 200 200 __0 00000000000D Počet vypnutí disku
C1 190 190 __0 000000007674 Počet cyklů načítání/vymazání
C2 112 _92 __0 000000000023 Teplota
C4 200 200 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000000 Počet podezřelých sektorů
C6 100 253 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 100 253 _51 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 42 7A 3F FF C8 37 00 10 00 00 00 00 00 3F 00 00
010: 00 00 00 00 20 20 20 20 20 57 44 2D 57 58 4D 31
020: 45 34 30 54 41 37 30 38 00 00 40 00 00 32 30 31
030: 2E 30 31 41 30 32 57 44 43 20 57 44 35 30 30 30
040: 42 45 56 54 2D 32 34 41 30 52 54 30 20 20 20 20
050: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 80 10
060: 00 00 2F 00 40 01 00 00 00 00 00 07 3F FF 00 10
070: 00 3F FC 10 00 FB 01 10 FF FF 0F FF 00 00 00 07
080: 00 03 00 78 00 78 00 78 00 78 00 00 00 00 00 00
090: 00 00 00 00 00 00 00 1F 1F 06 00 00 00 4C 00 40
0A0: 01 FE 00 00 74 6B 7F 09 61 63 74 69 BC 09 61 63
0B0: 40 7F 00 43 00 43 00 80 FF FE 00 00 80 FE 00 00
0C0: 00 00 00 00 00 00 00 00 60 30 3A 38 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 50 01 4E E6 AB 57 72 17
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 18
0F0: 40 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 29 00 00 00 00 00 00 00 00 16 D3 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 70 37 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 15 18 00 00 00 00 00 00 00 00 10 1E 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 01 10 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C6 A5

Kaspersky nasel jednu nakazu (trojsky kun) smazal jsem to

Co Memtest?

Stáhni si OTL by OldTimer
na plochu. Ujisti se , že máš zavřena všechna ostatní okna a poklepej na ikonu OTL.Nahoře v okně pod Výstup klikni na minimální výstup.Pod Běžné registry změň na Vše. Zatrhni Kontrola na havěť “LOP“ a Kontrola na havěť “ Purity“ . Klikni na Prohledat. Všechny ostatní nastavení ponech jak jsou. Sken může trvat dlouho, až skončí otevřou se dva logy:
OTL.Txt
Extras.Txt
Jsou uloženy ve stejném místě jako OTL. Oba logy sem prosím zkopíruj.

memtest byl po 2 hodinach bez erroru... stahnu to OLT a pak dam zase vedet :)