Problém s MyStart by IncrediBar.com

[romankrajicek]

Zdravím,
dostal se mi do pc vyhledávač MyStart by IncrediBar.com poprosím o kontrolu logu a rady jak tohle odstranit. Děkuji

Logfile of random's system information tool 1.09 (written by random/random)
Run by Roman at 2012-07-31 12:05:30
Microsoft Windows 7 Ultimate
System drive C: has 11 GB (23%) free of 50 GB
Total RAM: 1920 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:05:46, on 31.7.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Users\Roman\AppData\Local\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Program Files\WIBUKEY\Server\WkSvMgr.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wuauclt.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\Downloads\RSIT.exe
C:\Program Files\trend micro\Roman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: Web Assistant Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll
O2 - BHO: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Google Update] "C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-4046902235-2277129297-1121146792-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-4046902235-2277129297-1121146792-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: WinMySQLadmin.lnk = C:\apache\mysql\bin\winmysqladmin.exe
O4 - Global Startup: GamePark klient 2.lnk = C:\Program Files\GamePark2\gpcl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Network Server.lnk = C:\Program Files\WIBUKEY\Server\WkSvMgr.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://217.112.163.219:8080/program/SonySncRz25View.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: Apache2.2 - Apache Software Foundation - c:\xampp\apache\bin\apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: mysql - Unknown owner - c:\xampp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

--
End of file - 10193 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000UA.job
C:\Windows\tasks\Norton Security Scan for Roman.job
C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default

prefs.js - "browser.startup.homepage" - "http://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26"
prefs.js - "keyword.URL" - "http://mystart.incredibar.com/mb128/?loc=IB_DS&a=6OyJqMVw6C&&i=26&search="

"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\Web Assistant\Firefox


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.5.1]
"Description"=
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
"Description"=6.0.12.69
"Path"=C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\extensions\
OneClickDownload@OneClickDownload.com

C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\searchplugins\
MyStart Search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
Web Assistant - C:\Program Files\Web Assistant\Extension32.dll [2012-06-06 162816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}]
Incredibar.com Helper Object - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll [2012-01-22 261632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-05-04 453504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-05-04 157576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-03-28 1017592]
{F9639E4A-801B-4843-AEE3-03D9DA199E77} - Incredibar Toolbar - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll [2012-01-22 270336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"Flashget"=C:\Program Files\FlashGet\FlashGet.exe /min []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2007-10-19 286720]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-09-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"InstaLAN"=C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [2010-07-28 1485208]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [2012-04-27 3521424]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-17 252296]
"avast!"=C:\Program Files\Alwil Software\Avast4\ashDisp.exe [2008-05-16 79224]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-03-07 3117344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-23 136176]
"Steam"=C:\Program Files\Steam\steam.exe [2011-12-19 1242448]
"KiesHelper"=C:\Program Files\Samsung\Kies\KiesHelper.exe [2012-04-27 955280]
"KiesAirMessage"=C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup []
"KiesPDLR"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-05-25 21416]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
GamePark klient 2.lnk - C:\Program Files\GamePark2\gpcl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
Network Server.lnk - C:\Program Files\WIBUKEY\Server\WkSvMgr.exe

C:\Users\Roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
WinMySQLadmin.lnk - C:\apache\mysql\bin\winmysqladmin.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - "C:\Windows\notepad.exe" "%1"
.scr - install -
.scr - config -
.txt - open - C:\PROGRA~1\PSPADE~1\PSPad.exe "%1"

======List of files/folders created in the last 1 month======

2012-07-31 11:50:06 ----D---- C:\Program Files\ESET
2012-07-31 11:40:28 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2012-07-31 11:40:27 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2012-07-31 11:40:23 ----A---- C:\Windows\system32\AvastSS.scr
2012-07-31 11:40:22 ----A---- C:\Windows\system32\drivers\aswSP.sys
2012-07-31 11:40:22 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2012-07-31 11:40:06 ----A---- C:\Windows\system32\MFC71.dll
2012-07-31 11:40:06 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2012-07-31 11:40:06 ----A---- C:\Windows\system32\aswBoot.exe
2012-07-31 11:40:05 ----D---- C:\Program Files\Alwil Software
2012-07-29 20:39:42 ----D---- C:\Program Files\trend micro
2012-07-29 20:39:41 ----D---- C:\rsit
2012-07-29 19:47:13 ----D---- C:\Program Files\Perion
2012-07-29 19:47:05 ----D---- C:\Program Files\Incredibar.com
2012-07-29 19:47:05 ----A---- C:\user.js
2012-07-29 19:46:37 ----D---- C:\Program Files\Web Assistant
2012-07-29 19:44:49 ----D---- C:\Program Files\1ClickDownload
2012-07-23 15:45:50 ----SHD---- C:\Config.Msi
2012-07-23 15:45:12 ----A---- C:\Windows\system32\win32k.sys
2012-07-22 20:39:07 ----A---- C:\Windows\system32\wmi.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\wintrust.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\imagehlp.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-07-22 20:38:05 ----A---- C:\Windows\system32\wininet.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\urlmon.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msrating.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msls31.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\mshtmler.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msfeedssync.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msfeedsbs.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\jsproxy.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieui.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\iesysprep.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\iertutil.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieframe.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieakeng.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\IEAdvpack.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\wextract.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\webcheck.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\vbscript.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\url.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\pngfilt.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\occache.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshtmled.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshtml.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshta.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\msfeeds.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\licmgr10.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\jscript9.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\jscript.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\inseng.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\imgutil.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iexpress.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieUnatt.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iesetup.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iernonce.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iepeers.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iedkcs32.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieapfltr.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieapfltr.dat
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieakui.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieaksie.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ie4uinit.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\icardie.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\dxtrans.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\dxtmsft.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\admparse.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsRasterService.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsPrint.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\WMVDECOD.DLL
2012-07-22 20:36:47 ----A---- C:\Windows\system32\FntCache.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\ExplorerFrame.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2012-07-22 20:36:47 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2012-07-22 20:36:47 ----A---- C:\Windows\system32\cdd.dll
2012-07-22 20:36:46 ----A---- C:\Windows\system32\mfreadwrite.dll
2012-07-22 20:36:46 ----A---- C:\Windows\system32\mf.dll
2012-07-22 19:24:46 ----A---- C:\Windows\system32\ole32.dll
2012-07-22 19:24:17 ----A---- C:\Windows\system32\drivers\srv.sys
2012-07-22 19:24:16 ----A---- C:\Windows\system32\drivers\srvnet.sys
2012-07-22 19:24:16 ----A---- C:\Windows\system32\drivers\srv2.sys
2012-07-22 19:24:00 ----A---- C:\Windows\system32\drivers\afd.sys
2012-07-22 19:23:45 ----A---- C:\Windows\system32\spoolsv.exe
2012-07-22 19:23:32 ----A---- C:\Windows\system32\ntdll.dll
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnsrslvr.dll
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnscacheugc.exe
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnsapi.dll
2012-07-22 19:23:00 ----A---- C:\Windows\system32\atmlib.dll
2012-07-22 19:23:00 ----A---- C:\Windows\system32\atmfd.dll
2012-07-22 19:22:39 ----A---- C:\Windows\system32\ir32_32.dll
2012-07-22 19:22:39 ----A---- C:\Windows\system32\iccvid.dll
2012-07-22 19:22:22 ----A---- C:\Windows\system32\t2embed.dll
2012-07-22 19:22:05 ----A---- C:\Windows\system32\psisdecd.dll
2012-07-22 19:21:58 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-07-22 19:21:43 ----A---- C:\Windows\system32\tzres.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\wmicmiplugin.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\taskschd.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\schedsvc.dll
2012-07-22 19:21:28 ----A---- C:\Windows\system32\taskeng.exe
2012-07-22 19:21:28 ----A---- C:\Windows\system32\taskcomp.dll
2012-07-22 19:21:28 ----A---- C:\Windows\system32\schtasks.exe
2012-07-22 19:21:12 ----A---- C:\Windows\system32\rtutils.dll
2012-07-22 19:21:06 ----A---- C:\Windows\system32\schannel.dll
2012-07-22 19:21:05 ----A---- C:\Windows\system32\ncrypt.dll
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\cng.sys
2012-07-22 19:20:50 ----A---- C:\Windows\system32\msxml6.dll
2012-07-22 19:20:49 ----A---- C:\Windows\system32\msxml3.dll
2012-07-22 19:20:39 ----A---- C:\Windows\system32\kerberos.dll
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2012-07-22 19:20:15 ----A---- C:\Windows\system32\oleaut32.dll
2012-07-22 19:20:15 ----A---- C:\Windows\system32\oleacc.dll
2012-07-22 19:20:06 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-07-22 19:19:51 ----A---- C:\Windows\system32\odbc32.dll
2012-07-22 19:19:31 ----A---- C:\Windows\system32\drivers\dfsc.sys
2012-07-22 19:17:53 ----A---- C:\Windows\system32\inetcomm.dll
2012-07-22 19:16:46 ----A---- C:\Windows\system32\comctl32.dll
2012-07-22 19:16:37 ----A---- C:\Windows\system32\mfc40u.dll
2012-07-22 19:16:37 ----A---- C:\Windows\system32\mfc40.dll
2012-07-22 19:16:17 ----A---- C:\Windows\system32\wmp.dll
2012-07-22 19:16:16 ----A---- C:\Windows\system32\wmploc.DLL
2012-07-22 19:16:03 ----A---- C:\Windows\system32\umpnpmgr.dll
2012-07-22 19:15:47 ----A---- C:\Windows\system32\packager.dll
2012-07-22 19:14:43 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-07-22 19:14:42 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-07-22 19:14:23 ----A---- C:\Windows\system32\FXSCOVER.exe
2012-07-22 19:14:14 ----A---- C:\Windows\system32\EncDec.dll
2012-07-22 19:14:04 ----A---- C:\Windows\system32\csrsrv.dll
2012-07-22 19:13:57 ----A---- C:\Windows\system32\CPFilters.dll
2012-07-22 19:13:56 ----A---- C:\Windows\system32\sbe.dll
2012-07-22 19:13:40 ----A---- C:\Windows\system32\quartz.dll
2012-07-22 19:13:39 ----A---- C:\Windows\system32\qdvd.dll
2012-07-22 19:08:21 ----A---- C:\Windows\system32\KernelBase.dll
2012-07-22 19:08:21 ----A---- C:\Windows\system32\kernel32.dll
2012-07-22 19:08:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-07-22 19:08:20 ----A---- C:\Windows\system32\winsrv.dll
2012-07-22 19:08:20 ----A---- C:\Windows\system32\conhost.exe
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-07-22 19:07:52 ----A---- C:\Windows\system32\mstscax.dll
2012-07-22 19:07:52 ----A---- C:\Windows\system32\mstsc.exe
2012-07-22 19:07:41 ----A---- C:\Windows\system32\webio.dll
2012-07-22 19:07:41 ----A---- C:\Windows\system32\lsasrv.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\sspisrv.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\sspicli.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\secur32.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\lsass.exe
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbcjt32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccu32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccr32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccp32.dll
2012-07-22 19:07:24 ----A---- C:\Windows\system32\odbctrac.dll
2012-07-22 19:07:15 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-07-22 19:07:14 ----A---- C:\Windows\system32\rdpwsx.dll
2012-07-22 19:07:14 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-07-22 19:07:07 ----A---- C:\Windows\system32\msvcrt.dll
2012-07-22 19:06:59 ----A---- C:\Windows\system32\drivers\partmgr.sys
2012-07-22 19:06:34 ----A---- C:\Windows\system32\srvsvc.dll
2012-07-22 19:05:48 ----A---- C:\Windows\system32\wmpmde.dll
2012-07-22 19:05:40 ----A---- C:\Windows\system32\consent.exe
2012-07-22 19:05:25 ----A---- C:\Windows\system32\d3d10warp.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\DWrite.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d3d10_1core.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d3d10_1.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d2d1.dll
2012-07-22 19:04:51 ----A---- C:\Windows\system32\mfc42u.dll
2012-07-22 19:04:51 ----A---- C:\Windows\system32\mfc42.dll
2012-07-22 19:04:35 ----A---- C:\Windows\system32\drivers\bowser.sys
2012-07-22 19:04:29 ----A---- C:\Windows\system32\StructuredQuery.dll
2012-07-22 19:04:22 ----A---- C:\Windows\system32\shell32.dll
2012-07-22 19:04:16 ----A---- C:\Windows\system32\poqexec.exe
2012-07-22 19:04:11 ----A---- C:\Windows\system32\cryptsvc.dll
2012-07-22 19:04:11 ----A---- C:\Windows\system32\cryptnet.dll
2012-07-22 19:04:11 ----A---- C:\Windows\system32\crypt32.dll
2012-07-22 18:23:45 ----A---- C:\Windows\system32\rdpcore.dll
2012-07-22 18:23:44 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-07-22 18:20:22 ----A---- C:\Windows\system32\wups2.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wucltux.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wuaueng.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wuauclt.exe
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wups.dll
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wudriver.dll
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wuapi.dll
2012-07-22 18:19:50 ----A---- C:\Windows\system32\wuwebv.dll
2012-07-22 18:19:50 ----A---- C:\Windows\system32\wuapp.exe
2012-07-11 21:23:02 ----D---- C:\Users\Roman\AppData\Roaming\Temp

======List of files/folders modified in the last 1 month======

2012-07-31 12:05:34 ----D---- C:\Windows\Temp
2012-07-31 11:57:56 ----D---- C:\Windows\system32\config
2012-07-31 11:54:58 ----D---- C:\Program Files\Steam
2012-07-31 11:51:18 ----SHD---- C:\Windows\Installer
2012-07-31 11:50:50 ----D---- C:\Windows\system32\DriverStore
2012-07-31 11:50:50 ----D---- C:\Windows\system32\drivers
2012-07-31 11:50:50 ----D---- C:\Windows\system32\catroot
2012-07-31 11:50:50 ----D---- C:\Windows\inf
2012-07-31 11:50:06 ----RD---- C:\Program Files
2012-07-31 11:42:24 ----D---- C:\Windows\Prefetch
2012-07-31 11:40:23 ----D---- C:\Windows\System32
2012-07-30 14:05:35 ----D---- C:\Windows\system32\catroot2
2012-07-30 09:22:40 ----SHD---- C:\System Volume Information
2012-07-30 08:32:01 ----D---- C:\Windows
2012-07-29 19:47:09 ----D---- C:\Program Files\Mozilla Firefox
2012-07-28 10:03:28 ----RSD---- C:\Windows\Fonts
2012-07-26 15:30:06 ----D---- C:\Windows\Panther
2012-07-26 15:30:01 ----D---- C:\Windows\Minidump
2012-07-26 15:30:01 ----D---- C:\Windows\Logs
2012-07-26 15:30:01 ----D---- C:\Windows\debug
2012-07-24 10:44:03 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-07-24 10:31:42 ----D---- C:\Windows\winsxs
2012-07-23 19:40:34 ----D---- C:\Windows\rescache
2012-07-23 18:04:01 ----D---- C:\Windows\Microsoft.NET
2012-07-23 18:03:07 ----RSD---- C:\Windows\assembly
2012-07-23 16:35:41 ----D---- C:\Windows\system32\cs-CZ
2012-07-23 16:35:40 ----D---- C:\Windows\ehome
2012-07-23 16:35:40 ----D---- C:\Program Files\Windows Mail
2012-07-23 16:35:40 ----D---- C:\Program Files\Common Files\System
2012-07-23 16:35:38 ----D---- C:\Program Files\Windows Journal
2012-07-23 16:35:37 ----D---- C:\Program Files\Windows Media Player
2012-07-22 20:40:26 ----D---- C:\Program Files\Internet Explorer
2012-07-22 20:40:25 ----D---- C:\Windows\system32\migration
2012-07-22 20:40:25 ----D---- C:\Windows\system32\en-US
2012-07-22 20:40:25 ----D---- C:\Windows\PolicyDefinitions
2012-07-03 03:13:34 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-08-13 691696]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2008-05-16 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2008-05-16 78416]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2008-05-16 42912]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-03-14 169080]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-03-14 120152]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 50768]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-12-30 83872]
R2 CdaC15BA;CdaC15BA; \??\C:\Windows\system32\drivers\CDAC15BA.SYS [2010-09-13 12464]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 103112]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-08-13 25888]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\Windows\SYSTEM32\DRIVERS\WibuKey.sys [2006-11-22 72704]
R3 NVNET;NVIDIA nForce 10/100 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmf6232.sys [2010-03-04 296936]
S3 a9l6rrj7;a9l6rrj7; C:\Windows\system32\drivers\a9l6rrj7.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2010-12-21 30312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-14 347264]
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-06-02 114280]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AffinegyService;AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [2010-07-28 569752]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-05-16 17272]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-05-16 144760]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\Windows\system32\drivers\CDAC11BA.EXE [2010-09-13 54784]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-03-07 913144]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-03-28 246520]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-12-15 75064]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2011-04-09 214520]
R2 Web Assistant Updater;Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [2012-06-06 185856]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-05-16 247160]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-05-16 349560]
R3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-06-19 529232]
S2 Apache2.2;Apache2.2; c:\xampp\apache\bin\apache.exe [2008-01-18 24635]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 mysql;mysql; c:\xampp\mysql\bin\mysqld-nt.exe --defaults-file=c:\xampp\mysql\bin\my.cnf mysql []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe []
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-05-10 136120]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-08-02 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Reklama]

[Žbeky]

Odinstaluj DAEMON Tools Toolbar, ICQToolBar a Incredibar Toolbar

Máš ESET i Avast. Jeden z toho musíš odinstalovat

Stáhni si HJT a fixni:

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-4046902235-2277129297-1121146792-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: GamePark klient 2.lnk = C:\Program Files\GamePark2\gpcl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://217.112.163.219:8080/program/SonySncRz25View.cab

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
- Pokud používáš Firefox, klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Chrome, nic dalšího nevybírej a dej Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(ZATÍM SÁM NIC NEMAŽ!).
Vlož sem pak obsah toho logu.

[romankrajicek]

Tak vše uděláno podle návodu, posílám tedy log. Děkuji moc.

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.62.0.1300
www.malwarebytes.org

Verze databáze: v2012.07.31.10

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Roman :: ROMAN-PC [administrátor]

Ochrana: Povolena

31.7.2012 18:05:42
mbam-log-2012-07-31 (18-11-54).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 203172
Uplynulý čas: 5 minut, 11 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKCU\SOFTWARE\10DPP6O2VE (Trojan.FakeAlert) -> Žádná instrukce nebyla provedena.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Žádná instrukce nebyla provedena.

(konec)

[memphisto]

Znovu spusť MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

[romankrajicek]

Tak log MbAM:
Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.62.0.1300
www.malwarebytes.org

Verze databáze: v2012.07.31.10

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Roman :: ROMAN-PC [administrátor]

Ochrana: Povolena

31.7.2012 18:48:44
mbam-log-2012-07-31 (18-48-44).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 203069
Uplynulý čas: 3 minut, 57 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKCU\SOFTWARE\10DPP6O2VE (Trojan.FakeAlert) -> Umístnění do karantény a smazání se zdařilo.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Umístnění do karantény a smazání se zdařilo.

(konec)

Log ComboFix:

ComboFix 12-07-30.03 - Roman 31.07.2012 18:58:24.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1920.1149 [GMT 2:00]
Spuštěný z: c:\users\Roman\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Incredibar.com
c:\program files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll
c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarApp.dll
c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarEng.dll
c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarsrv.exe
c:\program files\Incredibar.com\incredibar\1.5.11.14\inCRedibartlbr.dll
c:\program files\Incredibar.com\incredibar\1.5.11.14\uninstall.exe
c:\program files\Web Assistant\ExTEnsion32.dll
c:\users\Roman\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\users\Roman\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-28 do 2012-07-31 )))))))))))))))))))))))))))))))
.
.
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\users\Roman\AppData\Roaming\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\programdata\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-31 16:04 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 09:40 . 2008-05-15 23:15 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-31 09:40 . 2008-05-15 23:14 42912 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-31 09:40 . 2008-05-15 23:12 95608 ----a-w- c:\windows\system32\AvastSS.scr
2012-07-31 09:40 . 2008-05-15 23:20 78416 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-31 09:40 . 2008-05-15 23:16 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-31 09:40 . 2008-05-15 23:24 1152888 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-31 09:40 . 2008-05-15 23:18 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-31 09:40 . 2004-01-09 09:13 380928 ----a-w- c:\windows\system32\actskin4.ocx
2012-07-31 09:40 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2012-07-31 09:40 . 2012-07-31 09:40 -------- d-----w- c:\program files\Alwil Software
2012-07-29 18:39 . 2012-07-31 10:05 -------- d-----w- c:\program files\trend micro
2012-07-29 18:39 . 2012-07-29 18:40 -------- d-----w- C:\rsit
2012-07-29 17:47 . 2012-07-29 17:47 -------- d-----w- c:\program files\Perion
2012-07-29 17:47 . 2012-07-29 17:47 842 ----a-w- C:\user.js
2012-07-29 17:46 . 2012-07-31 17:20 -------- d-----w- c:\program files\Web Assistant
2012-07-29 17:44 . 2012-07-29 17:45 -------- d-----w- c:\program files\1ClickDownload
2012-07-23 13:45 . 2012-06-12 02:44 2344448 ----a-w- c:\windows\system32\win32k.sys
2012-07-22 18:39 . 2012-03-01 05:53 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-22 18:39 . 2012-03-01 05:49 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-07-22 18:39 . 2012-03-01 05:45 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-22 18:39 . 2012-03-01 05:40 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-22 18:36 . 2012-07-22 18:36 801792 ----a-w- c:\windows\system32\FntCache.dll
2012-07-22 18:36 . 2012-07-22 18:36 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-07-22 18:36 . 2012-07-22 18:36 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-07-22 18:36 . 2012-07-22 18:36 283648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-07-22 18:36 . 2012-07-22 18:36 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-07-22 18:36 . 2012-07-22 18:36 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2012-07-22 18:36 . 2012-07-22 18:36 1495040 ----a-w- c:\windows\system32\ExplorerFrame.dll
2012-07-22 18:36 . 2012-07-22 18:36 135168 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-07-22 18:36 . 2012-07-22 18:36 107520 ----a-w- c:\windows\system32\cdd.dll
2012-07-22 18:36 . 2012-07-22 18:36 3181568 ----a-w- c:\windows\system32\mf.dll
2012-07-22 18:36 . 2012-07-22 18:36 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-07-22 17:24 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2012-07-22 17:24 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2012-07-22 17:24 . 2011-04-29 02:57 311296 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-22 17:24 . 2011-04-29 02:57 309760 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-07-22 17:24 . 2011-04-29 02:57 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-22 17:24 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-07-22 17:23 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2012-07-22 17:23 . 2011-11-17 05:41 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-07-22 17:23 . 2011-03-03 05:29 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2012-07-22 17:23 . 2011-03-03 05:27 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2012-07-22 17:23 . 2011-02-19 05:32 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-07-22 17:23 . 2011-02-19 03:37 294912 ----a-w- c:\windows\system32\atmfd.dll
2012-07-22 17:22 . 2011-10-01 04:43 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-07-22 17:22 . 2010-07-29 06:30 197632 ----a-w- c:\windows\system32\ir32_32.dll
2012-07-22 17:22 . 2010-07-29 06:30 82944 ----a-w- c:\windows\system32\iccvid.dll
2012-07-22 17:22 . 2010-08-26 04:39 109056 ----a-w- c:\windows\system32\t2embed.dll
2012-07-22 17:22 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2012-07-22 17:22 . 2011-08-17 04:22 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-07-22 17:22 . 2011-08-17 04:26 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-07-22 17:22 . 2011-08-17 04:22 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-07-22 17:22 . 2011-08-17 04:22 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-07-22 17:22 . 2011-08-17 04:22 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-07-22 17:20 . 2012-06-06 05:09 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-07-22 17:20 . 2012-06-06 05:09 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-22 17:20 . 2010-12-18 05:29 541184 ----a-w- c:\windows\system32\kerberos.dll
2012-07-22 17:20 . 2011-07-09 02:26 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-07-22 17:20 . 2011-05-04 02:43 96256 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-07-22 17:20 . 2011-05-04 02:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-07-22 17:20 . 2011-08-27 04:43 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-07-22 17:20 . 2011-08-27 04:43 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-07-22 17:20 . 2012-03-30 10:29 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-07-22 17:19 . 2010-10-16 04:34 573440 ----a-w- c:\windows\system32\odbc32.dll
2012-07-22 17:19 . 2010-10-16 04:33 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-22 17:19 . 2010-10-16 04:33 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-22 17:19 . 2010-10-16 04:33 208896 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-22 17:19 . 2012-04-02 04:40 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-07-22 17:19 . 2012-04-02 04:41 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-07-22 17:19 . 2012-04-02 04:40 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-07-22 17:19 . 2012-04-02 04:40 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-07-22 17:19 . 2011-04-27 02:33 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-07-22 17:17 . 2011-05-03 04:50 740864 ----a-w- c:\windows\system32\inetcomm.dll
2012-07-22 17:16 . 2010-08-21 05:33 530432 ----a-w- c:\windows\system32\comctl32.dll
2012-07-22 17:16 . 2010-08-31 04:32 954752 ----a-w- c:\windows\system32\mfc40.dll
2012-07-22 17:16 . 2010-08-31 04:32 954288 ----a-w- c:\windows\system32\mfc40u.dll
2012-07-22 17:16 . 2010-09-01 04:26 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2012-07-22 17:16 . 2010-09-01 04:23 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2012-07-22 17:16 . 2011-05-24 10:35 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-07-22 17:15 . 2011-11-19 14:06 67072 ----a-w- c:\windows\system32\packager.dll
2012-07-22 17:15 . 2012-06-06 05:09 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-22 17:14 . 2012-04-02 04:46 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-07-22 17:14 . 2012-04-02 04:46 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-22 17:14 . 2011-02-12 05:30 191488 ----a-w- c:\windows\system32\FXSCOVER.exe
2012-07-22 17:14 . 2011-10-15 05:48 534528 ----a-w- c:\windows\system32\EncDec.dll
2012-07-22 17:14 . 2011-10-26 04:25 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-07-22 17:13 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
2012-07-22 17:13 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
2012-07-22 17:13 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2012-07-22 17:13 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-07-22 17:13 . 2011-10-26 04:28 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-07-22 17:07 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
2012-07-22 17:06 . 2012-03-17 07:20 56688 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-07-22 17:06 . 2010-08-27 05:46 168448 ----a-w- c:\windows\system32\srvsvc.dll
2012-07-22 17:05 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2012-07-22 17:05 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2012-07-22 17:05 . 2012-03-03 05:40 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-07-22 17:05 . 2012-03-03 05:40 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-07-22 17:05 . 2012-03-03 05:40 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-07-22 17:05 . 2012-03-03 05:40 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-07-22 17:05 . 2012-03-03 05:40 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-07-22 17:04 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2012-07-22 17:04 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\system32\mfc42.dll
2012-07-22 17:04 . 2011-02-23 05:05 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-07-22 17:04 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-07-22 17:04 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2012-07-22 17:04 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-07-22 17:04 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-07-22 17:04 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-07-22 16:23 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-07-22 16:23 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-07-22 16:20 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-22 16:20 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-22 16:20 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-22 16:20 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-22 16:20 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-22 16:20 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-07-22 16:20 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-07-22 16:19 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-07-22 16:19 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-07-22 15:33 . 2012-07-16 00:41 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5872CA2C-8583-42CB-9E66-21E0B1D1D8F8}\mpengine.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 04:48 . 2012-07-22 17:21 225280 ----a-w- c:\windows\system32\schannel.dll
2012-05-24 21:18 . 2012-05-24 21:18 4472832 ----a-w- c:\windows\system32\GPhotos.scr
2012-05-04 17:29 . 2012-06-21 07:02 772504 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-05-04 17:29 . 2010-07-19 06:43 687504 ----a-w- c:\windows\system32\deployJava1.dll
2005-12-05 16:00 . 2005-12-05 16:00 74448 ------w- c:\program files\DSETUP.dll
2005-12-05 16:00 . 2005-12-05 16:00 484560 ------w- c:\program files\DXSETUP.exe
2005-12-05 16:00 . 2005-12-05 16:00 2247888 ------w- c:\program files\dsetup32.dll
2011-12-21 07:39 . 2012-01-31 09:22 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-11-06 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2011-12-19 1242448]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-25 21416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-19 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-07-28 1485208]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-04-27 3521424]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2008-05-15 79224]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
WinMySQLadmin.lnk - c:\apache\mysql\bin\winmysqladmin.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Network Server.lnk - c:\program files\WIBUKEY\Server\WkSvMgr.exe [2011-8-27 3768320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [x]
S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000Core.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-23 10:58]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000UA.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-23 10:58]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb128/?lo ... 26&search=
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyJqMVw6C
FF - user.js: extensions.incredibar_i.upn2n - 92261840006464338
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyJqM ... 26&search=
FF - user.js: extensions.incredibar_i.id - e05f6d32000000000000001d7d52447c
FF - user.js: extensions.incredibar_i.instlDay - 15550
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1419:47
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
HKLM-Run-Flashget - c:\program files\FlashGet\FlashGet.exe
AddRemove-BH - RT - d:\hry\BLITZK~1\BH-RT~1\UNINST~1\UNWISE.EXE
AddRemove-Blitzkrieg - d:\hry\BLITZK~1\UNINST~1\UNWISE.EXE
AddRemove-Call of Duty: Black Ops_is1 - d:\hry\CoD BO\Call of Duty - Black Ops\unins000.exe
AddRemove-CdaC13Ba - c:\program files\Common Files\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE
AddRemove-CoD 2 čeština_is1 - d:\hry\Call of Duty 2\main\unins000.exe
AddRemove-ffdshow_is1 - c:\program files\Magic Video Converter\codec\ffdshow\unins000.exe
AddRemove-FlashGet - c:\program files\FlashGet\uninst.exe
AddRemove-Football Manager 2010 - d:\hry\FM 2010\Uninstall_Football Manager 2010\Uninstall Football Manager 2010.exe
AddRemove-GameParkClient_is1 - d:\hry\Call of Duty 2\GamePark\unins000.exe
AddRemove-GameSpy Arcade - c:\progra~1\GAMESP~1\UNWISE.EXE
AddRemove-incredibar - c:\program files\Incredibar.com\incredibar\1.5.11.14\uninstall.exe
AddRemove-InstallShield_{8E1CCF20-9E12-4824-BD59-7AD9E0486DD8} - c:\progra~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
AddRemove-Magic Video Converter_is1 - c:\program files\Magic Video Converter\unins000.exe
AddRemove-NSS - c:\progra~1\NORTON~2\Engine\351~1.8\InstWrap.exe
AddRemove-RAR Password Cracker - c:\program files\RAR Password Cracker\uninstall.exe
AddRemove-RealAlt_is1 - c:\program files\Magic Video Converter\codec\real\unins000.exe
AddRemove-SiteMap Generator_is1 - c:\program files\SiteMap Generator\unins000.exe
AddRemove-Sudden Strike 3 - d:\hry\Sudden\Sudden Strike 3\uninstall.exe
AddRemove-Sudden Strike 3 Demo - c:\program files\Sudden Strike 3 Demo\uninst.exe
AddRemove-{52E5D8A7-B129-4A29-AD4B-EBB749DCC3A3}_is1 - c:\program files\GamePark2\unins000.exe
AddRemove-{C13E90B0-4E1C-11DB-6784-0152EAA218BE} - d:\hry\Call of Duty 2\Uninst_Call of Duty(R) 2 Patch 1.3.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4046902235-2277129297-1121146792-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:49,69,e9,7c,c1,42,7d,e4,30,b6,9c,fa,d4,0f,de,1e,58,39,7f,ff,60,27,da,
93,96,d7,b1,f7,00,51,6f,d9,73,ee,14,b5,41,71,2c,6e,a4,f0,b5,58,c7,ce,9f,51,\
"??"=hex:5c,37,23,9a,71,63,97,8e,e3,66,c1,b6,ba,3a,82,fe
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\AUDIODG.EXE
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\taskhost.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-07-31 19:26:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-07-31 17:26
.
Před spuštěním: Volných bajtů: 12 429 082 624
Po spuštění: Volných bajtů: 12 169 125 888
.
- - End Of File - - 9878B4BB3153E93D18497F77B097798B


Budu u PC až tak v neděli tak pokud neodpovím je to tím. Děkuji moc.

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::

File::
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000Core.job
c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000UA.job

DDS::
uStart Page = hxxp://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
uInternet Settings,ProxyOverride = *.local

Firefox::
FF - ProfilePath - c:\users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredibar.com/mb128?a=6OyJqMVw6C&i=26
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb128/?lo ... 26&search=
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyJqMVw6C
FF - user.js: extensions.incredibar_i.upn2n - 92261840006464338
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10658
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyJqM ... 26&search=
FF - user.js: extensions.incredibar_i.id - e05f6d32000000000000001d7d52447c
FF - user.js: extensions.incredibar_i.instlDay - 15550
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1419:47
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\actskin4.ocx

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[romankrajicek]

Zdravím,
virustotal: https://www.virustotal.com/file/f05e0b9 ... 344093137/

ComboFix:

ComboFix 12-07-30.03 - Roman 04.08.2012 16:55:45.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1920.1107 [GMT 2:00]
Spuštěný z: c:\users\Roman\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe
c:\users\Roman\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\users\Roman\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\muzapp.exe
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4046902235-2277129297-1121146792-1000UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-07-04 do 2012-08-04 )))))))))))))))))))))))))))))))
.
.
2012-08-04 15:03 . 2012-08-04 15:03 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-08-04 15:03 . 2012-08-04 15:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-31 16:59 . 2012-08-04 15:03 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5872CA2C-8583-42CB-9E66-21E0B1D1D8F8}\offreg.dll
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\users\Roman\AppData\Roaming\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\programdata\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-31 16:04 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 09:40 . 2008-05-15 23:15 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-31 09:40 . 2008-05-15 23:14 42912 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-31 09:40 . 2008-05-15 23:12 95608 ----a-w- c:\windows\system32\AvastSS.scr
2012-07-31 09:40 . 2008-05-15 23:20 78416 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-31 09:40 . 2008-05-15 23:16 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-31 09:40 . 2008-05-15 23:24 1152888 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-31 09:40 . 2008-05-15 23:18 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-31 09:40 . 2004-01-09 09:13 380928 ----a-w- c:\windows\system32\actskin4.ocx
2012-07-31 09:40 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2012-07-31 09:40 . 2012-07-31 09:40 -------- d-----w- c:\program files\Alwil Software
2012-07-29 18:39 . 2012-07-31 10:05 -------- d-----w- c:\program files\trend micro
2012-07-29 18:39 . 2012-07-29 18:40 -------- d-----w- C:\rsit
2012-07-29 17:47 . 2012-07-29 17:47 -------- d-----w- c:\program files\Perion
2012-07-29 17:47 . 2012-07-29 17:47 842 ----a-w- C:\user.js
2012-07-29 17:46 . 2012-07-31 17:20 -------- d-----w- c:\program files\Web Assistant
2012-07-29 17:44 . 2012-07-29 17:45 -------- d-----w- c:\program files\1ClickDownload
2012-07-23 13:45 . 2012-06-12 02:44 2344448 ----a-w- c:\windows\system32\win32k.sys
2012-07-22 18:39 . 2012-03-01 05:53 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-22 18:39 . 2012-03-01 05:49 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-07-22 18:39 . 2012-03-01 05:45 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-22 18:39 . 2012-03-01 05:40 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-22 18:36 . 2012-07-22 18:36 801792 ----a-w- c:\windows\system32\FntCache.dll
2012-07-22 18:36 . 2012-07-22 18:36 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-07-22 18:36 . 2012-07-22 18:36 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-07-22 18:36 . 2012-07-22 18:36 283648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-07-22 18:36 . 2012-07-22 18:36 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-07-22 18:36 . 2012-07-22 18:36 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2012-07-22 18:36 . 2012-07-22 18:36 1495040 ----a-w- c:\windows\system32\ExplorerFrame.dll
2012-07-22 18:36 . 2012-07-22 18:36 135168 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-07-22 18:36 . 2012-07-22 18:36 107520 ----a-w- c:\windows\system32\cdd.dll
2012-07-22 18:36 . 2012-07-22 18:36 3181568 ----a-w- c:\windows\system32\mf.dll
2012-07-22 18:36 . 2012-07-22 18:36 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-07-22 17:24 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2012-07-22 17:24 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2012-07-22 17:24 . 2011-04-29 02:57 311296 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-22 17:24 . 2011-04-29 02:57 309760 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-07-22 17:24 . 2011-04-29 02:57 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-22 17:24 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-07-22 17:23 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2012-07-22 17:23 . 2011-11-17 05:41 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-07-22 17:23 . 2011-03-03 05:29 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2012-07-22 17:23 . 2011-03-03 05:27 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2012-07-22 17:23 . 2011-02-19 05:32 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-07-22 17:23 . 2011-02-19 03:37 294912 ----a-w- c:\windows\system32\atmfd.dll
2012-07-22 17:22 . 2011-10-01 04:43 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-07-22 17:22 . 2010-07-29 06:30 197632 ----a-w- c:\windows\system32\ir32_32.dll
2012-07-22 17:22 . 2010-07-29 06:30 82944 ----a-w- c:\windows\system32\iccvid.dll
2012-07-22 17:22 . 2010-08-26 04:39 109056 ----a-w- c:\windows\system32\t2embed.dll
2012-07-22 17:22 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2012-07-22 17:22 . 2011-08-17 04:22 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-07-22 17:22 . 2011-08-17 04:26 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-07-22 17:22 . 2011-08-17 04:22 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-07-22 17:22 . 2011-08-17 04:22 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-07-22 17:22 . 2011-08-17 04:22 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-07-22 17:20 . 2012-06-06 05:09 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-07-22 17:20 . 2012-06-06 05:09 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-22 17:20 . 2010-12-18 05:29 541184 ----a-w- c:\windows\system32\kerberos.dll
2012-07-22 17:20 . 2011-07-09 02:26 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-07-22 17:20 . 2011-05-04 02:43 96256 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-07-22 17:20 . 2011-05-04 02:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-07-22 17:20 . 2011-08-27 04:43 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-07-22 17:20 . 2011-08-27 04:43 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-07-22 17:20 . 2012-03-30 10:29 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-07-22 17:19 . 2010-10-16 04:34 573440 ----a-w- c:\windows\system32\odbc32.dll
2012-07-22 17:19 . 2010-10-16 04:33 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-22 17:19 . 2010-10-16 04:33 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-22 17:19 . 2010-10-16 04:33 208896 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-22 17:19 . 2012-04-02 04:40 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-07-22 17:19 . 2012-04-02 04:41 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-07-22 17:19 . 2012-04-02 04:40 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-07-22 17:19 . 2012-04-02 04:40 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-07-22 17:19 . 2011-04-27 02:33 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-07-22 17:17 . 2011-05-03 04:50 740864 ----a-w- c:\windows\system32\inetcomm.dll
2012-07-22 17:16 . 2010-08-21 05:33 530432 ----a-w- c:\windows\system32\comctl32.dll
2012-07-22 17:16 . 2010-08-31 04:32 954752 ----a-w- c:\windows\system32\mfc40.dll
2012-07-22 17:16 . 2010-08-31 04:32 954288 ----a-w- c:\windows\system32\mfc40u.dll
2012-07-22 17:16 . 2010-09-01 04:26 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2012-07-22 17:16 . 2010-09-01 04:23 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2012-07-22 17:16 . 2011-05-24 10:35 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-07-22 17:15 . 2011-11-19 14:06 67072 ----a-w- c:\windows\system32\packager.dll
2012-07-22 17:15 . 2012-06-06 05:09 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-22 17:14 . 2012-04-02 04:46 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-07-22 17:14 . 2012-04-02 04:46 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-22 17:14 . 2011-02-12 05:30 191488 ----a-w- c:\windows\system32\FXSCOVER.exe
2012-07-22 17:14 . 2011-10-15 05:48 534528 ----a-w- c:\windows\system32\EncDec.dll
2012-07-22 17:14 . 2011-10-26 04:25 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-07-22 17:13 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
2012-07-22 17:13 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
2012-07-22 17:13 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2012-07-22 17:13 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-07-22 17:13 . 2011-10-26 04:28 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-07-22 17:07 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
2012-07-22 17:06 . 2012-03-17 07:20 56688 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-07-22 17:06 . 2010-08-27 05:46 168448 ----a-w- c:\windows\system32\srvsvc.dll
2012-07-22 17:05 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2012-07-22 17:05 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2012-07-22 17:05 . 2012-03-03 05:40 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-07-22 17:05 . 2012-03-03 05:40 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-07-22 17:05 . 2012-03-03 05:40 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-07-22 17:05 . 2012-03-03 05:40 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-07-22 17:05 . 2012-03-03 05:40 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-07-22 17:04 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2012-07-22 17:04 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\system32\mfc42.dll
2012-07-22 17:04 . 2011-02-23 05:05 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-07-22 17:04 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-07-22 17:04 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2012-07-22 17:04 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-07-22 17:04 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-07-22 17:04 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-07-22 16:23 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-07-22 16:23 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-07-22 16:20 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-22 16:20 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-22 16:20 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-22 16:20 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-22 16:20 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-22 16:20 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-07-22 16:20 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 04:48 . 2012-07-22 17:21 225280 ----a-w- c:\windows\system32\schannel.dll
2012-05-24 21:18 . 2012-05-24 21:18 4472832 ----a-w- c:\windows\system32\GPhotos.scr
2005-12-05 16:00 . 2005-12-05 16:00 74448 ------w- c:\program files\DSETUP.dll
2005-12-05 16:00 . 2005-12-05 16:00 484560 ------w- c:\program files\DXSETUP.exe
2005-12-05 16:00 . 2005-12-05 16:00 2247888 ------w- c:\program files\dsetup32.dll
2011-12-21 07:39 . 2012-01-31 09:22 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-11-06 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2012-08-04 1353080]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-25 21416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-19 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-07-28 1485208]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-04-27 3521424]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2008-05-15 79224]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
WinMySQLadmin.lnk - c:\apache\mysql\bin\winmysqladmin.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Network Server.lnk - c:\program files\WIBUKEY\Server\WkSvMgr.exe [2011-8-27 3768320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [x]
S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4046902235-2277129297-1121146792-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:49,69,e9,7c,c1,42,7d,e4,30,b6,9c,fa,d4,0f,de,1e,58,39,7f,ff,60,27,da,
93,96,d7,b1,f7,00,51,6f,d9,73,ee,14,b5,41,71,2c,6e,a4,f0,b5,58,c7,ce,9f,51,\
"??"=hex:5c,37,23,9a,71,63,97,8e,e3,66,c1,b6,ba,3a,82,fe
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\AUDIODG.EXE
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\taskhost.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-08-04 17:08:48 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-08-04 15:08
ComboFix2.txt 2012-07-31 17:26
.
Před spuštěním: Volných bajtů: 12 584 513 536
Po spuštění: Volných bajtů: 12 368 117 760
.
- - End Of File - - FB796A2F417FA4A9FFC9A90F41AAF6ED

[romankrajicek]

A ještě HJT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Roman at 2012-08-04 17:16:42
Microsoft Windows 7 Ultimate
System drive C: has 12 GB (24%) free of 50 GB
Total RAM: 1920 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:16:59, on 4.8.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\Downloads\RSIT.exe
C:\Program Files\trend micro\Roman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-21-4046902235-2277129297-1121146792-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-4046902235-2277129297-1121146792-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: WinMySQLadmin.lnk = C:\apache\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Network Server.lnk = C:\Program Files\WIBUKEY\Server\WkSvMgr.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://217.112.163.219:8080/program/SonySncRz25View.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: Apache2.2 - Apache Software Foundation - c:\xampp\apache\bin\apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mysql - Unknown owner - c:\xampp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

--
End of file - 7652 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default

"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\Web Assistant\Firefox


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.5.1]
"Description"=
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
"Description"=6.0.12.69
"Path"=C:\Program Files\Magic Video Converter\codec\real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\extensions\
OneClickDownload@OneClickDownload.com

C:\Users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\searchplugins\
MyStart Search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-05-04 453504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-05-04 157576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-03-28 1017592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2007-10-19 286720]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-09-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"InstaLAN"=C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [2010-07-28 1485208]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [2012-04-27 3521424]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-17 252296]
"avast!"=C:\Program Files\Alwil Software\Avast4\ashDisp.exe [2008-05-16 79224]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-07-03 462920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files\Steam\steam.exe [2012-08-04 1353080]
"KiesPDLR"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-05-25 21416]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Network Server.lnk - C:\Program Files\WIBUKEY\Server\WkSvMgr.exe

C:\Users\Roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
WinMySQLadmin.lnk - C:\apache\mysql\bin\winmysqladmin.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2012-07-22 203776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - "C:\Windows\notepad.exe" "%1"
.scr - install -
.scr - config -
.txt - open - C:\PROGRA~1\PSPADE~1\PSPad.exe "%1"

======List of files/folders created in the last 1 month======

2012-08-04 17:08:49 ----A---- C:\ComboFix.txt
2012-08-04 17:05:26 ----D---- C:\$RECYCLE.BIN
2012-08-04 16:49:04 ----D---- C:\ComboFix
2012-07-31 18:56:07 ----A---- C:\Windows\zip.exe
2012-07-31 18:56:07 ----A---- C:\Windows\SWSC.exe
2012-07-31 18:56:07 ----A---- C:\Windows\SWREG.exe
2012-07-31 18:56:07 ----A---- C:\Windows\sed.exe
2012-07-31 18:56:07 ----A---- C:\Windows\PEV.exe
2012-07-31 18:56:07 ----A---- C:\Windows\NIRCMD.exe
2012-07-31 18:56:07 ----A---- C:\Windows\MBR.exe
2012-07-31 18:56:07 ----A---- C:\Windows\grep.exe
2012-07-31 18:55:56 ----D---- C:\Qoobox
2012-07-31 18:55:41 ----D---- C:\Windows\erdnt
2012-07-31 18:04:37 ----D---- C:\Users\Roman\AppData\Roaming\Malwarebytes
2012-07-31 18:04:17 ----D---- C:\ProgramData\Malwarebytes
2012-07-31 18:04:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-07-31 18:04:14 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-07-31 11:40:28 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2012-07-31 11:40:27 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2012-07-31 11:40:23 ----A---- C:\Windows\system32\AvastSS.scr
2012-07-31 11:40:22 ----A---- C:\Windows\system32\drivers\aswSP.sys
2012-07-31 11:40:22 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2012-07-31 11:40:06 ----A---- C:\Windows\system32\MFC71.dll
2012-07-31 11:40:06 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2012-07-31 11:40:06 ----A---- C:\Windows\system32\aswBoot.exe
2012-07-31 11:40:05 ----D---- C:\Program Files\Alwil Software
2012-07-29 20:39:42 ----D---- C:\Program Files\trend micro
2012-07-29 20:39:41 ----D---- C:\rsit
2012-07-29 19:47:13 ----D---- C:\Program Files\Perion
2012-07-29 19:47:05 ----A---- C:\user.js
2012-07-29 19:46:37 ----D---- C:\Program Files\Web Assistant
2012-07-29 19:44:49 ----D---- C:\Program Files\1ClickDownload
2012-07-23 15:45:12 ----A---- C:\Windows\system32\win32k.sys
2012-07-22 20:39:07 ----A---- C:\Windows\system32\wmi.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\wintrust.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\imagehlp.dll
2012-07-22 20:39:07 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-07-22 20:38:05 ----A---- C:\Windows\system32\wininet.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\urlmon.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msrating.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msls31.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\mshtmler.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msfeedssync.exe
2012-07-22 20:38:05 ----A---- C:\Windows\system32\msfeedsbs.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\jsproxy.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieui.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\iesysprep.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\iertutil.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieframe.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\ieakeng.dll
2012-07-22 20:38:05 ----A---- C:\Windows\system32\IEAdvpack.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\wextract.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\webcheck.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\vbscript.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\url.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\pngfilt.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\occache.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshtmled.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshtml.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\mshta.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\msfeeds.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\licmgr10.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\jscript9.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\jscript.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\inseng.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\imgutil.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iexpress.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieUnatt.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iesetup.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iernonce.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iepeers.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\iedkcs32.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieapfltr.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieapfltr.dat
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieakui.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ieaksie.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\ie4uinit.exe
2012-07-22 20:38:04 ----A---- C:\Windows\system32\icardie.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\dxtrans.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\dxtmsft.dll
2012-07-22 20:38:04 ----A---- C:\Windows\system32\admparse.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsRasterService.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsPrint.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\WMVDECOD.DLL
2012-07-22 20:36:47 ----A---- C:\Windows\system32\FntCache.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\ExplorerFrame.dll
2012-07-22 20:36:47 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2012-07-22 20:36:47 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2012-07-22 20:36:47 ----A---- C:\Windows\system32\cdd.dll
2012-07-22 20:36:46 ----A---- C:\Windows\system32\mfreadwrite.dll
2012-07-22 20:36:46 ----A---- C:\Windows\system32\mf.dll
2012-07-22 19:24:46 ----A---- C:\Windows\system32\ole32.dll
2012-07-22 19:24:17 ----A---- C:\Windows\system32\drivers\srv.sys
2012-07-22 19:24:16 ----A---- C:\Windows\system32\drivers\srvnet.sys
2012-07-22 19:24:16 ----A---- C:\Windows\system32\drivers\srv2.sys
2012-07-22 19:24:00 ----A---- C:\Windows\system32\drivers\afd.sys
2012-07-22 19:23:45 ----A---- C:\Windows\system32\spoolsv.exe
2012-07-22 19:23:32 ----A---- C:\Windows\system32\ntdll.dll
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnsrslvr.dll
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnscacheugc.exe
2012-07-22 19:23:08 ----A---- C:\Windows\system32\dnsapi.dll
2012-07-22 19:23:00 ----A---- C:\Windows\system32\atmlib.dll
2012-07-22 19:23:00 ----A---- C:\Windows\system32\atmfd.dll
2012-07-22 19:22:39 ----A---- C:\Windows\system32\ir32_32.dll
2012-07-22 19:22:39 ----A---- C:\Windows\system32\iccvid.dll
2012-07-22 19:22:22 ----A---- C:\Windows\system32\t2embed.dll
2012-07-22 19:22:05 ----A---- C:\Windows\system32\psisdecd.dll
2012-07-22 19:21:58 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-07-22 19:21:43 ----A---- C:\Windows\system32\tzres.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\wmicmiplugin.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\taskschd.dll
2012-07-22 19:21:29 ----A---- C:\Windows\system32\schedsvc.dll
2012-07-22 19:21:28 ----A---- C:\Windows\system32\taskeng.exe
2012-07-22 19:21:28 ----A---- C:\Windows\system32\taskcomp.dll
2012-07-22 19:21:28 ----A---- C:\Windows\system32\schtasks.exe
2012-07-22 19:21:12 ----A---- C:\Windows\system32\rtutils.dll
2012-07-22 19:21:06 ----A---- C:\Windows\system32\schannel.dll
2012-07-22 19:21:05 ----A---- C:\Windows\system32\ncrypt.dll
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-07-22 19:21:05 ----A---- C:\Windows\system32\drivers\cng.sys
2012-07-22 19:20:50 ----A---- C:\Windows\system32\msxml6.dll
2012-07-22 19:20:49 ----A---- C:\Windows\system32\msxml3.dll
2012-07-22 19:20:39 ----A---- C:\Windows\system32\kerberos.dll
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2012-07-22 19:20:28 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2012-07-22 19:20:15 ----A---- C:\Windows\system32\oleaut32.dll
2012-07-22 19:20:15 ----A---- C:\Windows\system32\oleacc.dll
2012-07-22 19:20:06 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-07-22 19:19:51 ----A---- C:\Windows\system32\odbc32.dll
2012-07-22 19:19:31 ----A---- C:\Windows\system32\drivers\dfsc.sys
2012-07-22 19:17:53 ----A---- C:\Windows\system32\inetcomm.dll
2012-07-22 19:16:46 ----A---- C:\Windows\system32\comctl32.dll
2012-07-22 19:16:37 ----A---- C:\Windows\system32\mfc40u.dll
2012-07-22 19:16:37 ----A---- C:\Windows\system32\mfc40.dll
2012-07-22 19:16:17 ----A---- C:\Windows\system32\wmp.dll
2012-07-22 19:16:16 ----A---- C:\Windows\system32\wmploc.DLL
2012-07-22 19:16:03 ----A---- C:\Windows\system32\umpnpmgr.dll
2012-07-22 19:15:47 ----A---- C:\Windows\system32\packager.dll
2012-07-22 19:14:43 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-07-22 19:14:42 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-07-22 19:14:23 ----A---- C:\Windows\system32\FXSCOVER.exe
2012-07-22 19:14:14 ----A---- C:\Windows\system32\EncDec.dll
2012-07-22 19:14:04 ----A---- C:\Windows\system32\csrsrv.dll
2012-07-22 19:13:57 ----A---- C:\Windows\system32\CPFilters.dll
2012-07-22 19:13:56 ----A---- C:\Windows\system32\sbe.dll
2012-07-22 19:13:40 ----A---- C:\Windows\system32\quartz.dll
2012-07-22 19:13:39 ----A---- C:\Windows\system32\qdvd.dll
2012-07-22 19:08:21 ----A---- C:\Windows\system32\KernelBase.dll
2012-07-22 19:08:21 ----A---- C:\Windows\system32\kernel32.dll
2012-07-22 19:08:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-07-22 19:08:20 ----A---- C:\Windows\system32\winsrv.dll
2012-07-22 19:08:20 ----A---- C:\Windows\system32\conhost.exe
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-07-22 19:08:19 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-07-22 19:08:18 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-07-22 19:07:52 ----A---- C:\Windows\system32\mstscax.dll
2012-07-22 19:07:52 ----A---- C:\Windows\system32\mstsc.exe
2012-07-22 19:07:41 ----A---- C:\Windows\system32\webio.dll
2012-07-22 19:07:41 ----A---- C:\Windows\system32\lsasrv.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\sspisrv.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\sspicli.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\secur32.dll
2012-07-22 19:07:40 ----A---- C:\Windows\system32\lsass.exe
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbcjt32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccu32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccr32.dll
2012-07-22 19:07:25 ----A---- C:\Windows\system32\odbccp32.dll
2012-07-22 19:07:24 ----A---- C:\Windows\system32\odbctrac.dll
2012-07-22 19:07:15 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-07-22 19:07:14 ----A---- C:\Windows\system32\rdpwsx.dll
2012-07-22 19:07:14 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-07-22 19:07:07 ----A---- C:\Windows\system32\msvcrt.dll
2012-07-22 19:06:59 ----A---- C:\Windows\system32\drivers\partmgr.sys
2012-07-22 19:06:34 ----A---- C:\Windows\system32\srvsvc.dll
2012-07-22 19:05:48 ----A---- C:\Windows\system32\wmpmde.dll
2012-07-22 19:05:40 ----A---- C:\Windows\system32\consent.exe
2012-07-22 19:05:25 ----A---- C:\Windows\system32\d3d10warp.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\DWrite.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d3d10_1core.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d3d10_1.dll
2012-07-22 19:05:24 ----A---- C:\Windows\system32\d2d1.dll
2012-07-22 19:04:51 ----A---- C:\Windows\system32\mfc42u.dll
2012-07-22 19:04:51 ----A---- C:\Windows\system32\mfc42.dll
2012-07-22 19:04:35 ----A---- C:\Windows\system32\drivers\bowser.sys
2012-07-22 19:04:29 ----A---- C:\Windows\system32\StructuredQuery.dll
2012-07-22 19:04:22 ----A---- C:\Windows\system32\shell32.dll
2012-07-22 19:04:16 ----A---- C:\Windows\system32\poqexec.exe
2012-07-22 19:04:11 ----A---- C:\Windows\system32\cryptsvc.dll
2012-07-22 19:04:11 ----A---- C:\Windows\system32\cryptnet.dll
2012-07-22 19:04:11 ----A---- C:\Windows\system32\crypt32.dll
2012-07-22 18:23:45 ----A---- C:\Windows\system32\rdpcore.dll
2012-07-22 18:23:44 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-07-22 18:20:22 ----A---- C:\Windows\system32\wups2.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wucltux.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wuaueng.dll
2012-07-22 18:20:21 ----A---- C:\Windows\system32\wuauclt.exe
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wups.dll
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wudriver.dll
2012-07-22 18:20:10 ----A---- C:\Windows\system32\wuapi.dll
2012-07-22 18:19:50 ----A---- C:\Windows\system32\wuwebv.dll
2012-07-22 18:19:50 ----A---- C:\Windows\system32\wuapp.exe
2012-07-11 21:23:02 ----D---- C:\Users\Roman\AppData\Roaming\Temp

======List of files/folders modified in the last 1 month======

2012-08-04 17:16:44 ----D---- C:\Windows\Temp
2012-08-04 17:16:43 ----D---- C:\Windows\Prefetch
2012-08-04 17:08:52 ----D---- C:\Windows\system32\drivers
2012-08-04 17:05:28 ----D---- C:\Windows
2012-08-04 17:05:28 ----A---- C:\Windows\system.ini
2012-08-04 17:05:22 ----D---- C:\Windows\system32\drivers\etc
2012-08-04 17:03:10 ----D---- C:\Windows\Tasks
2012-08-04 17:03:10 ----D---- C:\Windows\System32
2012-08-04 17:00:06 ----D---- C:\Windows\AppPatch
2012-08-04 17:00:05 ----D---- C:\Program Files\Common Files
2012-08-04 16:49:37 ----SHD---- C:\System Volume Information
2012-08-04 12:26:44 ----D---- C:\Windows\system32\config
2012-08-04 12:13:05 ----D---- C:\Program Files\Steam
2012-08-02 20:39:46 ----D---- C:\Program Files\Common Files\Steam
2012-07-31 19:25:47 ----D---- C:\Windows\system32\Tasks
2012-07-31 18:31:14 ----D---- C:\Windows\inf
2012-07-31 18:31:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-07-31 18:04:17 ----D---- C:\ProgramData
2012-07-31 18:04:14 ----RD---- C:\Program Files
2012-07-31 18:01:00 ----SHD---- C:\Windows\Installer
2012-07-31 17:56:13 ----D---- C:\Windows\system32\DriverStore
2012-07-31 17:56:13 ----D---- C:\Windows\system32\catroot
2012-07-30 14:05:35 ----D---- C:\Windows\system32\catroot2
2012-07-29 19:47:09 ----D---- C:\Program Files\Mozilla Firefox
2012-07-28 10:03:28 ----RSD---- C:\Windows\Fonts
2012-07-26 15:30:06 ----D---- C:\Windows\Panther
2012-07-26 15:30:01 ----D---- C:\Windows\Minidump
2012-07-26 15:30:01 ----D---- C:\Windows\Logs
2012-07-26 15:30:01 ----D---- C:\Windows\debug
2012-07-24 10:31:42 ----D---- C:\Windows\winsxs
2012-07-23 19:40:34 ----D---- C:\Windows\rescache
2012-07-23 18:04:01 ----D---- C:\Windows\Microsoft.NET
2012-07-23 18:03:07 ----RSD---- C:\Windows\assembly
2012-07-23 16:35:41 ----D---- C:\Windows\system32\cs-CZ
2012-07-23 16:35:40 ----D---- C:\Windows\ehome
2012-07-23 16:35:40 ----D---- C:\Program Files\Windows Mail
2012-07-23 16:35:40 ----D---- C:\Program Files\Common Files\System
2012-07-23 16:35:38 ----D---- C:\Program Files\Windows Journal
2012-07-23 16:35:37 ----D---- C:\Program Files\Windows Media Player
2012-07-22 20:40:26 ----D---- C:\Program Files\Internet Explorer
2012-07-22 20:40:25 ----D---- C:\Windows\system32\migration
2012-07-22 20:40:25 ----D---- C:\Windows\system32\en-US
2012-07-22 20:40:25 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-08-13 691696]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2008-05-16 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2008-05-16 78416]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2008-05-16 42912]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 50768]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-12-30 83872]
R2 CdaC15BA;CdaC15BA; \??\C:\Windows\system32\drivers\CDAC15BA.SYS [2010-09-13 12464]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-08-13 25888]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\Windows\SYSTEM32\DRIVERS\WibuKey.sys [2006-11-22 72704]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2012-07-03 22344]
R3 NVNET;NVIDIA nForce 10/100 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmf6232.sys [2010-03-04 296936]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2010-12-21 30312]
S3 at9q88bk;at9q88bk; C:\Windows\system32\drivers\at9q88bk.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Roman\AppData\Local\Temp\catchme.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-14 347264]
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-06-02 114280]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AffinegyService;AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [2010-07-28 569752]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-05-16 17272]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-05-16 144760]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\Windows\system32\drivers\CDAC11BA.EXE [2010-09-13 54784]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-03-28 246520]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-12-15 75064]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2011-04-09 214520]
R2 Web Assistant Updater;Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [2012-06-06 185856]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-05-16 247160]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-05-16 349560]
S2 Apache2.2;Apache2.2; c:\xampp\apache\bin\apache.exe [2008-01-18 24635]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 mysql;mysql; c:\xampp\mysql\bin\mysqld-nt.exe --defaults-file=c:\xampp\mysql\bin\my.cnf mysql []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe []
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-05-10 136120]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-08-01 529232]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-08-02 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Děkuji mockrát.

[jaro3]

Nedávej sem stále RSIT , stáhni si HJT:
viewtopic.php?f=70&t=5119

Odinstaluj:
DAEMON Tools Toolbar
ICQToolBar

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::
File::
c:\windows\system32\actskin4.ocx


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.


Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[romankrajicek]

Zdravím,
tak všechno uděláno.

Log ComboFix:

ComboFix 12-07-30.03 - Roman 05.08.2012 12:03:35.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1920.839 [GMT 2:00]
Spuštěný z: c:\users\Roman\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
FILE ::
"c:\windows\system32\actskin4.ocx"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Roman\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\users\Roman\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll
c:\windows\system32\actskin4.ocx
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-07-05 do 2012-08-05 )))))))))))))))))))))))))))))))
.
.
2012-08-05 10:05 . 2012-08-05 10:05 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-08-05 10:05 . 2012-08-05 10:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-05 09:36 . 2012-08-05 09:36 388096 ----a-r- c:\users\Roman\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-08-04 16:29 . 2012-08-04 16:29 -------- d-----w- c:\users\Roman\AppData\Local\Adobe
2012-07-31 16:59 . 2012-08-04 15:03 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5872CA2C-8583-42CB-9E66-21E0B1D1D8F8}\offreg.dll
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\users\Roman\AppData\Roaming\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\programdata\Malwarebytes
2012-07-31 16:04 . 2012-07-31 16:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-31 16:04 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 09:40 . 2008-05-15 23:15 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-31 09:40 . 2008-05-15 23:14 42912 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-31 09:40 . 2008-05-15 23:12 95608 ----a-w- c:\windows\system32\AvastSS.scr
2012-07-31 09:40 . 2008-05-15 23:20 78416 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-31 09:40 . 2008-05-15 23:16 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-31 09:40 . 2008-05-15 23:24 1152888 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-31 09:40 . 2008-05-15 23:18 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-31 09:40 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2012-07-31 09:40 . 2012-07-31 09:40 -------- d-----w- c:\program files\Alwil Software
2012-07-29 18:39 . 2012-08-05 09:36 -------- d-----w- c:\program files\trend micro
2012-07-29 18:39 . 2012-07-29 18:40 -------- d-----w- C:\rsit
2012-07-29 17:47 . 2012-07-29 17:47 -------- d-----w- c:\program files\Perion
2012-07-29 17:47 . 2012-07-29 17:47 842 ----a-w- C:\user.js
2012-07-29 17:46 . 2012-07-31 17:20 -------- d-----w- c:\program files\Web Assistant
2012-07-29 17:44 . 2012-07-29 17:45 -------- d-----w- c:\program files\1ClickDownload
2012-07-23 13:45 . 2012-06-12 02:44 2344448 ----a-w- c:\windows\system32\win32k.sys
2012-07-22 18:39 . 2012-03-01 05:53 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-22 18:39 . 2012-03-01 05:49 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-07-22 18:39 . 2012-03-01 05:45 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-22 18:39 . 2012-03-01 05:40 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-22 18:36 . 2012-07-22 18:36 801792 ----a-w- c:\windows\system32\FntCache.dll
2012-07-22 18:36 . 2012-07-22 18:36 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-07-22 18:36 . 2012-07-22 18:36 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-07-22 18:36 . 2012-07-22 18:36 283648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-07-22 18:36 . 2012-07-22 18:36 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-07-22 18:36 . 2012-07-22 18:36 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2012-07-22 18:36 . 2012-07-22 18:36 1495040 ----a-w- c:\windows\system32\ExplorerFrame.dll
2012-07-22 18:36 . 2012-07-22 18:36 135168 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-07-22 18:36 . 2012-07-22 18:36 107520 ----a-w- c:\windows\system32\cdd.dll
2012-07-22 18:36 . 2012-07-22 18:36 3181568 ----a-w- c:\windows\system32\mf.dll
2012-07-22 18:36 . 2012-07-22 18:36 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-07-22 17:24 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2012-07-22 17:24 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2012-07-22 17:24 . 2011-04-29 02:57 311296 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-22 17:24 . 2011-04-29 02:57 309760 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-07-22 17:24 . 2011-04-29 02:57 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-22 17:24 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-07-22 17:23 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2012-07-22 17:23 . 2011-11-17 05:41 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-07-22 17:23 . 2011-03-03 05:29 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2012-07-22 17:23 . 2011-03-03 05:27 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2012-07-22 17:23 . 2011-02-19 05:32 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-07-22 17:23 . 2011-02-19 03:37 294912 ----a-w- c:\windows\system32\atmfd.dll
2012-07-22 17:22 . 2011-10-01 04:43 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-07-22 17:22 . 2010-07-29 06:30 197632 ----a-w- c:\windows\system32\ir32_32.dll
2012-07-22 17:22 . 2010-07-29 06:30 82944 ----a-w- c:\windows\system32\iccvid.dll
2012-07-22 17:22 . 2010-08-26 04:39 109056 ----a-w- c:\windows\system32\t2embed.dll
2012-07-22 17:22 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2012-07-22 17:22 . 2011-08-17 04:22 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-07-22 17:22 . 2011-08-17 04:26 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-07-22 17:22 . 2011-08-17 04:22 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-07-22 17:22 . 2011-08-17 04:22 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-07-22 17:22 . 2011-08-17 04:22 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-07-22 17:20 . 2012-06-06 05:09 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-07-22 17:20 . 2012-06-06 05:09 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-22 17:20 . 2010-12-18 05:29 541184 ----a-w- c:\windows\system32\kerberos.dll
2012-07-22 17:20 . 2011-07-09 02:26 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-07-22 17:20 . 2011-05-04 02:43 96256 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-07-22 17:20 . 2011-05-04 02:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-07-22 17:20 . 2011-08-27 04:43 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-07-22 17:20 . 2011-08-27 04:43 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-07-22 17:20 . 2012-03-30 10:29 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-07-22 17:19 . 2010-10-16 04:34 573440 ----a-w- c:\windows\system32\odbc32.dll
2012-07-22 17:19 . 2010-10-16 04:33 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-22 17:19 . 2010-10-16 04:33 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-22 17:19 . 2010-10-16 04:33 208896 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-22 17:19 . 2012-04-02 04:40 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-07-22 17:19 . 2012-04-02 04:41 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-07-22 17:19 . 2012-04-02 04:40 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-07-22 17:19 . 2012-04-02 04:40 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-07-22 17:19 . 2011-04-27 02:33 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-07-22 17:17 . 2011-05-03 04:50 740864 ----a-w- c:\windows\system32\inetcomm.dll
2012-07-22 17:16 . 2010-08-21 05:33 530432 ----a-w- c:\windows\system32\comctl32.dll
2012-07-22 17:16 . 2010-08-31 04:32 954752 ----a-w- c:\windows\system32\mfc40.dll
2012-07-22 17:16 . 2010-08-31 04:32 954288 ----a-w- c:\windows\system32\mfc40u.dll
2012-07-22 17:16 . 2010-09-01 04:26 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2012-07-22 17:16 . 2010-09-01 04:23 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2012-07-22 17:16 . 2011-05-24 10:35 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-07-22 17:15 . 2011-11-19 14:06 67072 ----a-w- c:\windows\system32\packager.dll
2012-07-22 17:15 . 2012-06-06 05:09 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-22 17:14 . 2012-04-02 04:46 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-07-22 17:14 . 2012-04-02 04:46 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-22 17:14 . 2011-02-12 05:30 191488 ----a-w- c:\windows\system32\FXSCOVER.exe
2012-07-22 17:14 . 2011-10-15 05:48 534528 ----a-w- c:\windows\system32\EncDec.dll
2012-07-22 17:14 . 2011-10-26 04:25 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-07-22 17:13 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
2012-07-22 17:13 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
2012-07-22 17:13 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2012-07-22 17:13 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-07-22 17:13 . 2011-10-26 04:28 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-07-22 17:07 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
2012-07-22 17:06 . 2012-03-17 07:20 56688 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-07-22 17:06 . 2010-08-27 05:46 168448 ----a-w- c:\windows\system32\srvsvc.dll
2012-07-22 17:05 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2012-07-22 17:05 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2012-07-22 17:05 . 2012-03-03 05:40 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-07-22 17:05 . 2012-03-03 05:40 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-07-22 17:05 . 2012-03-03 05:40 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-07-22 17:05 . 2012-03-03 05:40 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-07-22 17:05 . 2012-03-03 05:40 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-07-22 17:04 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2012-07-22 17:04 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\system32\mfc42.dll
2012-07-22 17:04 . 2011-02-23 05:05 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-07-22 17:04 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-07-22 17:04 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2012-07-22 17:04 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-07-22 17:04 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-07-22 17:04 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-07-22 16:23 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-07-22 16:23 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-07-22 16:20 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-22 16:20 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-22 16:20 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-22 16:20 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-22 16:20 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-22 16:20 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 04:48 . 2012-07-22 17:21 225280 ----a-w- c:\windows\system32\schannel.dll
2012-05-24 21:18 . 2012-05-24 21:18 4472832 ----a-w- c:\windows\system32\GPhotos.scr
2005-12-05 16:00 . 2005-12-05 16:00 74448 ------w- c:\program files\DSETUP.dll
2005-12-05 16:00 . 2005-12-05 16:00 484560 ------w- c:\program files\DXSETUP.exe
2005-12-05 16:00 . 2005-12-05 16:00 2247888 ------w- c:\program files\dsetup32.dll
2011-12-21 07:39 . 2012-01-31 09:22 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-11-06 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2012-08-04 1353080]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-25 21416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-19 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-07-28 1485208]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-04-27 3521424]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2008-05-15 79224]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
WinMySQLadmin.lnk - c:\apache\mysql\bin\winmysqladmin.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Network Server.lnk - c:\program files\WIBUKEY\Server\WkSvMgr.exe [2011-8-27 3768320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [x]
S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: &Stáhnout všechny FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Roman\AppData\Roaming\Mozilla\Firefox\Profiles\l46ok9gu.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4046902235-2277129297-1121146792-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:49,69,e9,7c,c1,42,7d,e4,30,b6,9c,fa,d4,0f,de,1e,58,39,7f,ff,60,27,da,
93,96,d7,b1,f7,00,51,6f,d9,73,ee,14,b5,41,71,2c,6e,a4,f0,b5,58,c7,ce,9f,51,\
"??"=hex:5c,37,23,9a,71,63,97,8e,e3,66,c1,b6,ba,3a,82,fe
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(2808)
c:\windows\System32\Actioncenter.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\AUDIODG.EXE
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\taskhost.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\conhost.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Steam\SteamService.exe
.
**************************************************************************
.
Celkový čas: 2012-08-05 12:10:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-08-05 10:10
ComboFix2.txt 2012-08-04 15:08
ComboFix3.txt 2012-07-31 17:26
.
Před spuštěním: Volných bajtů: 12 632 944 640
Po spuštění: Volných bajtů: 12 838 055 936
.
- - End Of File - - A21C21418C1A1F9475F945928E4F921A

Log HJT:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:23:52, on 5.8.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files\WIBUKEY\Server\WkSvMgr.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\trend micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing)
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - Startup: WinMySQLadmin.lnk = C:\apache\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Network Server.lnk = C:\Program Files\WIBUKEY\Server\WkSvMgr.exe
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stáhnout všechny FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://217.112.163.219:8080/program/SonySncRz25View.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: Apache2.2 - Apache Software Foundation - c:\xampp\apache\bin\apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mysql - Unknown owner - c:\xampp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

--
End of file - 6749 bytes

[romankrajicek]

a ještě log aswMBR:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-05 13:24:44
-----------------------------
13:24:44.365 OS Version: Windows 6.1.7600
13:24:44.365 Number of processors: 2 586 0x4303
13:24:44.365 ComputerName: ROMAN-PC UserName: Roman
13:24:45.160 Initialize success
13:24:55.271 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000063
13:24:55.271 Disk 0 Vendor: SAMSUNG_ FH10 Size: 238474MB BusType: 3
13:24:55.286 Disk 0 MBR read successfully
13:24:55.286 Disk 0 MBR scan
13:24:55.286 Disk 0 Windows 7 default MBR code
13:24:55.302 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
13:24:55.318 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 49898 MB offset 206848
13:24:55.318 Disk 0 Partition - 00 0F Extended LBA 188465 MB offset 102398310
13:24:55.333 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 188465 MB offset 102398373
13:24:55.333 Disk 0 scanning sectors +488376000
13:24:55.396 Disk 0 scanning C:\Windows\system32\drivers
13:25:00.154 Service scanning
13:25:13.180 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
13:25:16.284 Modules scanning
13:25:30.574 Disk 0 trace - called modules:
13:25:30.589 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x849981f8]<<
13:25:30.605 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x858e9030]
13:25:30.605 3 CLASSPNP.SYS[88c9a59e] -> nt!IofCallDriver -> [0x856c0438]
13:25:30.620 5 ACPI.sys[8853a3b2] -> nt!IofCallDriver -> \Device\00000063[0x856e5680]
13:25:30.620 \Driver\nvstor[0x856e08f8] -> IRP_MJ_CREATE -> 0x849981f8
13:25:30.636 Scan finished successfully
13:25:41.696 Disk 0 MBR has been saved successfully to "C:\Users\Roman\Desktop\MBR.dat"
13:25:41.712 The log file has been saved successfully to "C:\Users\Roman\Desktop\aswMBR.txt"

Děkuji moc.

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.


Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.