pravděbodobně FB vir

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#16 Příspěvek od aniworld »

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Verze databáze: 7298

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27.7.2011 20:50:59
mbam-log-2011-07-27 (20-50-49).txt

Typ: Úplná kontrola (C:\|D:\|K:\|)
Kontrolované objekty: 325328
Uplynulý čas: 36 minut, 38 sekund

Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče v registru: 6
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 18

Infikované procesy v paměti:
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 2580 -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 3036 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.

Infikované soubory:
c:\qip infium jadrispack\qip infium jadrispack.exe (Trojan.Downloader) -> No action taken.
c:\Users\Dajoš\downloads\flash-player.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\20516_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#17 Příspěvek od vyosek »

Nalezy smazta - pak se objevi log - ten bych rad videl

A zkuste spustit ComboFix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#18 Příspěvek od aniworld »

tak zde jsou logy s mbam a combofixu

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Verze databáze: 7298

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.7.2011 12:12:08
mbam-log-2011-07-28 (12-12-08).txt

Typ: Úplná kontrola (C:\|D:\|K:\|)
Kontrolované objekty: 325328
Uplynulý čas: 36 minut, 38 sekund

Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče v registru: 6
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 18

Infikované procesy v paměti:
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 2580 -> Failed to unload process.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 3036 -> Failed to unload process.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> Quarantined and deleted successfully.

Infikované soubory:
c:\qip infium jadrispack\qip infium jadrispack.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Dajoš\downloads\flash-player.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\Temp\20516_myunrar2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.



ComboFix 11-07-28.01 - Dajoš 28.07.2011 12:32:32.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2935.1893 [GMT 2:00]
Spuštěný z: c:\users\Dajoš\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: ZoneAlarm Firewall *Disabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\DAJO~1\AppData\Local\Temp\IswTmp\WH\0
c:\users\Dajoš\AppData\Local\Temp\IswTmp\WH\0
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.2
c:\windows\update.5.0
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-28 )))))))))))))))))))))))))))))))
.
.
2011-07-28 10:40 . 2011-07-28 10:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-27 18:09 . 2011-07-27 18:09 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Malwarebytes
2011-07-27 18:09 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-27 18:09 . 2011-07-27 18:09 -------- d-----w- c:\programdata\Malwarebytes
2011-07-27 18:09 . 2011-07-27 18:11 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-27 18:09 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-27 16:56 . 2011-07-27 16:56 -------- d-----w- c:\users\Dajoš\AppData\Roaming\CheckPoint
2011-07-27 16:52 . 2011-07-27 16:52 -------- d-----w- c:\programdata\CheckPoint
2011-07-27 16:52 . 2011-07-28 10:42 -------- d-----w- c:\windows\Internet Logs
2011-07-27 16:43 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-27 16:43 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-07-27 16:42 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-27 16:42 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-27 16:42 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-27 16:42 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-27 16:42 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-27 16:42 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-07-27 16:42 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-27 16:42 . 2011-07-27 16:42 -------- d-----w- c:\programdata\AVAST Software
2011-07-27 16:42 . 2011-07-27 16:42 -------- d-----w- c:\program files\AVAST Software
2011-07-27 16:32 . 2011-07-27 16:32 -------- d-----w- c:\windows\ufa
2011-07-27 16:32 . 2011-07-27 16:32 246272 ----a-w- c:\windows\unrar.exe
2011-07-27 16:27 . 2011-07-27 16:27 -------- d-----w- C:\WINSSLog
2011-07-27 16:25 . 2011-07-27 16:25 31808 ----a-w- C:\FixitRegBackup.reg
2011-07-27 16:18 . 2011-07-27 16:18 -------- d-----w- c:\program files (x86)\CCleaner
2011-07-27 16:07 . 2011-07-27 16:08 -------- d-----w- C:\uninstall
2011-07-27 14:17 . 2011-07-27 14:27 -------- d-----w- C:\pitomec.com
2011-07-27 10:09 . 2011-07-27 10:30 -------- d-----w- c:\program files\trend micro
2011-07-26 13:12 . 2011-07-20 07:44 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{569CE388-DF2E-4B2A-9FEB-E59956B51F4F}\mpengine.dll
2011-07-21 18:29 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64F3FD1D-51E6-4514-9C29-51ECE8C03DEE}\mpengine.dll
2011-07-10 19:38 . 2011-07-10 19:38 -------- d-----w- c:\program files\Data
2011-07-10 19:37 . 2011-07-10 19:38 -------- d-----w- c:\program files\Help
2011-07-10 19:37 . 2011-07-10 19:37 253952 ------w- c:\windows\Setup1.exe
2011-07-10 19:37 . 2011-07-10 19:37 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-10 19:19 . 2011-07-10 19:46 -------- d-----w- c:\program files (x86)\RK Software
2011-07-10 18:47 . 2011-07-10 19:31 -------- d-----w- c:\programdata\firebird
2011-07-10 17:49 . 2011-07-10 19:22 -------- d-----w- c:\program files (x86)\Optimik
2011-07-05 16:49 . 2011-07-05 16:49 -------- d-----w- c:\program files (x86)\ASIO4ALL v2
2011-07-05 16:46 . 2006-06-20 08:56 225280 ----a-w- c:\windows\SysWow64\rewire.dll
2011-07-05 16:46 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\SysWow64\vorbis.acm
2011-07-05 16:46 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\VstPlugins
2011-07-05 16:46 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\Outsim
2011-07-05 16:43 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\Image-Line
2011-07-05 15:31 . 2011-07-05 15:31 -------- d-----w- c:\windows\system32\SPReview
2011-07-05 15:30 . 2011-07-05 15:30 -------- d-----w- c:\windows\system32\EventProviders
2011-07-05 15:21 . 2011-07-05 15:21 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Intel Corporation
2011-07-05 15:18 . 2011-07-05 15:18 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Intel
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\program files (x86)\Cisco
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\programdata\Intel
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\program files\Intel
2011-07-05 14:50 . 2011-07-05 15:16 -------- d-----w- c:\program files\Common Files\Intel
2011-07-05 14:50 . 2011-07-05 14:50 -------- d-----w- c:\program files (x86)\Common Files\Intel
2011-07-05 14:40 . 2010-08-30 17:17 14848 ----a-w- c:\windows\system32\IntcDAuC.dll
2011-07-05 14:40 . 2010-08-30 17:17 289280 ----a-w- c:\windows\system32\drivers\IntcDAud.sys
2011-07-05 14:40 . 2010-10-07 02:40 161304 ----a-w- c:\windows\system32\igfxtray.exe
2011-07-05 14:40 . 2010-10-07 02:40 508952 ----a-w- c:\windows\system32\igfxsrvc.exe
2011-07-05 14:40 . 2010-10-07 02:40 415256 ----a-w- c:\windows\system32\igfxpers.exe
2011-07-05 14:40 . 2010-10-07 02:40 223768 ----a-w- c:\windows\system32\igfxext.exe
2011-07-05 14:40 . 2010-10-07 02:40 386584 ----a-w- c:\windows\system32\hkcmd.exe
2011-07-05 14:40 . 2010-10-07 02:40 3156504 ----a-w- c:\windows\system32\GfxUI.exe
2011-07-05 14:40 . 2010-10-07 02:40 152600 ----a-w- c:\windows\system32\difx64.exe
2011-07-05 14:23 . 2010-03-03 17:51 540696 ----a-w- c:\windows\system32\drivers\iaStor.sys
2011-07-05 14:23 . 2011-07-05 14:23 -------- d-----w- c:\users\Dajoš\AppData\Roaming\InstallShield
2011-07-05 14:05 . 2010-03-04 19:43 346144 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2011-07-05 14:05 . 2010-01-05 22:39 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2011-07-05 14:05 . 2009-12-03 15:27 74272 ----a-w- c:\windows\system32\RtNicProp64.dll
2011-07-05 13:08 . 2011-07-05 13:08 -------- d-----w- c:\program files\Synaptics
2011-07-05 13:08 . 2009-08-07 07:49 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2011-07-05 13:08 . 2009-12-10 17:25 301104 ----a-w- c:\windows\system32\drivers\SynTP.sys
2011-07-05 13:08 . 2009-12-10 17:20 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2011-07-05 13:08 . 2009-12-10 17:20 147752 ----a-w- c:\windows\system32\SynTPCo4.dll
2011-07-05 13:08 . 2009-12-10 17:20 207144 ----a-w- c:\windows\system32\SynTPAPI.dll
2011-07-05 13:08 . 2009-12-10 17:20 263464 ----a-w- c:\windows\system32\SynCtrl.dll
2011-07-05 13:08 . 2009-12-10 17:20 206120 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2011-07-05 13:08 . 2009-12-10 17:20 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2011-07-05 13:08 . 2009-12-10 17:20 396584 ----a-w- c:\windows\system32\SynCOM.dll
2011-07-05 12:52 . 2011-07-05 12:52 -------- d-----w- c:\program files\IDT
2011-07-05 12:47 . 2009-11-02 12:03 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2011-07-05 12:43 . 2009-02-02 16:27 7347200 ----a-w- c:\windows\system32\RTSUSTORicon.dll
2011-07-05 12:43 . 2011-07-05 14:05 -------- d-----w- c:\program files (x86)\Realtek
2011-07-05 12:43 . 2009-08-10 09:07 222208 ----a-w- c:\windows\system32\drivers\RtsUStor.sys
2011-07-05 12:43 . 2009-06-22 09:52 351744 ----a-w- c:\windows\system32\RtsUStor.dll
2011-07-05 12:22 . 2009-05-13 01:27 652288 ----a-w- c:\windows\system32\ctapo64.dll
2011-07-05 12:22 . 2009-05-13 01:25 511488 ----a-w- c:\windows\system32\ctapo32.dll
2011-07-05 12:22 . 2009-03-02 23:59 165888 ----a-w- c:\windows\system32\AESTAC64.dll
2011-07-05 12:22 . 2009-03-02 23:58 68608 ----a-w- c:\windows\system32\AESTAR64.dll
2011-07-05 12:22 . 2009-03-02 23:08 431104 ----a-w- c:\windows\system32\AESTEC64.dll
2011-07-05 12:22 . 2010-04-07 02:35 431616 ----a-w- c:\windows\system32\stcplx64.dll
2011-07-05 12:22 . 2010-04-07 02:35 3348480 ----a-w- c:\windows\system32\stlang64.dll
2011-07-05 12:22 . 2010-04-07 02:35 1465344 ----a-w- c:\windows\system32\stapo64.dll
2011-07-05 12:22 . 2010-04-07 02:35 12772352 ----a-w- c:\windows\system32\idtcpl64.cpl
2011-07-05 12:22 . 2009-05-13 01:28 57856 ----a-w- c:\windows\system32\ctppld64.dll
2011-07-05 12:22 . 2009-03-02 23:47 90624 ----a-w- c:\windows\system32\AESTCo64.dll
2011-07-05 12:21 . 2010-04-07 02:35 505344 ----a-w- c:\windows\system32\drivers\stwrt64.sys
2011-07-05 12:21 . 2010-04-07 02:35 645632 ------w- c:\windows\system32\stapi64.dll
2011-07-05 12:21 . 2010-04-07 02:35 209920 ----a-w- c:\windows\system32\st646277.dll
2011-07-05 12:18 . 2011-07-05 12:18 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2011-07-05 12:18 . 2009-09-17 10:54 56344 ----a-w- c:\windows\system32\drivers\HECIx64.sys
2011-07-05 12:08 . 2011-07-05 15:17 -------- d-----w- c:\program files\Dell
2011-07-05 12:02 . 2011-07-05 12:02 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Dell
2011-07-05 12:02 . 2011-07-05 12:08 -------- d-----w- c:\programdata\Dell
2011-07-05 12:01 . 2011-07-05 12:02 -------- d-----w- c:\program files\Dell Support Center
2011-07-05 11:57 . 2011-07-05 12:02 -------- d-----w- c:\programdata\PCDr
2011-07-05 11:57 . 2011-07-05 12:01 -------- d-----w- c:\users\Dajoš\AppData\Roaming\PCDr
2011-07-05 11:57 . 2011-07-05 11:57 -------- d-----w- C:\dell
2011-07-04 17:09 . 2011-07-04 17:09 -------- d-----w- c:\program files\CCleaner
2011-07-01 13:14 . 2011-07-28 10:12 -------- d-----w- C:\QIP Infium JadrisPack
2011-07-01 13:04 . 2011-07-01 13:04 -------- d-----w- c:\program files (x86)\QIP 2010
2011-06-29 16:11 . 2011-05-24 11:21 404992 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-06-29 16:11 . 2011-05-24 10:34 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-06-29 16:11 . 2011-05-24 10:34 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-06-29 16:11 . 2011-05-24 10:32 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-06-29 16:11 . 2011-05-24 10:34 64512 ----a-w- c:\windows\SysWow64\devobj.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-25 14:30 . 2011-06-17 06:32 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-01 12:43 . 2011-04-03 19:48 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-06-27 11:45 . 2011-04-03 19:48 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-06-22 06:14 . 2011-04-17 08:42 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2011-06-07 17:10 . 2010-11-03 07:50 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-06-02 05:56 . 2011-07-13 05:54 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-28 03:25 . 2011-06-16 09:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-28 03:00 . 2011-06-16 09:38 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-05-24 17:14 . 2010-11-01 17:16 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-15 08:26 . 2011-05-15 08:26 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-05-04 02:51 . 2011-06-16 09:39 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-05-04 02:51 . 2011-06-16 09:39 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-05-04 02:51 . 2011-06-16 09:39 126464 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-05-03 05:21 . 2011-06-16 09:38 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-03 04:50 . 2011-06-16 09:38 740864 ----a-w- c:\windows\SysWow64\inetcomm.dll
2009-01-29 15:08 . 2009-01-29 15:08 3104768 ----a-w- c:\program files\Truhlář V6_3_5.exe
2009-01-29 14:12 . 2009-01-29 14:12 434176 ----a-w- c:\program files\Faktury.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
"ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-17 1043968]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x]
R3 nmwcdcmx64;Nokia USB Modem;c:\windows\system32\drivers\nmwcdcmx64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\nmwcdx64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d550fa1f2cf8996d\AESTSr64.exe [2009-03-03 89600]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-02-15 33528]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-02-15 822264]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-27 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
2011-07-28 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-07 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-07 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-07 415256]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-07-05 5107712]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 1123320]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.5.252
FF - ProfilePath - c:\users\Dajoš\AppData\Roaming\Mozilla\Firefox\Profiles\el45y7gz.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
FF - Ext: QipAuthorizer: {32a1fd71-835e-4b11-8e54-886fda0b4c89} - %profile%\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SafeBoot-MsMpSvc
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SysTrayApp - c:\program files (x86)\IDT\WDM\sttray64.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2011-07-28 12:54:39 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-28 10:54
.
Před spuštěním: Volných bajtů: 250 138 054 656
Po spuštění: Volných bajtů: 249 985 036 288
.
- - End Of File - - 582DF4A336BDA12DCB11A9254FF5BD4E
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#19 Příspěvek od vyosek »

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

Folder::
c:\windows\ufa

File::
c:\windows\unrar.exe

DDS::
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie

Firefox::
FF - ProfilePath - c:\users\Dajoš\AppData\Roaming\Mozilla\Firefox\Profiles\el45y7gz.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.2.6&q=
FF - Ext: QipAuthorizer: {32a1fd71-835e-4b11-8e54-886fda0b4c89} - %profile%\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#20 Příspěvek od aniworld »

ComboFix 11-07-28.01 - Dajoš 28.07.2011 13:32:29.4.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2935.1590 [GMT 2:00]
Spuštěný z: c:\users\DajoÜ\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\DajoÜ\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-28 )))))))))))))))))))))))))))))))
.
.
2011-07-28 11:37 . 2011-07-28 11:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-27 18:09 . 2011-07-27 18:09 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Malwarebytes
2011-07-27 18:09 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-27 18:09 . 2011-07-27 18:09 -------- d-----w- c:\programdata\Malwarebytes
2011-07-27 18:09 . 2011-07-27 18:11 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-27 18:09 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-27 16:56 . 2011-07-27 16:56 -------- d-----w- c:\users\Dajoš\AppData\Roaming\CheckPoint
2011-07-27 16:52 . 2011-07-27 16:52 -------- d-----w- c:\programdata\CheckPoint
2011-07-27 16:52 . 2011-07-28 11:38 -------- d-----w- c:\windows\Internet Logs
2011-07-27 16:43 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-27 16:43 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-07-27 16:42 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-27 16:42 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-27 16:42 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-27 16:42 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-27 16:42 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-27 16:42 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-07-27 16:42 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-07-27 16:42 . 2011-07-27 16:42 -------- d-----w- c:\programdata\AVAST Software
2011-07-27 16:42 . 2011-07-27 16:42 -------- d-----w- c:\program files\AVAST Software
2011-07-27 16:32 . 2011-07-27 16:32 -------- d-----w- c:\windows\ufa
2011-07-27 16:32 . 2011-07-27 16:32 246272 ----a-w- c:\windows\unrar.exe
2011-07-27 16:27 . 2011-07-27 16:27 -------- d-----w- C:\WINSSLog
2011-07-27 16:25 . 2011-07-27 16:25 31808 ----a-w- C:\FixitRegBackup.reg
2011-07-27 16:18 . 2011-07-27 16:18 -------- d-----w- c:\program files (x86)\CCleaner
2011-07-27 16:07 . 2011-07-27 16:08 -------- d-----w- C:\uninstall
2011-07-27 14:17 . 2011-07-27 14:27 -------- d-----w- C:\pitomec.com
2011-07-27 10:09 . 2011-07-27 10:30 -------- d-----w- c:\program files\trend micro
2011-07-26 13:12 . 2011-07-20 07:44 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{569CE388-DF2E-4B2A-9FEB-E59956B51F4F}\mpengine.dll
2011-07-21 18:29 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64F3FD1D-51E6-4514-9C29-51ECE8C03DEE}\mpengine.dll
2011-07-10 19:38 . 2011-07-10 19:38 -------- d-----w- c:\program files\Data
2011-07-10 19:37 . 2011-07-10 19:38 -------- d-----w- c:\program files\Help
2011-07-10 19:37 . 2011-07-10 19:37 253952 ------w- c:\windows\Setup1.exe
2011-07-10 19:37 . 2011-07-10 19:37 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-07-10 19:19 . 2011-07-10 19:46 -------- d-----w- c:\program files (x86)\RK Software
2011-07-10 18:47 . 2011-07-10 19:31 -------- d-----w- c:\programdata\firebird
2011-07-10 17:49 . 2011-07-10 19:22 -------- d-----w- c:\program files (x86)\Optimik
2011-07-05 16:49 . 2011-07-05 16:49 -------- d-----w- c:\program files (x86)\ASIO4ALL v2
2011-07-05 16:46 . 2006-06-20 08:56 225280 ----a-w- c:\windows\SysWow64\rewire.dll
2011-07-05 16:46 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\SysWow64\vorbis.acm
2011-07-05 16:46 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\VstPlugins
2011-07-05 16:46 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\Outsim
2011-07-05 16:43 . 2011-07-05 16:46 -------- d-----w- c:\program files (x86)\Image-Line
2011-07-05 15:31 . 2011-07-05 15:31 -------- d-----w- c:\windows\system32\SPReview
2011-07-05 15:30 . 2011-07-05 15:30 -------- d-----w- c:\windows\system32\EventProviders
2011-07-05 15:21 . 2011-07-05 15:21 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Intel Corporation
2011-07-05 15:18 . 2011-07-05 15:18 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Intel
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\program files (x86)\Cisco
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\programdata\Intel
2011-07-05 15:16 . 2011-07-05 15:16 -------- d-----w- c:\program files\Intel
2011-07-05 14:50 . 2011-07-05 15:16 -------- d-----w- c:\program files\Common Files\Intel
2011-07-05 14:50 . 2011-07-05 14:50 -------- d-----w- c:\program files (x86)\Common Files\Intel
2011-07-05 14:40 . 2010-08-30 17:17 14848 ----a-w- c:\windows\system32\IntcDAuC.dll
2011-07-05 14:40 . 2010-08-30 17:17 289280 ----a-w- c:\windows\system32\drivers\IntcDAud.sys
2011-07-05 14:40 . 2010-10-07 02:40 161304 ----a-w- c:\windows\system32\igfxtray.exe
2011-07-05 14:40 . 2010-10-07 02:40 508952 ----a-w- c:\windows\system32\igfxsrvc.exe
2011-07-05 14:40 . 2010-10-07 02:40 415256 ----a-w- c:\windows\system32\igfxpers.exe
2011-07-05 14:40 . 2010-10-07 02:40 223768 ----a-w- c:\windows\system32\igfxext.exe
2011-07-05 14:40 . 2010-10-07 02:40 386584 ----a-w- c:\windows\system32\hkcmd.exe
2011-07-05 14:40 . 2010-10-07 02:40 3156504 ----a-w- c:\windows\system32\GfxUI.exe
2011-07-05 14:40 . 2010-10-07 02:40 152600 ----a-w- c:\windows\system32\difx64.exe
2011-07-05 14:23 . 2010-03-03 17:51 540696 ----a-w- c:\windows\system32\drivers\iaStor.sys
2011-07-05 14:23 . 2011-07-05 14:23 -------- d-----w- c:\users\Dajoš\AppData\Roaming\InstallShield
2011-07-05 14:05 . 2010-03-04 19:43 346144 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2011-07-05 14:05 . 2010-01-05 22:39 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2011-07-05 14:05 . 2009-12-03 15:27 74272 ----a-w- c:\windows\system32\RtNicProp64.dll
2011-07-05 13:08 . 2011-07-05 13:08 -------- d-----w- c:\program files\Synaptics
2011-07-05 13:08 . 2009-08-07 07:49 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2011-07-05 13:08 . 2009-12-10 17:25 301104 ----a-w- c:\windows\system32\drivers\SynTP.sys
2011-07-05 13:08 . 2009-12-10 17:20 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2011-07-05 13:08 . 2009-12-10 17:20 147752 ----a-w- c:\windows\system32\SynTPCo4.dll
2011-07-05 13:08 . 2009-12-10 17:20 207144 ----a-w- c:\windows\system32\SynTPAPI.dll
2011-07-05 13:08 . 2009-12-10 17:20 263464 ----a-w- c:\windows\system32\SynCtrl.dll
2011-07-05 13:08 . 2009-12-10 17:20 206120 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2011-07-05 13:08 . 2009-12-10 17:20 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2011-07-05 13:08 . 2009-12-10 17:20 396584 ----a-w- c:\windows\system32\SynCOM.dll
2011-07-05 12:52 . 2011-07-05 12:52 -------- d-----w- c:\program files\IDT
2011-07-05 12:47 . 2009-11-02 12:03 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2011-07-05 12:43 . 2009-02-02 16:27 7347200 ----a-w- c:\windows\system32\RTSUSTORicon.dll
2011-07-05 12:43 . 2011-07-05 14:05 -------- d-----w- c:\program files (x86)\Realtek
2011-07-05 12:43 . 2009-08-10 09:07 222208 ----a-w- c:\windows\system32\drivers\RtsUStor.sys
2011-07-05 12:43 . 2009-06-22 09:52 351744 ----a-w- c:\windows\system32\RtsUStor.dll
2011-07-05 12:22 . 2009-05-13 01:27 652288 ----a-w- c:\windows\system32\ctapo64.dll
2011-07-05 12:22 . 2009-05-13 01:25 511488 ----a-w- c:\windows\system32\ctapo32.dll
2011-07-05 12:22 . 2009-03-02 23:59 165888 ----a-w- c:\windows\system32\AESTAC64.dll
2011-07-05 12:22 . 2009-03-02 23:58 68608 ----a-w- c:\windows\system32\AESTAR64.dll
2011-07-05 12:22 . 2009-03-02 23:08 431104 ----a-w- c:\windows\system32\AESTEC64.dll
2011-07-05 12:22 . 2010-04-07 02:35 431616 ----a-w- c:\windows\system32\stcplx64.dll
2011-07-05 12:22 . 2010-04-07 02:35 3348480 ----a-w- c:\windows\system32\stlang64.dll
2011-07-05 12:22 . 2010-04-07 02:35 1465344 ----a-w- c:\windows\system32\stapo64.dll
2011-07-05 12:22 . 2010-04-07 02:35 12772352 ----a-w- c:\windows\system32\idtcpl64.cpl
2011-07-05 12:22 . 2009-05-13 01:28 57856 ----a-w- c:\windows\system32\ctppld64.dll
2011-07-05 12:22 . 2009-03-02 23:47 90624 ----a-w- c:\windows\system32\AESTCo64.dll
2011-07-05 12:21 . 2010-04-07 02:35 505344 ----a-w- c:\windows\system32\drivers\stwrt64.sys
2011-07-05 12:21 . 2010-04-07 02:35 645632 ------w- c:\windows\system32\stapi64.dll
2011-07-05 12:21 . 2010-04-07 02:35 209920 ----a-w- c:\windows\system32\st646277.dll
2011-07-05 12:18 . 2011-07-05 12:18 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2011-07-05 12:18 . 2009-09-17 10:54 56344 ----a-w- c:\windows\system32\drivers\HECIx64.sys
2011-07-05 12:08 . 2011-07-05 15:17 -------- d-----w- c:\program files\Dell
2011-07-05 12:02 . 2011-07-05 12:02 -------- d-----w- c:\users\Dajoš\AppData\Roaming\Dell
2011-07-05 12:02 . 2011-07-05 12:08 -------- d-----w- c:\programdata\Dell
2011-07-05 12:01 . 2011-07-05 12:02 -------- d-----w- c:\program files\Dell Support Center
2011-07-05 11:57 . 2011-07-05 12:02 -------- d-----w- c:\programdata\PCDr
2011-07-05 11:57 . 2011-07-05 12:01 -------- d-----w- c:\users\Dajoš\AppData\Roaming\PCDr
2011-07-05 11:57 . 2011-07-05 11:57 -------- d-----w- C:\dell
2011-07-04 17:09 . 2011-07-04 17:09 -------- d-----w- c:\program files\CCleaner
2011-07-01 13:14 . 2011-07-28 10:12 -------- d-----w- C:\QIP Infium JadrisPack
2011-07-01 13:04 . 2011-07-01 13:04 -------- d-----w- c:\program files (x86)\QIP 2010
2011-06-29 16:11 . 2011-05-24 11:21 404992 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-06-29 16:11 . 2011-05-24 10:34 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-06-29 16:11 . 2011-05-24 10:34 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-06-29 16:11 . 2011-05-24 10:32 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-06-29 16:11 . 2011-05-24 10:34 64512 ----a-w- c:\windows\SysWow64\devobj.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-25 14:30 . 2011-06-17 06:32 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-01 12:43 . 2011-04-03 19:48 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-06-27 11:45 . 2011-04-03 19:48 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-06-22 06:14 . 2011-04-17 08:42 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2011-06-07 17:10 . 2010-11-03 07:50 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-06-02 05:56 . 2011-07-13 05:54 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-28 03:25 . 2011-06-16 09:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-28 03:00 . 2011-06-16 09:38 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-05-24 17:14 . 2010-11-01 17:16 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-15 08:26 . 2011-05-15 08:26 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-05-04 02:51 . 2011-06-16 09:39 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-05-04 02:51 . 2011-06-16 09:39 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-05-04 02:51 . 2011-06-16 09:39 126464 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-05-03 05:21 . 2011-06-16 09:38 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-03 04:50 . 2011-06-16 09:38 740864 ----a-w- c:\windows\SysWow64\inetcomm.dll
2009-01-29 15:08 . 2009-01-29 15:08 3104768 ----a-w- c:\program files\Truhlář V6_3_5.exe
2009-01-29 14:12 . 2009-01-29 14:12 434176 ----a-w- c:\program files\Faktury.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-28_10.42.36 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-07-28 10:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-07-28 11:40 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-07-28 10:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-28 11:40 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-28 11:40 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-28 10:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-01 19:01 . 2011-07-28 10:43 42814 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-07-28 10:43 33210 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-01 16:59 . 2011-07-28 10:43 15628 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1672503799-4105561473-1797923420-1000_UserData.bin
+ 2010-11-01 17:11 . 2011-07-28 11:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-11-01 17:11 . 2011-07-28 10:42 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-11-01 17:11 . 2011-07-28 11:38 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-11-01 17:11 . 2011-07-28 10:42 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-11-01 17:11 . 2011-07-28 11:38 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-11-01 17:11 . 2011-07-28 10:42 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-01 17:11 . 2011-07-28 11:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-11-01 17:11 . 2011-07-28 10:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-11-01 17:11 . 2011-07-28 10:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-01 17:11 . 2011-07-28 11:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-07-28 11:38 . 2011-07-28 11:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-28 10:41 . 2011-07-28 10:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-28 10:41 . 2011-07-28 10:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-28 11:38 . 2011-07-28 11:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-07-28 10:33 631158 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-07-28 10:55 631158 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-07-28 10:55 654516 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-07-28 10:33 654516 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-07-28 10:33 115504 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-07-28 10:55 115504 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-07-28 10:33 132082 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-07-28 10:55 132082 c:\windows\system32\perfc005.dat
- 2009-07-14 05:01 . 2011-07-28 10:40 331064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-07-28 11:37 331064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 02:34 . 2011-07-27 17:33 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-07-28 11:03 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
"ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-17 1043968]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x]
R3 nmwcdcmx64;Nokia USB Modem;c:\windows\system32\drivers\nmwcdcmx64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\nmwcdx64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d550fa1f2cf8996d\AESTSr64.exe [2009-03-03 89600]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-02-15 33528]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-02-15 822264]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-27 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
2011-07-28 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:09]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files (x86)\IDT\WDM\sttray64.exe" [BU]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-07 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-07 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-07 415256]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-07-05 5107712]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 1123320]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.5.252
FF - ProfilePath - c:\users\Dajoš\AppData\Roaming\Mozilla\Firefox\Profiles\el45y7gz.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
FF - Ext: QipAuthorizer: {32a1fd71-835e-4b11-8e54-886fda0b4c89} - %profile%\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2011-07-28 13:43:06 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-28 11:43
ComboFix2.txt 2011-07-28 10:54
.
Před spuštěním: Volných bajtů: 249 808 420 864
Po spuštění: Volných bajtů: 249 740 857 344
.
- - End Of File - - FBB7B86C3E0F3B89109489C89DD27BBE
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#21 Příspěvek od vyosek »

Nejak se nam neprovedlo co melo, pujdem na to jinak :James008:

:arrow: Stahnete OTM (viz muj podpis)
  • Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

  • Kód: Vybrat vše

    :files
c:\windows\unrar.exe
c:\windows\ufa
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
  • Kliknete na cervene tlacitko MoveIt!
  • Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#22 Příspěvek od aniworld »

All processes killed
========== FILES ==========
c:\windows\unrar.exe moved successfully.
c:\windows\ufa folder moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Dajoš
->Temp folder emptied: 559728 bytes
->Temporary Internet Files folder emptied: 49286 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 71359148 bytes
->Flash cache emptied: 792 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21688 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 69,00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 07282011_140135

Files moved on Reboot...
C:\Users\Dajoš\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Dajoš\AppData\Local\Temp\~DF7D9599BE21D46808.TMP moved successfully.
File C:\Windows\temp\ZLT00be4.TMP not found!

Registry entries deleted on Reboot...
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#23 Příspěvek od vyosek »

Jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#24 Příspěvek od aniworld »

vše vypadá v pořádku, antivir zatím nehlásí žádné problémy, internetové stránky včetně facebooku (který fungoval jak se mu zachtělo nebo vůbec) fungují také
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#25 Příspěvek od vyosek »

Tak jeste uklidime :James008:

:arrow: Odinstalujte Combofix
  • Prejmenujte ComboFix na Uninstall
  • Spustte jej
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner (viz muj podpis)
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: Projedte PC timhle http://go.microsoft.com/?linkid=9748340 a jeste timto http://download.microsoft.com/download/ ... leanUp.exe a jeste timto http://files.avast.com/files/eng/aswclear.exe

:arrow: Nainstalujte Avast free http://www.avast.com/cs-cz/free-antivirus-download

:arrow: Napiste co PC
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#26 Příspěvek od aniworld »

již nezaznamenávám žádné neobvyklé reakce
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#27 Příspěvek od vyosek »

Pokud tedy nejsou problemy ci dotazy, je to z me strany vse :turned:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
aniworld
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 05 Bře 2007 16:49

Re: pravděbodobně FB vir

#28 Příspěvek od aniworld »

díky za pomoc
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: pravděbodobně FB vir

#29 Příspěvek od vyosek »

Nemate zac, rado se stalo :)
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“