Zdravim, zrejme se mi taky do pocitace dostal ten znamy facebook vir a potreboval bych poradit jak na nej. Bohuzel nejsem zrovna moc zrucny s pocitacem, takze nevim jak to pujde. Log prikladam podle navodu.
Logfile of random's system information tool 1.09 (written by random/random)
Run by Kaja at 2011-08-19 20:08:13
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 91 GB (19%) free of 477 GB
Total RAM: 3070 MB (59% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:08:16, on 19.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe
C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMConfig.exe
C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyWow64.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\trend micro\Kaja.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2528058
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: TBSB01620 - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: IMinent Toolbar - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\4Story\PrePatch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [HamaKMCONFIG] C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-10-0\svchost.exe
O4 - HKLM\..\Run: [1945188.exe] "C:\Windows\Temp\1945188.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [3235009.exe] "C:\Users\Kaja\AppData\Local\Temp\3235009.exe"
O4 - HKLM\..\Run: [6341250.exe] "C:\Windows\Temp\6341250.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [82477653-loader2.exe] "C:\Windows\Temp\82477653-loader2.exe"
O4 - HKLM\..\Run: [1914294.exe] "C:\Windows\Temp\1914294.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpyEmergency] C:\Program Files\NETGATE\Spy Emergency\SpyEmergency.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Stavová služba ASP.NET (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton AntiVirus (NAV) - Unknown owner - C:\Program Files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Unknown owner - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe
--
End of file - 12186 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Ati2evxx.exe -Client
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
"C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe"
"C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
"C:\Program Files\NETGATE\Spy Emergency\SpyEmergency.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe" KMConfig.exe
KMConfig.exe
"C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe"
"C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe" /SILENT
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-05f7c25d-f4ae-4775-b801-7b1734a0bca5 -SystemEventPortName:HostProcess-d2730418-477e-4d88-b2e5-c953a9b80a40 -IoCancelEventPortName:HostProcess-b8e0073f-5fdc-49a9-bddb-766f0054486b -NonStateChangingEventPortName:HostProcess-66b96912-14b4-446a-8cf3-06df1e8e804c -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:a7fdcf1d-333e-449a-ab95-445659648482
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe" -Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyWow64.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Users\Kaja\Desktop\RSITx64.exe"
======Scheduled tasks folder======
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906, engine@conduit.com:3.2.5.2, {d3f4b70a-92e0-4393-a0f3-976d03b1ebf5}:3.2.5.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://search.bearshare.com/web?src=ffb&q="
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\plugins\
np32dsw.dll
npdeployJava1.dll
NPOFFICE.DLL
nppdf32.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
BearShareWebSearch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\extensions\
{51a86bb3-6602-4c85-92a5-130ee4864f13}
{C9B68337-E93A-44EA-94DC-CB300EC06444}
{d3f4b70a-92e0-4393-a0f3-976d03b1ebf5}
C:\Users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\searchplugins\
BearShareWebSearch.xml
conduit.xml
daemon-search.xml
icqplugin-1.xml
icqplugin.xml
prohledat-4story-lexikn.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
TBSB01620 Class - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02 2607872]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL []
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-02 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - IMinent Toolbar - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02 2607872]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TNOD UP"=C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe [2010-04-02 1811968]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06 500208]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
"AdobeBridge"=C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe -stealth []
"ICQ"=C:\Program Files (x86)\ICQ7.2\ICQ.exe silent loginmode=4 []
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2010-12-03 14944136]
"SpyEmergency"=C:\Program Files\NETGATE\Spy Emergency\SpyEmergency.exe [2011-06-05 3685208]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-02-10 61440]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2009-11-09 180224]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-08-20 150016]
"4StoryPrePatch"=C:\Program Files (x86)\Gameforge4D\4Story\PrePatch.exe []
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"DivX Download Manager"=C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe start []
"HamaKMCONFIG"=C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe [2008-05-30 212992]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-04 1955208]
"wxpdrv"=C:\Windows\services32.exe [2011-08-19 1215488]
"tray_ico"= []
"tray_ico0"=C:\Windows\update.tray-10-0\svchost.exe [2011-08-19 1215488]
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"1945188.exe"=C:\Windows\Temp\1945188.exe []
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-19 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-19 258048]
"3235009.exe"=C:\Users\Kaja\AppData\Local\Temp\3235009.exe []
"6341250.exe"=C:\Windows\Temp\6341250.exe []
"l1rezerv.exe"=C:\Windows\l1rezerv.exe [2011-08-19 232960]
"82477653-loader2.exe"=C:\Windows\Temp\82477653-loader2.exe []
"1914294.exe"=C:\Windows\Temp\1914294.exe []
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe /nogui []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2011-08-19 19:55:07 ----D---- C:\rsit
2011-08-19 19:55:07 ----D---- C:\Program Files\trend micro
2011-08-19 19:41:52 ----D---- C:\Users\Kaja\AppData\Roaming\Spy Emergency
2011-08-19 19:41:49 ----A---- C:\Windows\system32\drivers\spyemrg_guard.sys
2011-08-19 19:41:49 ----A---- C:\Windows\system32\drivers\spyemrg_access.sys
2011-08-19 19:41:49 ----A---- C:\Windows\system32\drivers\spyemrg.sys
2011-08-19 19:41:47 ----D---- C:\ProgramData\NETGATE
2011-08-19 19:41:41 ----D---- C:\Program Files\NETGATE
2011-08-19 19:24:21 ----D---- C:\Program Files (x86)\ESET
2011-08-19 18:32:07 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-08-19 18:32:07 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2011-08-19 18:21:42 ----D---- C:\Windows\system32\drivers\NISx64
2011-08-19 18:14:30 ----HD---- C:\Windows\update.tray-10-0-lnk
2011-08-19 18:14:30 ----HD---- C:\Windows\update.tray-10-0
2011-08-19 18:11:53 ----D---- C:\Program Files\Symantec
2011-08-19 18:11:53 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-08-19 18:11:53 ----A---- C:\Windows\system32\drivers\SYMEVENT64x86.SYS
2011-08-19 18:10:53 ----D---- C:\Windows\system32\drivers\NAVx64
2011-08-19 17:46:59 ----HD---- C:\Windows\update.tray-7-0-lnk
2011-08-19 17:46:59 ----HD---- C:\Windows\update.tray-7-0
2011-08-19 17:44:57 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-08-19 17:44:56 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-08-19 17:44:55 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-08-19 17:44:52 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-08-19 17:44:49 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-08-19 17:44:09 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2011-08-19 17:44:09 ----A---- C:\Windows\avastSS.scr
2011-08-19 13:27:48 ----HD---- C:\Windows\update.7.1
2011-08-19 11:57:59 ----D---- C:\Program Files (x86)\AMD APP
2011-08-19 11:57:37 ----D---- C:\Program Files\ATI Technologies
2011-08-19 11:54:13 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-19 11:53:47 ----HD---- C:\Windows\update.2
2011-08-19 11:41:22 ----D---- C:\Windows\ufa
2011-08-19 11:41:22 ----D---- C:\Windows\rpcminer
2011-08-19 11:41:22 ----D---- C:\Windows\phoenix
2011-08-19 11:41:13 ----A---- C:\Windows\l1rezerv.exe
2011-08-19 11:40:56 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-19 11:40:30 ----HD---- C:\Windows\update.5.0
2011-08-19 11:40:27 ----A---- C:\Windows\unrar.exe
2011-08-19 11:35:54 ----A---- C:\Windows\iplist.txt
2011-08-19 11:35:26 ----A---- C:\Windows\sysdriver32_.exe
2011-08-19 11:35:12 ----A---- C:\Windows\sysdriver32.exe
2011-08-19 11:34:59 ----D---- C:\Windows\av_ico
2011-08-19 11:34:47 ----A---- C:\Windows\front_ip_list.txt
2011-08-19 11:33:23 ----HD---- C:\Windows\update.1
2011-08-19 11:33:22 ----HD---- C:\Windows\update.tray-2-0-lnk
2011-08-19 11:33:22 ----HD---- C:\Windows\update.tray-2-0
2011-08-19 11:23:09 ----A---- C:\Windows\winlog-ids.txt
2011-08-19 11:23:09 ----A---- C:\Windows\winlog-dirs.txt
2011-08-19 11:23:04 ----A---- C:\Windows\services32.exe
2011-08-13 13:47:33 ----RHD---- C:\Users\Kaja\AppData\Roaming\SecuROM
2011-08-13 13:41:22 ----D---- C:\Program Files (x86)\KONAMI
2011-08-13 11:15:51 ----D---- C:\ProgramData\Sports Interactive
2011-08-13 10:47:10 ----D---- C:\Users\Kaja\AppData\Roaming\Sports Interactive
2011-08-13 10:46:52 ----HD---- C:\Program Files (x86)\Zero G Registry
2011-08-13 10:46:52 ----D---- C:\Program Files (x86)\Sports Interactive
2011-08-11 09:18:44 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-08-10 18:22:58 ----D---- C:\ProgramData\PlayfulAge
2011-08-10 09:49:29 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-10 09:49:29 ----A---- C:\Windows\system32\xmllite.dll
2011-08-10 09:49:28 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-10 09:49:28 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-10 09:49:28 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-10 09:49:28 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-10 09:49:27 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-10 09:49:27 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-10 09:49:27 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-10 09:49:27 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-10 09:49:27 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-10 09:49:26 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-10 09:49:18 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-10 09:49:18 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\wow64win.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\wow64.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\winsrv.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\kernel32.dll
2011-08-10 09:49:18 ----A---- C:\Windows\system32\conhost.exe
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 09:49:17 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 09:49:17 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-10 09:49:17 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-10 09:49:17 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-10 09:49:17 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 09:49:16 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 09:49:15 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 09:49:14 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 09:49:14 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 09:49:14 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 09:49:14 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-10 09:49:14 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-10 09:49:14 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-10 09:49:12 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-10 09:49:10 ----A---- C:\Windows\system32\mshtml.dll
2011-08-10 09:49:08 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 09:49:07 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-10 09:49:05 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 09:49:01 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-10 09:48:59 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-10 09:48:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-10 09:48:57 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 09:48:56 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-10 09:48:56 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-10 09:48:56 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 09:48:56 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-10 09:48:55 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-10 09:48:55 ----A---- C:\Windows\system32\url.dll
2011-08-10 09:48:55 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 09:48:54 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-10 09:48:54 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-10 09:48:54 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-10 09:48:54 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 09:48:54 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 09:48:49 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-10 09:48:48 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-10 09:48:46 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-09 22:35:46 ----D---- C:\ProgramData\MumboJumbo
2011-08-09 15:53:03 ----D---- C:\Users\Kaja\AppData\Roaming\CasualForge
2011-08-09 15:53:03 ----D---- C:\ProgramData\CasualForge
2011-08-09 15:52:43 ----D---- C:\ProgramData\AWEM
2011-08-09 15:52:24 ----D---- C:\Program Files (x86)\Superhry.cz
2011-08-07 17:23:59 ----D---- C:\Users\Kaja\AppData\Roaming\YoudaGames
2011-08-07 17:15:38 ----D---- C:\ProgramData\Big Fish Games
2011-08-04 17:34:43 ----D---- C:\Program Files (x86)\Electronic Arts
======List of files/folders modified in the last 1 month======
2011-08-19 20:03:40 ----D---- C:\Windows\system32\config
2011-08-19 20:03:02 ----D---- C:\Windows\Temp
2011-08-19 19:55:07 ----RD---- C:\Program Files
2011-08-19 19:50:14 ----SD---- C:\Users\Kaja\AppData\Roaming\Microsoft
2011-08-19 19:49:52 ----D---- C:\Users\Kaja\AppData\Roaming\Skype
2011-08-19 19:49:42 ----D---- C:\Users\Kaja\AppData\Roaming\skypePM
2011-08-19 19:47:53 ----D---- C:\Users\Kaja\AppData\Roaming\uTorrent
2011-08-19 19:41:49 ----D---- C:\Windows\system32\drivers
2011-08-19 19:41:47 ----HD---- C:\ProgramData
2011-08-19 19:24:21 ----RD---- C:\Program Files (x86)
2011-08-19 18:22:48 ----D---- C:\Windows\system32\Tasks
2011-08-19 18:15:49 ----D---- C:\Windows
2011-08-19 18:13:10 ----SHD---- C:\System Volume Information
2011-08-19 18:11:53 ----D---- C:\Program Files\Common Files
2011-08-19 18:03:17 ----SHD---- C:\Windows\Installer
2011-08-19 18:02:40 ----SHD---- C:\Config.Msi
2011-08-19 18:02:38 ----RSD---- C:\Windows\assembly
2011-08-19 17:56:08 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-08-19 17:56:08 ----D---- C:\Windows\SysWOW64
2011-08-19 17:55:36 ----D---- C:\Windows\System32
2011-08-19 17:55:36 ----D---- C:\Windows\inf
2011-08-19 17:55:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-19 17:50:48 ----D---- C:\Windows\debug
2011-08-19 17:44:43 ----D---- C:\Windows\winsxs
2011-08-19 17:34:31 ----D---- C:\Windows\system32\catroot2
2011-08-19 16:26:14 ----D---- C:\Users\Kaja\AppData\Roaming\ICQ
2011-08-19 16:19:40 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-19 16:17:32 ----D---- C:\Windows\Tasks
2011-08-19 16:17:32 ----D---- C:\Windows\system32\wfp
2011-08-19 16:17:31 ----D---- C:\Windows\system32\wbem
2011-08-19 16:16:38 ----D---- C:\Windows\system32\DriverStore
2011-08-19 16:16:37 ----D---- C:\Windows\system32\drivers\etc
2011-08-19 16:16:36 ----D---- C:\Windows\registration
2011-08-13 11:08:01 ----D---- C:\Windows\Prefetch
2011-08-11 09:16:12 ----D---- C:\Windows\SYSWOW64\migration
2011-08-11 09:16:12 ----D---- C:\Windows\system32\migration
2011-08-11 09:16:12 ----D---- C:\Windows\AppPatch
2011-08-11 09:16:12 ----D---- C:\Program Files\Internet Explorer
2011-08-11 09:16:12 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-10 21:35:12 ----D---- C:\Windows\system32\catroot
2011-08-10 21:33:10 ----A---- C:\Windows\system32\MRT.exe
2011-08-10 20:58:14 ----D---- C:\Program Files (x86)\EA GAMES
2011-08-10 19:22:59 ----AD---- C:\ProgramData\TEMP
2011-08-04 17:54:12 ----D---- C:\Windows\SYSWOW64\directx
2011-08-04 17:54:04 ----HD---- C:\Windows\msdownld.tmp
2011-08-04 16:00:14 ----D---- C:\Program Files (x86)\DivX
2011-08-01 16:05:40 ----D---- C:\Windows\rescache
2011-07-25 14:15:56 ----D---- C:\Windows\system32\NDF
2011-07-25 09:17:06 ----D---- C:\Program Files\TeamSpeak 3 Client
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-07-31 834544]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [2010-10-21 450608]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [2010-11-18 802864]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-11-16 136584]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-11-09 91568]
R1 SpyEmrg;Spy Emergency Driver; C:\Windows\System32\Drivers\spyemrg.sys [2011-04-21 17240]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\NISx64\1205000.07D\SRTSPX64.SYS [2010-11-23 40568]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\system32\drivers\NISx64\1205000.07D\SYMNETS.SYS [2010-12-01 382072]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-04-07 163888]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2009-12-18 123200]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-02-11 5352960]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver; C:\Windows\System32\Drivers\spyemrg_guard.sys [2011-04-21 18776]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2011-08-19 174640]
S1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys []
S1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys []
S1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [2010-11-16 171128]
S3 dump_wmimmc;dump_wmimmc; \??\C:\Program Files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys []
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-11-16 145336]
S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20101201.025\ENG64.SYS []
S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20101201.025\EX64.SYS []
S3 NPPTNT2;NPPTNT2; \??\C:\Windows\syswow64\npptNT2.sys [2009-04-06 4682]
S3 SpyEmrgAccess;Spy Emergency OnAccess Driver; C:\Windows\System32\Drivers\spyemrg_access.sys [2011-04-21 24408]
S3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\system32\drivers\NISx64\1205000.07D\SRTSP64.SYS [2010-11-23 735864]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S3 X6va003;X6va003; \??\C:\Users\Kaja\AppData\Local\Temp\003C8D7.tmp []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2010-02-11 952320]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Program Files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe [2009-07-01 197120]
R2 SpyEmrgSrv;Spy Emergency Engine Service; C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe [2011-04-21 3629912]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-19 382464]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S2 NAV;Norton AntiVirus; C:\Program Files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe /s NAV /m C:\Program Files (x86)\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll /prefetch:1 []
S2 NIS;Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe /s NIS /m C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll /prefetch:1 []
S2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-19 348672]
S2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-19 632832]
S2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-19 258048]
S2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe [2011-08-19 1215488]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe []
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2010-08-03 3732680]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-27 1255736]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Facebook vir
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: Facebook vir
Zdravím, tohle fixni v HJT :
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2528058
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL (file missing)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\4Story\PrePatch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-10-0\svchost.exe
O4 - HKLM\..\Run: [1945188.exe] "C:\Windows\Temp\1945188.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [3235009.exe] "C:\Users\Kaja\AppData\Local\Temp\3235009.exe"
O4 - HKLM\..\Run: [6341250.exe] "C:\Windows\Temp\6341250.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [82477653-loader2.exe] "C:\Windows\Temp\82477653-loader2.exe"
O4 - HKLM\..\Run: [1914294.exe] "C:\Windows\Temp\1914294.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
HJT najdeš zde :
C:\Program Files\trend micro\Kaja.exe
Fix znamená že spustíš HJT
jako admin
v okně které se ti otevře klikneš na Do a system scan only
v dalším okně najdeš řádky které jsem ti vypsal,
vedle nich je čtvereček do kterého uděláš zatržítko,
pak klikneš na Fix checked které je vlevo dole,
program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.
Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :
ddservice
Služba Google Update (gupdate)
Služba Google Update (gupdatem)
NBService - Nero AG
NMIndexingService - Nero AG
srvbtcclient
srviecheck
srvsysdriver32
wxpdrivers
klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.
Přes Odebrat programy odinstaluj přebytečné antiviry a ponech pouze jeden.
Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2528058
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL (file missing)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\4Story\PrePatch.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-10-0\svchost.exe
O4 - HKLM\..\Run: [1945188.exe] "C:\Windows\Temp\1945188.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [3235009.exe] "C:\Users\Kaja\AppData\Local\Temp\3235009.exe"
O4 - HKLM\..\Run: [6341250.exe] "C:\Windows\Temp\6341250.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [82477653-loader2.exe] "C:\Windows\Temp\82477653-loader2.exe"
O4 - HKLM\..\Run: [1914294.exe] "C:\Windows\Temp\1914294.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
HJT najdeš zde :
C:\Program Files\trend micro\Kaja.exe
Fix znamená že spustíš HJT
jako adminv okně které se ti otevře klikneš na Do a system scan only
v dalším okně najdeš řádky které jsem ti vypsal,
vedle nich je čtvereček do kterého uděláš zatržítko,
pak klikneš na Fix checked které je vlevo dole,
program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.
Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :
ddservice
Služba Google Update (gupdate)
Služba Google Update (gupdatem)
NBService - Nero AG
NMIndexingService - Nero AG
srvbtcclient
srviecheck
srvsysdriver32
wxpdrivers
klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.
Přes Odebrat programy odinstaluj přebytečné antiviry a ponech pouze jeden.
Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!
Re: Facebook vir
Zdravím, přikládám protokol Mbam
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Verze databáze: 7587
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
27.8.2011 18:02:56
mbam-log-2011-08-27 (18-02-50).txt
Typ kontroly: Rychlý test
Testované objekty: 208262
Uplynulý čas: 13 minut, 21 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 9
Infikované hodnoty v registru: 4
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 15
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\DDSERVICE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WXPDRIVERS (Trojan.Agent) -> No action taken.
Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5835704.exe (Trojan.Downloader.Gen) -> Value: 5835704.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddservice\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.
Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.
Infikované soubory:
c:\Windows\Temp\70276_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Verze databáze: 7587
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
27.8.2011 18:02:56
mbam-log-2011-08-27 (18-02-50).txt
Typ kontroly: Rychlý test
Testované objekty: 208262
Uplynulý čas: 13 minut, 21 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 9
Infikované hodnoty v registru: 4
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 15
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\DDSERVICE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WXPDRIVERS (Trojan.Agent) -> No action taken.
Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5835704.exe (Trojan.Downloader.Gen) -> Value: 5835704.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddservice\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.
Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.
Infikované soubory:
c:\Windows\Temp\70276_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.
Re: Facebook vir
Vše co Mbam našel nech smazat.
Nyní použijeme větší kalibr tak že pozorně čti, protože tenhle softík netoleruje chyby.
Stáhni a ulož na plochu ComboFix,
spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.
Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,
pak ještě jednou klik na ANO a už to jede.
Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.
Při skenovaní může být PC i restartováno nelekat se.
Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,
protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.
Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt
(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.
V případě nejasností je ZDE obrázkový návod.
Nyní použijeme větší kalibr tak že pozorně čti, protože tenhle softík netoleruje chyby.
Stáhni a ulož na plochu ComboFix,
spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.
Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,
pak ještě jednou klik na ANO a už to jede.
Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.
Při skenovaní může být PC i restartováno nelekat se.
Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,
protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.
Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt
(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.
V případě nejasností je ZDE obrázkový návod.
Re: Facebook vir
Přeji krásné nedělní ráno.
Projel jsem pc ComboFixem a přikládám log.
ComboFix 11-08-27.01 - Kaja 28.08.2011 8:52.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3070.1939 [GMT 2:00]
Spuštěný z: c:\users\Kaja\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
c:\users\Kaja\AppData\Roaming\Local
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv(2)(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2)
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\[CNT_Naruto_Shippuuden_202_[F3A43F08(2).mkv
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\users\Kaja\Documents\1491.doc
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\b06daa0d4f17c7dc46f72f1c164c221e.elf
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\fde7516325fa75f8c98460cdad5f6a2e.elf
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\549a889c363cee1938a7e3db8c01051b.elf
c:\windows\phoenix\kernels\poclbm\b70640f7a57fe0f7277c0e538cfd65f9.elf
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\update.7.1
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_conhost.exe pid: 1620 24: c:\windows\System32\cs-CZ\conhost.exe.mui
-------\Service_Copyright (C) 1997-2008 Mark Russinovich
-------\Service_csrss.exe pid: 484 3C: c:\windows\System32\cs-CZ\csrss.exe.mui
-------\Service_dwm.exe pid: 2372 24: c:\windows\System32\cs-CZ\dwm.exe.mui
-------\Service_explorer.exe pid: 2412 38: c:\windows\cs-CZ\explorer.exe.mui
-------\Service_Handle v3.42
-------\Service_lsm.exe pid: 672 260: c:\windows\System32\cs-CZ\lsm.exe.mui
-------\Service_SearchIndexer.exe pid: 2788 38: c:\windows\System32\cs-CZ\SearchIndexer.exe.mui
-------\Service_services.exe pid: 616 48: c:\windows\System32\cs-CZ\services.exe.mui
-------\Service_spoolsv.exe pid: 1228 30: c:\windows\System32\cs-CZ\spoolsv.exe.mui
-------\Service_srviecheck
-------\Service_svchost.exe pid: 1004 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1096 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1260 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1768 8C: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1992 F0: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2016 138: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2576 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 260 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2768 C8: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 3992 90: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 760 84: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 840 180: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 856 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 956 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_Sysinternals - www.sysinternals.com
-------\Service_taskhost.exe pid: 2292 30: c:\windows\System32\cs-CZ\taskhost.exe.mui
-------\Service_wmpnetwk.exe pid: 2852 3C: c:\program files\Windows Media Player\cs-CZ\wmpnetwk.exe.mui
-------\Service_WUDFHost.exe pid: 2148 3C: c:\windows\System32\cs-CZ\WUDFHost.exe.mui
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\kajík\AppData\Local\temp
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\Haninka\AppData\Local\temp
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\users\Kaja\AppData\Roaming\Malwarebytes
2011-08-27 15:47 . 2010-11-29 15:42 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-27 15:47 . 2010-11-29 15:42 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:37 . 2011-08-27 15:37 -------- d-----w- c:\program files\ESET
2011-08-27 15:25 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:25 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-27 15:23 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69ABD40D-D8BE-4917-B146-5D9565359DCB}\mpengine.dll
2011-08-19 17:55 . 2011-08-27 15:28 -------- d-----w- c:\program files\trend micro
2011-08-19 17:55 . 2011-08-19 17:55 -------- d-----w- C:\rsit
2011-08-19 16:32 . 2011-08-19 17:45 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-19 16:32 . 2011-08-19 17:42 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-08-19 16:21 . 2011-08-19 16:21 -------- d-----w- c:\windows\system32\drivers\NISx64
2011-08-19 16:14 . 2011-08-27 15:45 -------- d--h--w- c:\windows\update.tray-10-0-lnk
2011-08-19 16:14 . 2011-08-22 15:35 -------- d--h--w- c:\windows\update.tray-10-0
2011-08-19 16:11 . 2011-08-19 16:22 -------- d-----w- c:\program files\Symantec
2011-08-19 16:11 . 2011-08-19 16:22 174640 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-08-19 16:11 . 2011-08-19 16:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-08-19 16:10 . 2011-08-19 16:10 -------- d-----w- c:\windows\system32\drivers\NAVx64
2011-08-19 15:46 . 2011-08-27 18:10 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-19 15:46 . 2011-08-27 15:45 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-19 15:44 . 2010-06-28 20:32 20048 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 15:44 . 2010-06-28 20:37 121936 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 15:44 . 2010-06-28 20:33 28752 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 15:44 . 2010-06-28 20:37 51280 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 15:44 . 2010-06-28 20:33 61008 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 15:44 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2011-08-19 15:44 . 2010-06-28 20:57 165032 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files\ATI Technologies
2011-08-19 09:41 . 2011-08-21 09:27 -------- d-----w- c:\windows\ufa
2011-08-19 09:40 . 2011-08-21 09:24 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 09:34 . 2011-08-19 16:16 -------- d-----w- c:\windows\av_ico
2011-08-19 09:33 . 2011-08-27 18:10 -------- d--h--w- c:\windows\update.tray-2-0
2011-08-19 09:33 . 2011-08-27 17:12 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-08-13 11:47 . 2011-08-13 11:47 -------- d--h--r- c:\users\Kaja\AppData\Roaming\SecuROM
2011-08-13 11:41 . 2011-08-13 11:41 -------- d-----w- c:\program files (x86)\KONAMI
2011-08-13 09:15 . 2011-08-13 09:15 -------- d-----w- c:\programdata\Sports Interactive
2011-08-13 09:14 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Local\Sports Interactive
2011-08-13 08:47 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Roaming\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\program files (x86)\Zero G Registry
2011-08-13 08:46 . 2011-08-13 08:46 -------- d-----w- c:\program files (x86)\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\users\Kaja\InstallAnywhere
2011-08-11 07:18 . 2011-08-11 07:18 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 16:22 . 2011-08-10 16:22 -------- d-----w- c:\programdata\PlayfulAge
2011-08-09 20:35 . 2011-08-09 20:35 -------- d-----w- c:\programdata\MumboJumbo
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\users\Kaja\AppData\Roaming\CasualForge
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\programdata\CasualForge
2011-08-09 13:52 . 2011-08-09 13:52 -------- d-----w- c:\programdata\AWEM
2011-08-09 13:52 . 2011-08-19 15:34 -------- d-----w- c:\program files (x86)\Superhry.cz
2011-08-07 15:23 . 2011-08-09 17:08 -------- d-----w- c:\users\Kaja\AppData\Roaming\YoudaGames
2011-08-07 15:15 . 2011-08-19 15:30 -------- d-----w- c:\programdata\Big Fish Games
2011-08-04 16:39 . 2011-08-04 16:39 -------- d-----w- c:\users\Kaja\AppData\Local\Electronic Arts
2011-08-04 15:34 . 2011-08-19 15:56 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-07-29 15:17 . 2011-07-29 15:17 -------- d-----w- c:\users\Haninka\AppData\Roaming\Zoner
2011-07-29 15:17 . 2011-07-29 15:17 -------- d-----w- c:\users\Haninka\AppData\Local\Zoner
2011-07-29 14:39 . 2011-08-21 09:19 -------- d-----w- c:\users\Haninka\AppData\Local\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 05:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-16 05:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-16 04:26 . 2011-08-10 07:49 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-10 17:32 . 2011-07-10 15:52 4068763169 ----a-w- C:\L2_CT1_Hellbound-Live.zip
2011-07-05 09:07 . 2011-07-05 09:07 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
2011-07-02 06:14 . 2011-06-25 13:25 183112 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-25 13:26 . 2011-06-25 13:26 66872 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-17 18:20 . 2011-06-04 05:30 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2011-06-11 03:07 . 2011-07-13 05:35 3137536 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
2010-07-02 07:54 2607872 ----a-w- c:\program files (x86)\IMinent Toolbar\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{977AE9CC-AF83-45E8-9E03-E2798216E2D5}"= "c:\program files (x86)\IMinent Toolbar\tbcore3.dll" [2010-07-02 2607872]
.
[HKEY_CLASSES_ROOT\clsid\{977ae9cc-af83-45e8-9e03-e2798216e2d5}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-12-03 14944136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HamaKMCONFIG"="c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe" [2008-05-29 212992]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe [x]
R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [x]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va003;X6va003;c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp [x]
R4 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
R4 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-11-16 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe [2009-07-01 197120]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2716216]
"combofix"="c:\combofix\CF8071.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ7.2\ICQ.exe
Wow6432Node-HKCU-Run-SpyEmergency - c:\program files\NETGATE\Spy Emergency\SpyEmergency.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico1 - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
WebBrowser-{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)
HKLM-Run-TNOD UP - c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
.
.
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\conhost.exe pid: 1620 24: C:]
--
"ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\csrss.exe pid: 484 3C: C:]
--
"ImagePath"="\??\c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\dwm.exe pid: 2372 24: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\exfat]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\explorer.exe pid: 2412 38: C:]
--
"ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\lsm.exe pid: 672 260: C:]
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
"ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SearchIndexer.exe pid: 2788 38: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\services.exe pid: 616 48: C:]
--
"ImagePath"="%SystemRoot%\System32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\spoolsv.exe pid: 1228 30: C:]
--
"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1004 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1096 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1768 8C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1992 F0: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2016 138: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2576 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2768 C8: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 3992 90: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 760 84: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 840 180: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 856 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 956 34: C:]
--
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\taskhost.exe pid: 2292 30: C:]
--
"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\wmpnetwk.exe pid: 2852 3C: C:]
--
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 2148 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va003]
"ImagePath"="\??\c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}]
@Denied: (A 2) (Everyone)
@="FlashProp Class"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMConfig.exe
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe
.
**************************************************************************
.
Celkový čas: 2011-08-28 09:33:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-28 07:33
.
Před spuštěním: Volných bajtů: 96 066 224 128
Po spuštění: Volných bajtů: 96 037 195 776
.
- - End Of File - - 99BD9C3F5B8CE0827D9EABB68D70700D
Projel jsem pc ComboFixem a přikládám log.
ComboFix 11-08-27.01 - Kaja 28.08.2011 8:52.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3070.1939 [GMT 2:00]
Spuštěný z: c:\users\Kaja\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
c:\users\Kaja\AppData\Roaming\Local
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv(2)(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx(2).ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2)
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\[CNT_Naruto_Shippuuden_202_[F3A43F08(2).mkv
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\[CNT_Naruto_Shippuuden_202_[F3A43F08.mkv
c:\users\Kaja\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\users\Kaja\Documents\1491.doc
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\b06daa0d4f17c7dc46f72f1c164c221e.elf
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\fde7516325fa75f8c98460cdad5f6a2e.elf
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\549a889c363cee1938a7e3db8c01051b.elf
c:\windows\phoenix\kernels\poclbm\b70640f7a57fe0f7277c0e538cfd65f9.elf
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\update.7.1
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_conhost.exe pid: 1620 24: c:\windows\System32\cs-CZ\conhost.exe.mui
-------\Service_Copyright (C) 1997-2008 Mark Russinovich
-------\Service_csrss.exe pid: 484 3C: c:\windows\System32\cs-CZ\csrss.exe.mui
-------\Service_dwm.exe pid: 2372 24: c:\windows\System32\cs-CZ\dwm.exe.mui
-------\Service_explorer.exe pid: 2412 38: c:\windows\cs-CZ\explorer.exe.mui
-------\Service_Handle v3.42
-------\Service_lsm.exe pid: 672 260: c:\windows\System32\cs-CZ\lsm.exe.mui
-------\Service_SearchIndexer.exe pid: 2788 38: c:\windows\System32\cs-CZ\SearchIndexer.exe.mui
-------\Service_services.exe pid: 616 48: c:\windows\System32\cs-CZ\services.exe.mui
-------\Service_spoolsv.exe pid: 1228 30: c:\windows\System32\cs-CZ\spoolsv.exe.mui
-------\Service_srviecheck
-------\Service_svchost.exe pid: 1004 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1096 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1260 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1768 8C: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 1992 F0: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2016 138: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2576 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 260 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 2768 C8: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 3992 90: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 760 84: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 840 180: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 856 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_svchost.exe pid: 956 34: c:\windows\System32\cs-CZ\svchost.exe.mui
-------\Service_Sysinternals - www.sysinternals.com
-------\Service_taskhost.exe pid: 2292 30: c:\windows\System32\cs-CZ\taskhost.exe.mui
-------\Service_wmpnetwk.exe pid: 2852 3C: c:\program files\Windows Media Player\cs-CZ\wmpnetwk.exe.mui
-------\Service_WUDFHost.exe pid: 2148 3C: c:\windows\System32\cs-CZ\WUDFHost.exe.mui
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\kajík\AppData\Local\temp
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\Haninka\AppData\Local\temp
2011-08-28 07:16 . 2011-08-28 07:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\users\Kaja\AppData\Roaming\Malwarebytes
2011-08-27 15:47 . 2010-11-29 15:42 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-27 15:47 . 2010-11-29 15:42 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:37 . 2011-08-27 15:37 -------- d-----w- c:\program files\ESET
2011-08-27 15:25 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:25 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-27 15:23 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69ABD40D-D8BE-4917-B146-5D9565359DCB}\mpengine.dll
2011-08-19 17:55 . 2011-08-27 15:28 -------- d-----w- c:\program files\trend micro
2011-08-19 17:55 . 2011-08-19 17:55 -------- d-----w- C:\rsit
2011-08-19 16:32 . 2011-08-19 17:45 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-19 16:32 . 2011-08-19 17:42 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-08-19 16:21 . 2011-08-19 16:21 -------- d-----w- c:\windows\system32\drivers\NISx64
2011-08-19 16:14 . 2011-08-27 15:45 -------- d--h--w- c:\windows\update.tray-10-0-lnk
2011-08-19 16:14 . 2011-08-22 15:35 -------- d--h--w- c:\windows\update.tray-10-0
2011-08-19 16:11 . 2011-08-19 16:22 -------- d-----w- c:\program files\Symantec
2011-08-19 16:11 . 2011-08-19 16:22 174640 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-08-19 16:11 . 2011-08-19 16:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-08-19 16:10 . 2011-08-19 16:10 -------- d-----w- c:\windows\system32\drivers\NAVx64
2011-08-19 15:46 . 2011-08-27 18:10 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-19 15:46 . 2011-08-27 15:45 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-19 15:44 . 2010-06-28 20:32 20048 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 15:44 . 2010-06-28 20:37 121936 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 15:44 . 2010-06-28 20:33 28752 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 15:44 . 2010-06-28 20:37 51280 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 15:44 . 2010-06-28 20:33 61008 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 15:44 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2011-08-19 15:44 . 2010-06-28 20:57 165032 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files\ATI Technologies
2011-08-19 09:41 . 2011-08-21 09:27 -------- d-----w- c:\windows\ufa
2011-08-19 09:40 . 2011-08-21 09:24 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 09:34 . 2011-08-19 16:16 -------- d-----w- c:\windows\av_ico
2011-08-19 09:33 . 2011-08-27 18:10 -------- d--h--w- c:\windows\update.tray-2-0
2011-08-19 09:33 . 2011-08-27 17:12 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-08-13 11:47 . 2011-08-13 11:47 -------- d--h--r- c:\users\Kaja\AppData\Roaming\SecuROM
2011-08-13 11:41 . 2011-08-13 11:41 -------- d-----w- c:\program files (x86)\KONAMI
2011-08-13 09:15 . 2011-08-13 09:15 -------- d-----w- c:\programdata\Sports Interactive
2011-08-13 09:14 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Local\Sports Interactive
2011-08-13 08:47 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Roaming\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\program files (x86)\Zero G Registry
2011-08-13 08:46 . 2011-08-13 08:46 -------- d-----w- c:\program files (x86)\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\users\Kaja\InstallAnywhere
2011-08-11 07:18 . 2011-08-11 07:18 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 16:22 . 2011-08-10 16:22 -------- d-----w- c:\programdata\PlayfulAge
2011-08-09 20:35 . 2011-08-09 20:35 -------- d-----w- c:\programdata\MumboJumbo
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\users\Kaja\AppData\Roaming\CasualForge
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\programdata\CasualForge
2011-08-09 13:52 . 2011-08-09 13:52 -------- d-----w- c:\programdata\AWEM
2011-08-09 13:52 . 2011-08-19 15:34 -------- d-----w- c:\program files (x86)\Superhry.cz
2011-08-07 15:23 . 2011-08-09 17:08 -------- d-----w- c:\users\Kaja\AppData\Roaming\YoudaGames
2011-08-07 15:15 . 2011-08-19 15:30 -------- d-----w- c:\programdata\Big Fish Games
2011-08-04 16:39 . 2011-08-04 16:39 -------- d-----w- c:\users\Kaja\AppData\Local\Electronic Arts
2011-08-04 15:34 . 2011-08-19 15:56 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-07-29 15:17 . 2011-07-29 15:17 -------- d-----w- c:\users\Haninka\AppData\Roaming\Zoner
2011-07-29 15:17 . 2011-07-29 15:17 -------- d-----w- c:\users\Haninka\AppData\Local\Zoner
2011-07-29 14:39 . 2011-08-21 09:19 -------- d-----w- c:\users\Haninka\AppData\Local\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 05:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-16 05:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-16 04:26 . 2011-08-10 07:49 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-10 17:32 . 2011-07-10 15:52 4068763169 ----a-w- C:\L2_CT1_Hellbound-Live.zip
2011-07-05 09:07 . 2011-07-05 09:07 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
2011-07-02 06:14 . 2011-06-25 13:25 183112 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-25 13:26 . 2011-06-25 13:26 66872 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-17 18:20 . 2011-06-04 05:30 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2011-06-11 03:07 . 2011-07-13 05:35 3137536 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
2010-07-02 07:54 2607872 ----a-w- c:\program files (x86)\IMinent Toolbar\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{977AE9CC-AF83-45E8-9E03-E2798216E2D5}"= "c:\program files (x86)\IMinent Toolbar\tbcore3.dll" [2010-07-02 2607872]
.
[HKEY_CLASSES_ROOT\clsid\{977ae9cc-af83-45e8-9e03-e2798216e2d5}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-12-03 14944136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HamaKMCONFIG"="c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe" [2008-05-29 212992]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe [x]
R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [x]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va003;X6va003;c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp [x]
R4 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
R4 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-11-16 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe [2009-07-01 197120]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2716216]
"combofix"="c:\combofix\CF8071.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ7.2\ICQ.exe
Wow6432Node-HKCU-Run-SpyEmergency - c:\program files\NETGATE\Spy Emergency\SpyEmergency.exe
Wow6432Node-HKLM-Run-tray_ico - (no file)
Wow6432Node-HKLM-Run-tray_ico1 - (no file)
Wow6432Node-HKLM-Run-tray_ico2 - (no file)
Wow6432Node-HKLM-Run-tray_ico3 - (no file)
Wow6432Node-HKLM-Run-tray_ico4 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
WebBrowser-{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)
HKLM-Run-TNOD UP - c:\program files (x86)\TNod User & Password Finder\TNODUP.exe
.
.
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\conhost.exe pid: 1620 24: C:]
--
"ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\csrss.exe pid: 484 3C: C:]
--
"ImagePath"="\??\c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\dwm.exe pid: 2372 24: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\exfat]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\explorer.exe pid: 2412 38: C:]
--
"ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\lsm.exe pid: 672 260: C:]
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
"ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SearchIndexer.exe pid: 2788 38: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\services.exe pid: 616 48: C:]
--
"ImagePath"="%SystemRoot%\System32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\spoolsv.exe pid: 1228 30: C:]
--
"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1004 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1096 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1768 8C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1992 F0: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2016 138: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2576 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2768 C8: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 3992 90: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 760 84: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 840 180: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 856 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 956 34: C:]
--
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\taskhost.exe pid: 2292 30: C:]
--
"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\wmpnetwk.exe pid: 2852 3C: C:]
--
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 2148 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va003]
"ImagePath"="\??\c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}]
@Denied: (A 2) (Everyone)
@="FlashProp Class"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMConfig.exe
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe
.
**************************************************************************
.
Celkový čas: 2011-08-28 09:33:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-28 07:33
.
Před spuštěním: Volných bajtů: 96 066 224 128
Po spuštění: Volných bajtů: 96 037 195 776
.
- - End Of File - - 99BD9C3F5B8CE0827D9EABB68D70700D
Re: Facebook vir
Ahojky 
Pokud jsi tak ještě neučinil, přesuň Combofix na plochu
otevři si Poznámkový blok
do něj zkopíruj skript z následujícího okna:
ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,
po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:
Po aplikaci na Tebe vypadne další log, zkopíruj ho sem
Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,
v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci
Pokud jsi tak ještě neučinil, přesuň Combofix na plochu
otevři si Poznámkový blok
do něj zkopíruj skript z následujícího okna:
Kód: Vybrat vše
File::
c:\windows\unrar.exe
c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp
Folder::
c:\windows\update.tray-10-0-lnk
c:\windows\update.tray-10-0
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-2-0
c:\windows\update.tray-2-0-lnk
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va003]
"ImagePath"=-
RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
Driver::
X6va003
FireFox::
FF - ProfilePath - c:\users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q=
po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:
Po aplikaci na Tebe vypadne další log, zkopíruj ho sem
Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,
v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci
Re: Facebook vir
Nazdárek,
opět jsem projel ComboFixem a přikládám log.
ComboFix 11-08-28.01 - Kaja 29.08.2011 9:21.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3070.2268 [GMT 2:00]
Spuštěný z: c:\users\Kaja\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Kaja\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\av_ico\ico_norton_start.ico
c:\windows\ufa
c:\windows\unrar.exe
c:\windows\update.tray-10-0-lnk
c:\windows\update.tray-10-0
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_X6VA003
-------\Service_Copyright (C) 1997-2008 Mark Russinovich
-------\Service_Handle v3.42
-------\Service_Sysinternals - www.sysinternals.com
-------\Service_WUDFHost.exe pid: 1604 3C: c:\windows\System32\cs-CZ\WUDFHost.exe.mui
-------\Service_X6va003
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\kajík\AppData\Local\temp
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\Haninka\AppData\Local\temp
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\users\Kaja\AppData\Roaming\Malwarebytes
2011-08-27 15:47 . 2010-11-29 15:42 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-27 15:47 . 2010-11-29 15:42 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:37 . 2011-08-27 15:37 -------- d-----w- c:\program files\ESET
2011-08-27 15:25 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:25 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-27 15:23 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69ABD40D-D8BE-4917-B146-5D9565359DCB}\mpengine.dll
2011-08-19 17:55 . 2011-08-27 15:28 -------- d-----w- c:\program files\trend micro
2011-08-19 17:55 . 2011-08-19 17:55 -------- d-----w- C:\rsit
2011-08-19 16:32 . 2011-08-19 17:45 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-19 16:32 . 2011-08-19 17:42 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-08-19 16:21 . 2011-08-19 16:21 -------- d-----w- c:\windows\system32\drivers\NISx64
2011-08-19 16:11 . 2011-08-19 16:22 -------- d-----w- c:\program files\Symantec
2011-08-19 16:11 . 2011-08-19 16:22 174640 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-08-19 16:11 . 2011-08-19 16:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-08-19 16:10 . 2011-08-19 16:10 -------- d-----w- c:\windows\system32\drivers\NAVx64
2011-08-19 15:44 . 2010-06-28 20:32 20048 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 15:44 . 2010-06-28 20:37 121936 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 15:44 . 2010-06-28 20:33 28752 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 15:44 . 2010-06-28 20:37 51280 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 15:44 . 2010-06-28 20:33 61008 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 15:44 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2011-08-19 15:44 . 2010-06-28 20:57 165032 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files\ATI Technologies
2011-08-13 11:47 . 2011-08-13 11:47 -------- d--h--r- c:\users\Kaja\AppData\Roaming\SecuROM
2011-08-13 11:41 . 2011-08-13 11:41 -------- d-----w- c:\program files (x86)\KONAMI
2011-08-13 09:15 . 2011-08-13 09:15 -------- d-----w- c:\programdata\Sports Interactive
2011-08-13 09:14 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Local\Sports Interactive
2011-08-13 08:47 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Roaming\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\program files (x86)\Zero G Registry
2011-08-13 08:46 . 2011-08-13 08:46 -------- d-----w- c:\program files (x86)\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\users\Kaja\InstallAnywhere
2011-08-11 07:18 . 2011-08-11 07:18 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 16:22 . 2011-08-10 16:22 -------- d-----w- c:\programdata\PlayfulAge
2011-08-09 20:35 . 2011-08-09 20:35 -------- d-----w- c:\programdata\MumboJumbo
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\users\Kaja\AppData\Roaming\CasualForge
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\programdata\CasualForge
2011-08-09 13:52 . 2011-08-09 13:52 -------- d-----w- c:\programdata\AWEM
2011-08-09 13:52 . 2011-08-19 15:34 -------- d-----w- c:\program files (x86)\Superhry.cz
2011-08-07 15:23 . 2011-08-09 17:08 -------- d-----w- c:\users\Kaja\AppData\Roaming\YoudaGames
2011-08-07 15:15 . 2011-08-19 15:30 -------- d-----w- c:\programdata\Big Fish Games
2011-08-04 16:39 . 2011-08-04 16:39 -------- d-----w- c:\users\Kaja\AppData\Local\Electronic Arts
2011-08-04 15:34 . 2011-08-19 15:56 -------- d-----w- c:\program files (x86)\Electronic Arts
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 05:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-16 05:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-16 04:26 . 2011-08-10 07:49 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-10 17:32 . 2011-07-10 15:52 4068763169 ----a-w- C:\L2_CT1_Hellbound-Live.zip
2011-07-05 09:07 . 2011-07-05 09:07 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
2011-07-02 06:14 . 2011-06-25 13:25 183112 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-25 13:26 . 2011-06-25 13:26 66872 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-17 18:20 . 2011-06-04 05:30 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2011-06-11 03:07 . 2011-07-13 05:35 3137536 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-28_07.28.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-26 15:36 . 2011-08-29 04:42 51068 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-29 04:42 46222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-07-26 15:02 . 2011-08-29 04:42 24336 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1995608721-1024494364-1175723090-1000_UserData.bin
- 2003-01-03 23:35 . 2011-08-27 20:18 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2003-01-03 23:35 . 2011-08-28 11:58 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2003-01-03 23:35 . 2011-08-28 11:58 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2003-01-03 23:35 . 2011-08-27 20:18 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-28 11:58 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-27 20:18 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-27 07:10 . 2011-08-29 07:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-07-27 07:10 . 2011-08-28 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-27 07:10 . 2011-08-29 07:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-07-27 07:10 . 2011-08-28 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-29 07:53 . 2011-08-29 07:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-28 07:26 . 2011-08-28 07:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-28 07:26 . 2011-08-28 07:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-29 07:53 . 2011-08-29 07:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-07-27 09:43 . 2011-08-28 10:49 451966 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:01 . 2011-08-28 07:25 340684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-29 07:53 340684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-04-09 20:23 . 2011-08-29 07:53 1315580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1995608721-1024494364-1175723090-1000-12288.dat
- 2011-04-09 20:23 . 2011-08-28 07:25 1315580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1995608721-1024494364-1175723090-1000-12288.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
2010-07-02 07:54 2607872 ----a-w- c:\program files (x86)\IMinent Toolbar\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{977AE9CC-AF83-45E8-9E03-E2798216E2D5}"= "c:\program files (x86)\IMinent Toolbar\tbcore3.dll" [2010-07-02 2607872]
.
[HKEY_CLASSES_ROOT\clsid\{977ae9cc-af83-45e8-9e03-e2798216e2d5}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-12-03 14944136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HamaKMCONFIG"="c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe" [2008-05-29 212992]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe [x]
R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [x]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
R4 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-11-16 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe [2009-07-01 197120]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TNOD UP"="c:\program files (x86)\TNod User & Password Finder\TNODUP.exe" [BU]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2716216]
"combofix"="c:\combofix\CF2640.3XE" [2010-11-20 345088]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
WebBrowser-{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)
.
.
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\conhost.exe pid: 1620 24: C:]
--
"ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\csrss.exe pid: 484 3C: C:]
--
"ImagePath"="\??\c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\dwm.exe pid: 2372 24: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\exfat]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\explorer.exe pid: 2412 38: C:]
--
"ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\lsm.exe pid: 672 260: C:]
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
"ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SearchIndexer.exe pid: 2788 38: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\services.exe pid: 616 48: C:]
--
"ImagePath"="%SystemRoot%\System32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\spoolsv.exe pid: 1228 30: C:]
--
"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1004 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1096 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1768 8C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1992 F0: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2016 138: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2576 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2768 C8: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 3992 90: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 760 84: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 840 180: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 856 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 956 34: C:]
--
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\taskhost.exe pid: 2292 30: C:]
--
"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\wmpnetwk.exe pid: 2852 3C: C:]
--
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 1604 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 2148 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}]
@Denied: (A 2) (Everyone)
@="FlashProp Class"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMConfig.exe
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 10:00:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 08:00
ComboFix2.txt 2011-08-28 07:33
.
Před spuštěním: Volných bajtů: 96 604 532 736
Po spuštění: Volných bajtů: 96 525 377 536
.
- - End Of File - - CD7733FF10BABFF6D10FBD422757915B
opět jsem projel ComboFixem a přikládám log.
ComboFix 11-08-28.01 - Kaja 29.08.2011 9:21.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3070.2268 [GMT 2:00]
Spuštěný z: c:\users\Kaja\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Kaja\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Kaja\AppData\Local\Temp\003C8D7.tmp"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\av_ico\ico_norton_start.ico
c:\windows\ufa
c:\windows\unrar.exe
c:\windows\update.tray-10-0-lnk
c:\windows\update.tray-10-0
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_X6VA003
-------\Service_Copyright (C) 1997-2008 Mark Russinovich
-------\Service_Handle v3.42
-------\Service_Sysinternals - www.sysinternals.com
-------\Service_WUDFHost.exe pid: 1604 3C: c:\windows\System32\cs-CZ\WUDFHost.exe.mui
-------\Service_X6va003
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-29 )))))))))))))))))))))))))))))))
.
.
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\kajík\AppData\Local\temp
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\Haninka\AppData\Local\temp
2011-08-29 07:44 . 2011-08-29 07:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\users\Kaja\AppData\Roaming\Malwarebytes
2011-08-27 15:47 . 2010-11-29 15:42 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:47 . 2011-08-27 15:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-27 15:47 . 2010-11-29 15:42 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:37 . 2011-08-27 15:37 -------- d-----w- c:\program files\ESET
2011-08-27 15:25 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-27 15:25 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-27 15:23 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69ABD40D-D8BE-4917-B146-5D9565359DCB}\mpengine.dll
2011-08-19 17:55 . 2011-08-27 15:28 -------- d-----w- c:\program files\trend micro
2011-08-19 17:55 . 2011-08-19 17:55 -------- d-----w- C:\rsit
2011-08-19 16:32 . 2011-08-19 17:45 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-19 16:32 . 2011-08-19 17:42 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-08-19 16:21 . 2011-08-19 16:21 -------- d-----w- c:\windows\system32\drivers\NISx64
2011-08-19 16:11 . 2011-08-19 16:22 -------- d-----w- c:\program files\Symantec
2011-08-19 16:11 . 2011-08-19 16:22 174640 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-08-19 16:11 . 2011-08-19 16:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-08-19 16:10 . 2011-08-19 16:10 -------- d-----w- c:\windows\system32\drivers\NAVx64
2011-08-19 15:44 . 2010-06-28 20:32 20048 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 15:44 . 2010-06-28 20:37 121936 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 15:44 . 2010-06-28 20:33 28752 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 15:44 . 2010-06-28 20:37 51280 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 15:44 . 2010-06-28 20:33 61008 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 15:44 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2011-08-19 15:44 . 2010-06-28 20:57 165032 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files (x86)\AMD APP
2011-08-19 09:57 . 2011-08-19 09:57 -------- d-----w- c:\program files\ATI Technologies
2011-08-13 11:47 . 2011-08-13 11:47 -------- d--h--r- c:\users\Kaja\AppData\Roaming\SecuROM
2011-08-13 11:41 . 2011-08-13 11:41 -------- d-----w- c:\program files (x86)\KONAMI
2011-08-13 09:15 . 2011-08-13 09:15 -------- d-----w- c:\programdata\Sports Interactive
2011-08-13 09:14 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Local\Sports Interactive
2011-08-13 08:47 . 2011-08-13 09:14 -------- d-----w- c:\users\Kaja\AppData\Roaming\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\program files (x86)\Zero G Registry
2011-08-13 08:46 . 2011-08-13 08:46 -------- d-----w- c:\program files (x86)\Sports Interactive
2011-08-13 08:46 . 2011-08-13 08:46 -------- d--h--w- c:\users\Kaja\InstallAnywhere
2011-08-11 07:18 . 2011-08-11 07:18 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2011-08-10 16:22 . 2011-08-10 16:22 -------- d-----w- c:\programdata\PlayfulAge
2011-08-09 20:35 . 2011-08-09 20:35 -------- d-----w- c:\programdata\MumboJumbo
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\users\Kaja\AppData\Roaming\CasualForge
2011-08-09 13:53 . 2011-08-09 13:53 -------- d-----w- c:\programdata\CasualForge
2011-08-09 13:52 . 2011-08-09 13:52 -------- d-----w- c:\programdata\AWEM
2011-08-09 13:52 . 2011-08-19 15:34 -------- d-----w- c:\program files (x86)\Superhry.cz
2011-08-07 15:23 . 2011-08-09 17:08 -------- d-----w- c:\users\Kaja\AppData\Roaming\YoudaGames
2011-08-07 15:15 . 2011-08-19 15:30 -------- d-----w- c:\programdata\Big Fish Games
2011-08-04 16:39 . 2011-08-04 16:39 -------- d-----w- c:\users\Kaja\AppData\Local\Electronic Arts
2011-08-04 15:34 . 2011-08-19 15:56 -------- d-----w- c:\program files (x86)\Electronic Arts
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-16 05:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-16 05:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-16 04:26 . 2011-08-10 07:49 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-10 17:32 . 2011-07-10 15:52 4068763169 ----a-w- C:\L2_CT1_Hellbound-Live.zip
2011-07-05 09:07 . 2011-07-05 09:07 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
2011-07-02 06:14 . 2011-06-25 13:25 183112 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-25 13:26 . 2011-06-25 13:26 66872 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-17 18:20 . 2011-06-04 05:30 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2011-06-11 03:07 . 2011-07-13 05:35 3137536 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-28_07.28.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-26 15:36 . 2011-08-29 04:42 51068 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-29 04:42 46222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-07-26 15:02 . 2011-08-29 04:42 24336 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1995608721-1024494364-1175723090-1000_UserData.bin
- 2003-01-03 23:35 . 2011-08-27 20:18 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2003-01-03 23:35 . 2011-08-28 11:58 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2003-01-03 23:35 . 2011-08-28 11:58 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2003-01-03 23:35 . 2011-08-27 20:18 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-28 11:58 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-27 20:18 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-27 07:10 . 2011-08-29 07:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-07-27 07:10 . 2011-08-28 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-27 07:10 . 2011-08-29 07:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-07-27 07:10 . 2011-08-28 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-29 07:53 . 2011-08-29 07:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-28 07:26 . 2011-08-28 07:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-08-28 07:26 . 2011-08-28 07:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-29 07:53 . 2011-08-29 07:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-07-27 09:43 . 2011-08-28 10:49 451966 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:01 . 2011-08-28 07:25 340684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-29 07:53 340684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-04-09 20:23 . 2011-08-29 07:53 1315580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1995608721-1024494364-1175723090-1000-12288.dat
- 2011-04-09 20:23 . 2011-08-28 07:25 1315580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1995608721-1024494364-1175723090-1000-12288.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}]
2010-07-02 07:54 2607872 ----a-w- c:\program files (x86)\IMinent Toolbar\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{977AE9CC-AF83-45E8-9E03-E2798216E2D5}"= "c:\program files (x86)\IMinent Toolbar\tbcore3.dll" [2010-07-02 2607872]
.
[HKEY_CLASSES_ROOT\clsid\{977ae9cc-af83-45e8-9e03-e2798216e2d5}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01620.TBSB01620]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-12-03 14944136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HamaKMCONFIG"="c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\StartAutorun.exe" [2008-05-29 212992]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [x]
R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys [x]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe [x]
R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [x]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
R4 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 135664]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-11-16 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 2329480]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMWDSrv.exe [2009-07-01 197120]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-09 11:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TNOD UP"="c:\program files (x86)\TNod User & Password Finder\TNODUP.exe" [BU]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2716216]
"combofix"="c:\combofix\CF2640.3XE" [2010-11-20 345088]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\users\Kaja\AppData\Roaming\Mozilla\Firefox\Profiles\k1armw3q.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
WebBrowser-{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)
.
.
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\conhost.exe pid: 1620 24: C:]
--
"ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\csrss.exe pid: 484 3C: C:]
--
"ImagePath"="\??\c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\dwm.exe pid: 2372 24: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\exfat]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\explorer.exe pid: 2412 38: C:]
--
"ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\lsm.exe pid: 672 260: C:]
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
--
"ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SearchIndexer.exe pid: 2788 38: C:]
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\services.exe pid: 616 48: C:]
--
"ImagePath"="%SystemRoot%\System32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\spoolsv.exe pid: 1228 30: C:]
--
"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1004 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1096 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1768 8C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 1992 F0: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2016 138: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2576 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 260 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 2768 C8: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 3992 90: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 760 84: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 840 180: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 856 34: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\svchost.exe pid: 956 34: C:]
--
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\taskhost.exe pid: 2292 30: C:]
--
"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\wmpnetwk.exe pid: 2852 3C: C:]
--
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 1604 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 2148 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}]
@Denied: (A 2) (Everyone)
@="FlashProp Class"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMConfig.exe
c:\program files (x86)\Hama Keyboard and Mouse driver V6.0\KMProcess.exe
.
**************************************************************************
.
Celkový čas: 2011-08-29 10:00:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-29 08:00
ComboFix2.txt 2011-08-28 07:33
.
Před spuštěním: Volných bajtů: 96 604 532 736
Po spuštění: Volných bajtů: 96 525 377 536
.
- - End Of File - - CD7733FF10BABFF6D10FBD422757915B
Re: Facebook vir
Přes Start >> Spustit zkopíruj do okna:
ComboFix /Uninstall
a stiskni Enter
To odinstaluje ComboFix a smaže s ním související soubory a složky.
Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.
Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.
Pak použij AVP Tool z mého podpisu a dej mi sem z něj výsledky.
ComboFix /Uninstall
a stiskni Enter
To odinstaluje ComboFix a smaže s ním související soubory a složky.
Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.
Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.
Pak použij AVP Tool z mého podpisu a dej mi sem z něj výsledky.
Re: Facebook vir
AVPTool nenašel žádné hrozby, dokonce není ani možné uložit výsledek detekovaných ohrožení.
Re: Facebook vir
OK, zdá se, že jo.
Děkuju za vstřícný přístup a pomoc!
Děkuju za vstřícný přístup a pomoc!
Přispějete na provoz fóra?