Zadrhávání myši a opakování znaků v IE i v Firefoxu

[Rico75]

myslím že jsem to dle instrukcí udělal, oba soubory mám na ploše...zde je 2. pokus

ComboFix 11-09-07.02 - Roman Čáp 09.09.2011 15:26:37.3.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2943.1686 [GMT 2:00]
Spuštěný z: c:\users\Roman Lßp\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman Lßp\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-09 do 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 13:33 . 2011-09-09 13:33 -------- d-----w- c:\users\ROMANP~2\AppData\Local\temp
2011-09-09 13:33 . 2011-09-09 13:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 11:33 . 2011-09-08 11:33 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 123480 ----a-w- c:\windows\system32\OpenAL32.dll
2011-09-08 11:33 . 2011-09-08 11:33 109144 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-09-08 11:32 . 2010-02-02 08:57 2902498 ------w- c:\windows\SysWow64\Sens_oal.dll
2011-09-08 11:30 . 2009-01-16 12:28 497664 ----a-w- c:\windows\SysWow64\CTAPO32.dll
2011-09-08 10:59 . 2010-02-02 08:59 1940992 ------w- c:\windows\system32\Sens_oal.dll
2011-09-08 10:59 . 2011-09-08 10:59 -------- d-----w- c:\program files (x86)\Common Files\Creative Labs Shared
2011-09-08 10:57 . 2010-04-29 12:03 163840 ----a-w- c:\windows\system32\APOMgr64.DLL
2011-09-08 10:57 . 2010-04-29 12:03 128512 ----a-w- c:\windows\SysWow64\APOMngr.DLL
2011-09-08 10:57 . 2008-03-11 08:57 83456 ----a-w- c:\windows\system32\CmdRtr64.DLL
2011-09-08 10:57 . 2008-03-11 08:55 69120 ----a-w- c:\windows\SysWow64\CmdRtr.DLL
2011-09-07 05:35 . 2011-09-07 05:35 -------- d-----w- C:\Davky
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Malwarebytes
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\programdata\Malwarebytes
2011-09-07 05:30 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-09-01 12:57 . 2011-09-01 12:57 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Pinnacle
2011-09-01 07:24 . 2011-09-01 07:24 -------- d-----w- c:\program files (x86)\Common Files\Pinnacle
2011-09-01 07:23 . 2011-09-01 07:23 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate Collection
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Studio 14
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Yahoo!
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Pegasus Imaging
2011-09-01 07:09 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Pinnacle
2011-09-01 07:06 . 2011-09-01 07:06 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2011-08-30 20:38 . 2011-09-01 07:21 -------- d-----w- c:\programdata\Pinnacle
2011-08-23 13:05 . 2011-08-23 13:05 -------- d-----w- c:\program files\iPod
2011-08-23 13:05 . 2011-08-23 13:06 -------- d-----w- c:\program files\iTunes
2011-08-19 11:20 . 2011-08-19 11:20 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Aspyr
2011-08-19 11:19 . 2011-08-19 11:19 -------- d--h--r- c:\users\Roman Čáp\AppData\Roaming\SecuROM
2011-08-19 11:19 . 2011-08-19 11:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-08-19 11:03 . 2011-08-19 11:03 -------- d-----w- c:\program files (x86)\Aspyr
2011-08-19 11:03 . 2007-07-19 16:14 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
2011-08-19 11:03 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
2011-08-19 11:03 . 2007-04-04 16:54 107368 ----a-w- c:\windows\system32\xinput1_3.dll
2011-08-19 11:03 . 2007-04-04 16:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- C:\AppData
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Apple ComputerMobileSyncBackup
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-08-30 12:29 . 2011-08-30 12:32 22852 ----a-w- C:\UpdateXml.zip
2011-07-12 09:34 . 2011-07-12 09:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:34 . 2011-07-12 09:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:34 . 2011-07-12 09:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:34 . 2011-07-12 09:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_12.33.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-09-08 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 13:57 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-06-25 06:44 . 2011-09-08 13:59 36406 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-08 13:59 38072 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-06-25 06:44 . 2011-09-08 13:59 15882 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4275139881-4287817766-420560200-1000_UserData.bin
+ 2009-07-14 05:30 . 2011-09-08 11:30 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-09-08 11:30 . 2008-08-14 12:48 24064 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\skfiltv.sys
+ 2011-09-08 11:30 . 2009-01-16 12:34 57856 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctppld.dll
+ 2011-09-08 11:30 . 2008-08-26 14:30 8704 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\Common\ResDefE.exe
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-08 13:56 . 2011-09-08 13:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-08 13:56 . 2011-09-08 13:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-08-21 08:33 . 2011-09-07 04:53 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-08-21 08:33 . 2011-09-08 13:57 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-06-25 18:25 . 2011-09-09 11:36 531044 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-06-25 13:26 . 2011-09-07 16:24 347686 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2011-09-09 05:47 665570 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 665570 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 681316 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-09-09 05:47 126200 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-09-08 11:30 . 2009-01-16 12:28 497664 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\i386\CTAPO32.dll
+ 2011-09-08 11:30 . 2008-09-30 09:25 218112 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctdvinst.dll
+ 2011-09-08 11:30 . 2009-01-16 12:33 568320 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\CTAPO64.dll
+ 2009-07-14 05:01 . 2011-09-08 13:55 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-06 14:25 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
- 2011-08-25 07:17 . 2011-08-25 07:17 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
+ 2010-11-19 11:11 . 2011-09-08 13:55 6322152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4275139881-4287817766-420560200-1000-12288.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 6733824 c:\windows\Installer\45f81.msi
+ 2011-09-08 11:18 . 2011-09-08 11:18 18460672 c:\windows\Installer\45f74.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2011-03-15 2071904]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-18 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 VD_FileDisk;VD_FileDisk; [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-09-08 79360]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WDFORGA9;ORGA 900 WDF Bus Function;c:\windows\system32\DRIVERS\WDFORG9VB.sys [x]
R3 WDFORGSlot;ORGA Slot Function;c:\windows\system32\DRIVERS\WDFORG9UPF.sys [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-05-30 1025352]
S1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\Drivers\avgldx64.sys [x]
S1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\Drivers\avgmfx64.sys [x]
S1 AvgTdiA;AVG Free Network Redirector x64;c:\windows\system32\Drivers\avgtdia.sys [x]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\AVG\AVG9\avgemc.exe [2010-07-21 921952]
S2 avg9wd;AVG Free WatchDog;c:\program files (x86)\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe [2008-04-23 81920]
S2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe [2008-04-23 2015232]
S2 MSSQL$INSHOPSERVER;SQL Server (INSHOPSERVER);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 82464]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 15960096]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 134416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\avgrssta.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: gymuo.cz\zak
Trusted Zone: ica.cz\b
Trusted Zone: mojebanka.cz
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 82.144.143.254 82.144.143.1
FF - ProfilePath - c:\users\Roman Čáp\AppData\Roaming\Mozilla\Firefox\Profiles\9ao808qn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://gb.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://translate.google.cz/?client=firefox-a&rls=org.mozilla:cs:official&hl=cs&tab=wT#
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-09-09 15:36:29
ComboFix-quarantined-files.txt 2011-09-09 13:36
ComboFix2.txt 2011-09-08 14:13
ComboFix3.txt 2011-09-07 13:02
.
Před spuštěním: 7 772 147 712
Po spuštění: 7 711 899 648
.
- - End Of File - - 9A7C3BC52F6D4151CB16BE5DF54E1CAE

[Roli]

To není možné, je to tam pořád, zkus tu akci s tím skriptem provést v Nouzovém režimu.

[Rico75]

Zdravím...zde je nouzový pokus...

ComboFix 11-09-07.02 - Roman Čáp 13.09.2011 18:28:01.4.2 - x64 MINIMAL
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2943.1920 [GMT 2:00]
Spuštěný z: c:\users\Roman Lßp\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman Lßp\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-13 do 2011-09-13 )))))))))))))))))))))))))))))))
.
.
2011-09-13 16:30 . 2011-09-13 16:30 -------- d-----w- c:\users\ROMANP~2\AppData\Local\temp
2011-09-13 16:30 . 2011-09-13 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-12 19:20 . 2010-06-05 12:13 237056 ----a-w- c:\windows\SysWow64\ssleay32.dll
2011-09-12 19:20 . 2010-06-05 12:13 237056 ----a-w- c:\windows\SysWow64\libssl32.dll
2011-09-12 19:20 . 2010-06-05 12:12 1145344 ----a-w- c:\windows\SysWow64\libeay32.dll
2011-09-12 19:19 . 2011-09-12 19:20 -------- d-----w- c:\program files (x86)\OpenSSL-Win32
2011-09-08 11:33 . 2011-09-08 11:33 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 123480 ----a-w- c:\windows\system32\OpenAL32.dll
2011-09-08 11:33 . 2011-09-08 11:33 109144 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-09-08 11:32 . 2010-02-02 08:57 2902498 ------w- c:\windows\SysWow64\Sens_oal.dll
2011-09-08 11:30 . 2009-01-16 12:28 497664 ----a-w- c:\windows\SysWow64\CTAPO32.dll
2011-09-08 10:59 . 2010-02-02 08:59 1940992 ------w- c:\windows\system32\Sens_oal.dll
2011-09-08 10:59 . 2011-09-08 10:59 -------- d-----w- c:\program files (x86)\Common Files\Creative Labs Shared
2011-09-08 10:57 . 2010-04-29 12:03 163840 ----a-w- c:\windows\system32\APOMgr64.DLL
2011-09-08 10:57 . 2010-04-29 12:03 128512 ----a-w- c:\windows\SysWow64\APOMngr.DLL
2011-09-08 10:57 . 2008-03-11 08:57 83456 ----a-w- c:\windows\system32\CmdRtr64.DLL
2011-09-08 10:57 . 2008-03-11 08:55 69120 ----a-w- c:\windows\SysWow64\CmdRtr.DLL
2011-09-07 05:35 . 2011-09-07 05:35 -------- d-----w- C:\Davky
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Malwarebytes
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\programdata\Malwarebytes
2011-09-07 05:30 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-09-01 12:57 . 2011-09-01 12:57 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Pinnacle
2011-09-01 07:24 . 2011-09-01 07:24 -------- d-----w- c:\program files (x86)\Common Files\Pinnacle
2011-09-01 07:23 . 2011-09-01 07:23 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate Collection
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Studio 14
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Yahoo!
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Pegasus Imaging
2011-09-01 07:09 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Pinnacle
2011-09-01 07:06 . 2011-09-01 07:06 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2011-08-30 20:38 . 2011-09-01 07:21 -------- d-----w- c:\programdata\Pinnacle
2011-08-23 13:05 . 2011-08-23 13:05 -------- d-----w- c:\program files\iPod
2011-08-23 13:05 . 2011-08-23 13:06 -------- d-----w- c:\program files\iTunes
2011-08-19 11:20 . 2011-08-19 11:20 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Aspyr
2011-08-19 11:19 . 2011-08-19 11:19 -------- d--h--r- c:\users\Roman Čáp\AppData\Roaming\SecuROM
2011-08-19 11:19 . 2011-08-19 11:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-08-19 11:03 . 2011-08-19 11:03 -------- d-----w- c:\program files (x86)\Aspyr
2011-08-19 11:03 . 2007-07-19 16:14 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
2011-08-19 11:03 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
2011-08-19 11:03 . 2007-04-04 16:54 107368 ----a-w- c:\windows\system32\xinput1_3.dll
2011-08-19 11:03 . 2007-04-04 16:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- C:\AppData
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Apple ComputerMobileSyncBackup
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-12 17:01 . 2010-06-25 18:55 35664 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-08-30 12:29 . 2011-08-30 12:32 22852 ----a-w- C:\UpdateXml.zip
2011-07-12 09:34 . 2011-07-12 09:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:34 . 2011-07-12 09:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:34 . 2011-07-12 09:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:34 . 2011-07-12 09:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_12.33.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-09-13 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-13 16:24 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-13 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-06-25 13:26 . 2011-09-11 20:50 63792 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2010-06-25 06:44 . 2011-09-08 13:59 36406 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-10 08:56 38080 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-06-25 06:44 . 2011-09-10 08:56 15898 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4275139881-4287817766-420560200-1000_UserData.bin
+ 2009-07-14 05:30 . 2011-09-08 11:30 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-09-08 11:30 . 2008-08-14 12:48 24064 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\skfiltv.sys
+ 2011-09-08 11:30 . 2009-01-16 12:34 57856 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctppld.dll
+ 2011-09-08 11:30 . 2008-08-26 14:30 8704 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\Common\ResDefE.exe
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-13 16:25 . 2011-09-13 16:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-13 16:25 . 2011-09-13 16:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-08-21 08:33 . 2011-09-07 04:53 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-08-21 08:33 . 2011-09-13 16:24 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-06-25 18:25 . 2011-09-13 15:17 531132 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2009-07-14 02:36 . 2011-09-09 05:47 665570 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 665570 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-09-09 05:47 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-09-08 11:30 . 2009-01-16 12:28 497664 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\i386\CTAPO32.dll
+ 2011-09-08 11:30 . 2008-09-30 09:25 218112 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctdvinst.dll
+ 2011-09-08 11:30 . 2009-01-16 12:33 568320 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\CTAPO64.dll
+ 2009-07-14 05:01 . 2011-09-13 16:21 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-06 14:25 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
- 2011-08-25 07:17 . 2011-08-25 07:17 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
+ 2010-11-19 11:11 . 2011-09-13 16:21 6546524 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4275139881-4287817766-420560200-1000-12288.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 6733824 c:\windows\Installer\45f81.msi
+ 2011-09-08 11:18 . 2011-09-08 11:18 18460672 c:\windows\Installer\45f74.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2011-09-12 2076512]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-18 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\Drivers\avgldx64.sys [x]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\Drivers\avgmfx64.sys [x]
R1 AvgTdiA;AVG Free Network Redirector x64;c:\windows\system32\Drivers\avgtdia.sys [x]
R1 VD_FileDisk;VD_FileDisk; [x]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\AVG\AVG9\avgemc.exe [2010-07-21 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe [2008-04-23 81920]
R2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe [2008-04-23 2015232]
R2 MSSQL$INSHOPSERVER;SQL Server (INSHOPSERVER);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
R2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-09-08 79360]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WDFORGA9;ORGA 900 WDF Bus Function;c:\windows\system32\DRIVERS\WDFORG9VB.sys [x]
R3 WDFORGSlot;ORGA Slot Function;c:\windows\system32\DRIVERS\WDFORG9UPF.sys [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-05-30 1025352]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 82464]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 15960096]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 134416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\avgrssta.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: gymuo.cz\zak
Trusted Zone: ica.cz\b
Trusted Zone: mojebanka.cz
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 82.144.143.254 82.144.143.1
FF - ProfilePath - c:\users\Roman Čáp\AppData\Roaming\Mozilla\Firefox\Profiles\9ao808qn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://gb.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://translate.google.cz/?client=firefox-a&rls=org.mozilla:cs:official&hl=cs&tab=wT#
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-09-13 18:34:00
ComboFix-quarantined-files.txt 2011-09-13 16:34
ComboFix2.txt 2011-09-09 13:36
ComboFix3.txt 2011-09-08 14:13
ComboFix4.txt 2011-09-07 13:02
.
Před spuštěním: 6 350 385 152
Po spuštění: 6 268 039 168
.
- - End Of File - - 783B934F7A4099E67CF4BA236F5A8FA8

[Roli]

Nechápu, to už jsi během pár dní několikátý kterému nejde nic smáznout.

Tak jinak, přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
C:\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
c:\programdata\Spybot - Search & Destroy
c:\program files (x86)\Spybot - Search & Destroy

:commands
[purity]
[emptytemp]
[start explorer]

klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

[Rico75]

Nemůže být problém v tom že mám AVG free verzi kde jsem při těch akcích vypnul rezidentní štít ale anti-spyware tam vypnout nejde, nikde jsem to tam nenašel....?

ComboFix se mi nepodařilo odinstalovat přes Spusť hlásí to že to nemůže najít

[Roli]

Ten příkaz na odstranění ComboFixu naprosto přesně ComboFixmezera/Uninstall

Pokud to ani pak nepůjde T-Cleaner by to měl zvládnout.

No AVG samo o sobě je problém tak že je to možné.

Proveď tu akci s tím OTMoveItem a pak uvidíme.

[Rico75]

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\*.tmp not found.
C:\WINDOWS\System32\ConduitEngine.tmp moved successfully.
File/Folder C:\WINDOWS\*.tmp not found.
c:\programdata\Spybot - Search & Destroy\Recovery folder moved successfully.
c:\programdata\Spybot - Search & Destroy\Logs folder moved successfully.
c:\programdata\Spybot - Search & Destroy folder moved successfully.
c:\program files (x86)\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: uzivatel
->Temp folder emptied: 0 bytes

User: uzivatel
->Temp folder emptied: 7319 bytes
->Temporary Internet Files folder emptied: 7927658 bytes
->Java cache emptied: 18887705 bytes
->FireFox cache emptied: 107114934 bytes
->Apple Safari cache emptied: 11630592 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 12632 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50373 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 139,00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 09172011_092038

Files moved on Reboot...
C:\Users\uzivatel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

[Roli]

Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Pak dej vědět jaký je stav PC.

[Rico75]

Děkuju moc za pomoc! Zdá se mi to být OK. Nějakou ochranu, nějaký free SW který by bylo dobý mít nainstalovaný by jsi mi poradil?

Ještě jednou díky!

[Roli]

Jakou máš namysli ochranu ?

Vždyť tam máš AVG.