pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Zpráva

jaruneczka · #1 Příspěvek od **jaruneczka** » 30 pro 2011 21:59

ComboFix 11-12-30.01 - Jarka 30.12.2011 21:46:03.5.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2842 [GMT 1:00]
Spuštěný z: c:\users\Jarka\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\java.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-28 do 2011-12-30 )))))))))))))))))))))))))))))))
.
.
2011-12-30 20:49 . 2011-12-30 20:49 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-12-30 20:49 . 2011-12-30 20:49 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-30 20:49 . 2011-12-30 20:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-30 10:49 . 2007-11-20 16:58 55296 ----a-w- c:\windows\SysWow64\Remove.exe
2011-12-30 10:49 . 2011-12-30 10:49 -------- d-----w- c:\program files (x86)\KYE SYSTEMS CORP
2011-12-30 10:49 . 2006-10-12 10:57 14336 ----a-w- c:\windows\SysWow64\P7302USD.dll
2011-12-30 10:36 . 2011-12-30 10:36 -------- d-----w- C:\inetpub
2011-12-30 09:56 . 2011-12-30 10:51 -------- d-----w- c:\program files (x86)\Common Files\PAC7302
2011-12-30 07:53 . 2011-10-19 22:10 22872 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2011-12-30 06:43 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A4F8204E-2C06-488B-8931-C88EAE919E51}\mpengine.dll
2011-12-29 14:35 . 2011-12-29 14:35 -------- d-----w- c:\program files (x86)\Guard-ICQ
2011-12-29 14:35 . 2011-12-29 14:35 -------- d-----w- c:\program files (x86)\ICQ6Toolbar
2011-12-29 14:34 . 2011-12-29 14:35 -------- d-----w- c:\program files (x86)\ICQ7.7
2011-12-27 10:14 . 2011-12-30 10:49 -------- d-----w- c:\windows\PixArt
2011-12-27 09:31 . 2011-12-27 09:31 -------- d-----w- c:\users\Jarka\AppData\Local\Facebook
2011-12-26 07:35 . 2011-12-26 07:35 525544 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-26 07:35 . 2011-12-26 07:35 -------- d-----w- c:\program files\Java
2011-12-22 07:57 . 2011-12-22 07:57 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2011-12-22 07:57 . 2011-12-22 07:57 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2011-12-22 07:57 . 2011-12-22 07:57 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2011-12-22 07:57 . 2011-12-22 07:57 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll
2011-12-18 15:11 . 2011-12-30 15:39 -------- d-----w- c:\users\Jarka\AppData\Roaming\Jewel Match 3
2011-12-17 12:02 . 2011-12-17 12:34 -------- d-----w- c:\users\Jarka\AppData\Roaming\IObit
2011-12-14 06:32 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 06:32 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 06:32 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-14 06:32 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 06:32 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-14 06:32 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-12 08:00 . 2011-12-12 08:00 22 --sha-w- c:\users\Jarka\AppData\Roaming\Sys2662.Config.Repository.bin
2011-12-12 07:59 . 2011-12-12 08:35 -------- d-----w- c:\program files (x86)\jv16 PowerTools 2011
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\program files (x86)\Conduit
2011-12-04 19:01 . 2011-12-08 17:05 -------- d-----w- c:\program files (x86)\MyAshampoo
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\users\Jarka\AppData\Local\ashampoo
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\programdata\ashampoo
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\program files (x86)\Ashampoo
2011-12-02 19:50 . 2011-12-12 08:04 -------- d-----w- c:\users\Jarka\Tracing
2011-12-02 07:51 . 2011-12-02 07:51 -------- d-----w- c:\users\Jarka\AppData\Roaming\NVIDIA
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-30 15:44 . 2011-05-11 12:39 25640 ----a-w- c:\windows\gdrv.sys
2011-12-04 09:27 . 2011-09-28 18:41 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-24 12:29 . 2011-10-24 12:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 12:29 . 2011-10-24 12:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-10-23 07:03 . 2011-10-23 07:03 1409 ----a-w- c:\windows\QTFont.for
2011-10-08 06:02 . 2011-10-08 05:54 181064 ----a-w- c:\windows\PSEXESVC.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R3 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-11 30528]
R3 MEMSWEEP2;MEMSWEEP2; [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-19 494424]
R4 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R4 DES2 Service;DES2 Service for Energy Saving.;c:\program files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
R4 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2011-12-29 1564368]
R4 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2011-08-17 247872]
R4 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-08 974944]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-12-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
- c:\users\Jarka\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-27 09:31]
.
2011-12-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job
- c:\users\Jarka\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-27 09:31]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
- c:\users\Jarka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-23 14:10]
.
2011-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job
- c:\users\Jarka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-23 14:10]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-08 4030008]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://startsear.ch/?aff=1
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.centrum.cz
FF - prefs.js: keyword.URL - hxxp://startsear.ch/?aff=1&src=sp&cf=33cdfb4d-0310-11e1-b21a-1c6f65ad54de&q=
FF - prefs.js: network.proxy.type - 4
*
*
* For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
* To make a manual change to preferences, you can visit the URL about:config
*/
# Mozilla User Preferences
/* Do not edit this file.
FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1316584428
FF - user.js: app.update.lastUpdateTime.background-update-timer - 1316584668
FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1316584548
FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1316593405
FF - user.js: browser.anchor_color - #0000FF
FF - user.js: browser.bookmarks.restore_default_bookmarks - false
FF - user.js: browser.cache.disk.capacity - 1048576
FF - user.js: browser.cache.disk.smart_size.first_run - false
FF - user.js: browser.cache.disk.smart_size_cached_value - 1048576
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.background_color - #C0C0C0
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.display.use_system_colors - true
FF - user.js: browser.download.dir - c:\\Users\\Jarka\\Desktop
FF - user.js: browser.download.folderList - 0
FF - user.js: browser.formfill.enable - false
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.migration.version - 5
FF - user.js: browser.places.smartBookmarksVersion - 2
FF - user.js: browser.preferences.advanced.selectedTabIndex - 1
FF - user.js: browser.rights.3.shown - true
FF - user.js: browser.startup.homepage - www.centrum.cz
FF - user.js: browser.startup.homepage_override.buildID - 20110902133214
FF - user.js: browser.startup.homepage_override.mstone - rv:6.0.2
FF - user.js: browser.syncPromoViewsLeft - 3
FF - user.js: browser.taskbar.lastgroupid - Mozilla.Firefox.6.0.2
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.visited_color - #800080
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: extensions.adblockplus.currentVersion - 1.3.9
FF - user.js: extensions.adblockplus.detachsidebar - true
FF - user.js: extensions.adblockplus.showinstatusbar - true
FF - user.js: extensions.adblockplus.showintoolbar - false
FF - user.js: extensions.blocklist.pingCountTotal - 2
FF - user.js: extensions.blocklist.pingCountVersion - 2
FF - user.js: extensions.bootstrappedAddons - {}
FF - user.js: extensions.databaseSchema - 4
FF - user.js: extensions.enabledAddons - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9,{972ce4c6-7e08-4474-a285-3208198ce6fd}:6.0.2
FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1316459081279}}},{\name\:\app-profile\,\addons\:{\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\Users\\\\Jarka\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\hw6zn1q5.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1316459152579}}}]
FF - user.js: extensions.lastAppVersion - 6.0.2
FF - user.js: extensions.lastPlatformVersion - 6.0.2
FF - user.js: extensions.pendingOperations - false
FF - user.js: idle.lastDailyNotification - 1316501831
FF - user.js: intl.charsetmenu.browser.cache - ISO-8859-2, ISO-8859-1, windows-1250, UTF-8
FF - user.js: network.cookie.prefsMigrated - true
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: places.database.lastMaintenance - 1316501831
FF - user.js: places.history.expiration.transient_current_max_pages - 128581
FF - user.js: plugin.expose_full_path - true
FF - user.js: pref.browser.homepage.disable_button.restore_default - false
FF - user.js: privacy.donottrackheader.enabled - true
FF - user.js: privacy.sanitize.didShutdownSanitize - true
FF - user.js: privacy.sanitize.migrateFx3Prefs - true
FF - user.js: privacy.sanitize.sanitizeOnShutdown - true
FF - user.js: privacy.sanitize.timeSpan - 4
FF - user.js: security.disable_button.openDeviceManager - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: services.sync.clients.lastSync - 0
FF - user.js: services.sync.clients.lastSyncLocal - 0
FF - user.js: services.sync.migrated - true
FF - user.js: services.sync.tabs.lastSync - 0
FF - user.js: services.sync.tabs.lastSyncLocal - 0
FF - user.js: signon.rememberSignons - false
FF - user.js: storage.vacuum.last.index - 0
FF - user.js: storage.vacuum.last.places.sqlite - 1316501831
FF - user.js: ui.submenuDelay - 0
FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1319187283
FF - user.js: xpinstall.whitelist.add -
FF - user.js: xpinstall.whitelist.add.36 -
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="E0A97AA61C842A2FBD6C6CBF29F88C8F2DFA869087DA0B378084C6F907EA5E23D46BE0CD710D99C9B15FF22E710DEBDB3B464AB88F2F73DAFA70BE813E0D127BA9A516E2EFC965D9177C7B17471141029C028426CAE53B3E1E31C9A1B8C7CDC39B3D0B31D41F851ED62DE9F1DFFB41F9013B2A1D0AAEF93884988C0A7F1F29504F6A37778382B3073B2EA4A9995BE774FCD7B1D6C1C90ED2AACE31E1C2A783A9C93A12E882026DBBF39116FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667A2D97226D213B555FEBC9E127BECC74C4DD877A36101643F8644B94A9D4FAC9901D916F2AF1D498F2CE5C12592BFDDC5EDA4B5685329CD6AB19B22F005055DE03E02AEDF0A6D1312E6BD07909E2D723D09ED417947948561D2010B950057B6AFE4E5A8E9C0037299BF414B0C56FE29DD7AB9A84A7F2111B554D4754E6A4FC08A8E5C9D686FAE17B81B5E5AD1AEEE76EB95B28D16EF12C77D161979F7D5565A76C562B8F6E4260408502B955D571AA02F21A527D7428D5753EBF442AC883E347D8B98BA75A1018E22AEE173EDAB8244F555073FD2509D41D29AB40FD1FB38D53052C077065E3A63A8765E7C87C10DD1906269B20A2EB0581F5F46B30CDD5D979F8344D6108434003C5B204D73DF040C53670975C81D1B47DDE7BA16C410A8A763FB2F573EB3B2B707884E18BD02938A177C420E9B18100AB758CB322CA679881688AF06013DDD31B31AB0A136584DBAB82C9895D24AABF05AC65318326C920FD5701C890AA7C2677120B444F045A75A1872303A8414EC21783ECFE9105E1CE5466B6B1A512FD02875A0EA6C4760FA7E99C25440880BB414C7BE645F3C2F21898C23B702923FDC987694089A5376850F2782F2FB7D774B16803958C478C1114C54B94323CBFD1FAC2F69E4E5F50667C5AD0D1DD7C3D4D947E118167743333F54CC4271F1C03F34B060FEFEF5D3C2A7B59B2F085380D4ED1E2CB2ACEBE5CDE29B2746C976780F9C434D2BF68855942FBFE7AA8F7F1EDAFB6126DACEA9699418EF9ABF78CBBD2BBC56BEB791EF2596CA1D0AB6B003C781D8AE99D1D44B9A3D5E71629FCC242085DD327E60388FB5182CD9FEFA8D1870924077D24F37008D301897BC49BA42F2C6AA70DDD5F662B81C68D448186C0D4B114FFEA3FE168B180D0EAC6C96DAFECD47B480AF3EFEF4285C79C16820B5C4533009DFE2FE35C55323694C38D1E8470A966F25CBB226683F42BCA86997F73544D853856A62F9979EF83CE9E93C45994877B4F40DBFE3727EEEF267D7F86568A0A7793116B0F0831B48F7CB5108728CEADFBFD9D3E5565BAAB44229C432D47C2C6C29F749E4C71B307EF48941DE98C69AF9B093849B3E824A1BB376C3263EA371AB"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\antimalwareguard.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\file4exchange.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\folusho.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mediacontent4you.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\regsyonline.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xprstats.com]
@DACL=(02 0000)
"*"=dword:00000004
.
[HKEY_LOCAL_MACHINE\system\ControlSet007\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe
.
**************************************************************************
.
Celkový čas: 2011-12-30 21:54:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-30 20:54
.
Před spuštěním: Volných bajtů: 947 933 593 600
Po spuštění: Volných bajtů: 947 501 375 488
.
- - End Of File - - 345F977499CE14F4EB981C1066B322DF

#2 Příspěvek od **vyosek** » 30 pro 2011 22:58

Zdravim a pekny den preji:)

Za ten ComboFix dostanete za usiska, ten se spousti az na pokyn radce, jinak muze jit system do kytek

Nebezpeci CFka

Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
Maze stopy po haveti, takze v logu z RSIT neni nic videt
Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

c:\windows\SysWow64\Remove.exe
Kliknete na Prochazet
Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
Kliknete na Send File
Pokud na Vas vyskoci obrazovka jako je nize, tak kliknete na ReAnalyse
Vysledek analyzy sem vlozte (jako odkaz)

jaruneczka · #3 Příspěvek od **jaruneczka** » 31 pro 2011 21:37

http://www.virustotal.com/file-scan/rep ... 1325363248

...jinak se moc omlouvám, problém: velmi pomalý start pc
PF 2012

#4 Příspěvek od **vyosek** » 01 led 2012 20:19

PF 2012 i vam

Odkaz se mi nezobrazuje spravne, byly tam nejake nalezy

jaruneczka · #5 Příspěvek od **jaruneczka** » 02 led 2012 10:00

Dobrý den, co mám udělat?

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
Remove.exe
Submission date:
2012-01-02 08:55:49 (UTC)
Current status:
finished
Result:
0/ 43 (0.0%)

#6 Příspěvek od **vyosek** » 02 led 2012 10:11

Super, tohle mi staci, ona je chyba na strane virustotalu

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Folder::
c:\program files (x86)\ICQ6Toolbar
c:\users\Jarka\AppData\Roaming\IObit

Driver::
ICQ Service
MEMSWEEP2

File::
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job

DDS::
mStart Page = hxxp://startsear.ch/?aff=1

Firefox::
FF - ProfilePath - c:\users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\
FF - prefs.js: keyword.URL - hxxp://startsear.ch/?aff=1&src=sp&cf=33 ... 5ad54de&q=

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\antimalwareguard.com]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\file4exchange.com]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\folusho.com]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mediacontent4you.com]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\regsyonline.com]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xprstats.com]

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

jaruneczka · #7 Příspěvek od **jaruneczka** » 02 led 2012 10:35

ComboFix 12-01-01.06 - Jarka 02.01.2012 10:25:12.7.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2879 [GMT 1:00]
Spuštěný z: c:\users\Jarka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jarka\Desktop\CFScript.txt
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
FILE ::
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ICQ6Toolbar
c:\program files (x86)\ICQ6Toolbar\config.xml
c:\program files (x86)\ICQ6Toolbar\Icons.bmp
c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe
c:\program files (x86)\ICQ6Toolbar\icq6Toolbar.ico
c:\program files (x86)\ICQ6Toolbar\ICQToolBar.dll
c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files (x86)\ICQ6Toolbar\logo_small.gif
c:\program files (x86)\ICQ6Toolbar\ServiceStarter.exe
c:\program files (x86)\ICQ6Toolbar\short.wav
c:\program files (x86)\ICQ6Toolbar\Version.txt
c:\program files (x86)\ICQ6Toolbar\voucher.bmp
c:\program files (x86)\ICQ6Toolbar\voucher2.bmp
c:\users\Jarka\AppData\Roaming\IObit
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-17(13-10-25).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-18(14-55-09).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-19(13-01-22).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-21(08-51-58).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-23(08-04-54).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-26(08-41-49).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-29(09-17-36).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-30(08-48-29).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-30(08-54-26).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2011-12-30(22-22-50).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup32-2012-01-01(09-34-52).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-17(13-10-25).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-17(13-33-07).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-18(14-55-09).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-21(08-51-58).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-23(09-53-27).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-26(08-41-49).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-30(08-48-29).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-30(08-54-26).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2011-12-30(22-22-50).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Backup\ASCBackup64-2012-01-01(09-34-52).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Boottime\Boottime.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Boottime\LastAutoRunList.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\ignore.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\JFilterkey.dbd
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-17(13-10-25).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-17(13-33-07).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-17(13-41-13).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-18(14-55-09).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-19(13-01-22).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-21(08-51-58).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-23(08-04-54).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-23(09-53-27).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-26(08-41-49).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-29(09-17-36).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-30(08-48-29).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-30(08-54-26).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2011-12-30(22-22-50).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Log\ASCLog-2012-01-01(09-34-52).txt
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Main.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\PFilterkey.dbd
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\PrivacySweeper\Main.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-17(13-13-00).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-17(13-51-53).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-26(08-46-24).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-26(20-17-05).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-27(11-12-12).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-28(09-08-21).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-29(09-07-36).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup32-2011-12-30(08-56-08).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-17(13-13-00).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-17(13-51-53).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-18(15-49-05).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-26(08-46-24).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-26(20-17-05).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-27(11-12-12).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-28(09-08-21).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-29(09-07-36).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-30(08-56-08).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\backup\Regbackup64-2011-12-30(08-59-02).reg
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Registrycleaner\Main.ini
c:\users\Jarka\AppData\Roaming\IObit\Advanced SystemCare V5\Toolbox\Config.ini
c:\users\Jarka\AppData\Roaming\IObit\IObit Uninstaller\Log\2011-12-17.log
c:\users\Jarka\AppData\Roaming\IObit\IObit Uninstaller\Log\2011-12-18.log
c:\users\Jarka\AppData\Roaming\IObit\IObit Uninstaller\Log\2011-12-27.log
c:\users\Jarka\AppData\Roaming\IObit\IObit Uninstaller\Log\2011-12-30.log
c:\users\Jarka\AppData\Roaming\IObit\IObit Uninstaller\SoftwareCache.ini
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3058530099-2043524379-2683396900-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ICQ Service
-------\Service_MEMSWEEP2
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-02 do 2012-01-02 )))))))))))))))))))))))))))))))
.
.
2012-01-02 08:23 . 2012-01-02 08:23 -------- d-----w- c:\users\Jarka\AppData\Local\Apple
2011-12-31 20:57 . 2011-12-31 20:57 -------- d-----w- c:\users\Jarka\AppData\Local\Adobe
2011-12-30 21:25 . 2011-12-30 21:29 -------- d-----w- c:\users\Jarka\AppData\Roaming\Wise Registry Cleaner
2011-12-30 21:25 . 2011-12-30 21:25 -------- d-----w- c:\program files (x86)\Wise Registry Cleaner
2011-12-30 21:03 . 2011-12-30 21:03 -------- d-----w- c:\users\Jarka\AppData\Roaming\Malwarebytes
2011-12-30 21:03 . 2011-12-30 21:03 -------- d-----w- c:\programdata\Malwarebytes
2011-12-30 10:49 . 2007-11-20 16:58 55296 ----a-w- c:\windows\SysWow64\Remove.exe
2011-12-30 10:49 . 2011-12-30 10:49 -------- d-----w- c:\program files (x86)\KYE SYSTEMS CORP
2011-12-30 10:49 . 2006-10-12 10:57 14336 ----a-w- c:\windows\SysWow64\P7302USD.dll
2011-12-30 10:36 . 2011-12-30 10:36 -------- d-----w- C:\inetpub
2011-12-30 09:56 . 2011-12-30 10:51 -------- d-----w- c:\program files (x86)\Common Files\PAC7302
2011-12-30 07:53 . 2011-10-19 22:10 22872 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2011-12-30 06:43 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A4F8204E-2C06-488B-8931-C88EAE919E51}\mpengine.dll
2011-12-29 14:35 . 2011-12-29 14:35 -------- d-----w- c:\program files (x86)\Guard-ICQ
2011-12-29 14:34 . 2011-12-29 14:35 -------- d-----w- c:\program files (x86)\ICQ7.7
2011-12-27 10:14 . 2011-12-30 10:49 -------- d-----w- c:\windows\PixArt
2011-12-27 09:31 . 2011-12-27 09:31 -------- d-----w- c:\users\Jarka\AppData\Local\Facebook
2011-12-26 07:35 . 2011-12-26 07:35 525544 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-26 07:35 . 2011-12-26 07:35 -------- d-----w- c:\program files\Java
2011-12-22 07:57 . 2011-12-22 07:57 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2011-12-22 07:57 . 2011-12-22 07:57 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2011-12-22 07:57 . 2011-12-22 07:57 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2011-12-22 07:57 . 2011-12-22 07:57 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll
2011-12-18 15:11 . 2012-01-02 08:16 -------- d-----w- c:\users\Jarka\AppData\Roaming\Jewel Match 3
2011-12-14 06:32 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 06:32 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 06:32 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-14 06:32 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 06:32 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-14 06:32 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-12 08:00 . 2011-12-12 08:00 22 --sha-w- c:\users\Jarka\AppData\Roaming\Sys2662.Config.Repository.bin
2011-12-12 07:59 . 2011-12-12 08:35 -------- d-----w- c:\program files (x86)\jv16 PowerTools 2011
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\program files (x86)\Conduit
2011-12-04 19:01 . 2011-12-08 17:05 -------- d-----w- c:\program files (x86)\MyAshampoo
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\programdata\ashampoo
2011-12-04 19:01 . 2011-12-04 19:01 -------- d-----w- c:\program files (x86)\Ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-30 15:44 . 2011-05-11 12:39 25640 ----a-w- c:\windows\gdrv.sys
2011-12-04 09:27 . 2011-09-28 18:41 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-24 12:29 . 2011-10-24 12:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 12:29 . 2011-10-24 12:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-10-23 07:03 . 2011-10-23 07:03 1409 ----a-w- c:\windows\QTFont.for
2011-10-08 06:02 . 2011-10-08 05:54 181064 ----a-w- c:\windows\PSEXESVC.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R3 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2011-05-11 30528]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-19 494424]
R4 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R4 DES2 Service;DES2 Service for Energy Saving.;c:\program files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
R4 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2011-12-29 1564368]
R4 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-08 974944]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-08 4030008]
"combofix"="c:\combofix\CF24047.3XE" [2010-11-20 345088]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uDefault_Search_URL = hxxp://www.google.com
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.centrum.cz
FF - prefs.js: network.proxy.type - 4
*
*
* For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
* To make a manual change to preferences, you can visit the URL about:config
*/
# Mozilla User Preferences
/* Do not edit this file.
FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1316584428
FF - user.js: app.update.lastUpdateTime.background-update-timer - 1316584668
FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1316584548
FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1316593405
FF - user.js: browser.anchor_color - #0000FF
FF - user.js: browser.bookmarks.restore_default_bookmarks - false
FF - user.js: browser.cache.disk.capacity - 1048576
FF - user.js: browser.cache.disk.smart_size.first_run - false
FF - user.js: browser.cache.disk.smart_size_cached_value - 1048576
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.background_color - #C0C0C0
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.display.use_system_colors - true
FF - user.js: browser.download.dir - c:\\Users\\Jarka\\Desktop
FF - user.js: browser.download.folderList - 0
FF - user.js: browser.formfill.enable - false
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.migration.version - 5
FF - user.js: browser.places.smartBookmarksVersion - 2
FF - user.js: browser.preferences.advanced.selectedTabIndex - 1
FF - user.js: browser.rights.3.shown - true
FF - user.js: browser.startup.homepage - www.centrum.cz
FF - user.js: browser.startup.homepage_override.buildID - 20110902133214
FF - user.js: browser.startup.homepage_override.mstone - rv:6.0.2
FF - user.js: browser.syncPromoViewsLeft - 3
FF - user.js: browser.taskbar.lastgroupid - Mozilla.Firefox.6.0.2
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.visited_color - #800080
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: extensions.adblockplus.currentVersion - 1.3.9
FF - user.js: extensions.adblockplus.detachsidebar - true
FF - user.js: extensions.adblockplus.showinstatusbar - true
FF - user.js: extensions.adblockplus.showintoolbar - false
FF - user.js: extensions.blocklist.pingCountTotal - 2
FF - user.js: extensions.blocklist.pingCountVersion - 2
FF - user.js: extensions.bootstrappedAddons - {}
FF - user.js: extensions.databaseSchema - 4
FF - user.js: extensions.enabledAddons - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9,{972ce4c6-7e08-4474-a285-3208198ce6fd}:6.0.2
FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1316459081279}}},{\name\:\app-profile\,\addons\:{\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\Users\\\\Jarka\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\hw6zn1q5.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1316459152579}}}]
FF - user.js: extensions.lastAppVersion - 6.0.2
FF - user.js: extensions.lastPlatformVersion - 6.0.2
FF - user.js: extensions.pendingOperations - false
FF - user.js: idle.lastDailyNotification - 1316501831
FF - user.js: intl.charsetmenu.browser.cache - ISO-8859-2, ISO-8859-1, windows-1250, UTF-8
FF - user.js: network.cookie.prefsMigrated - true
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: places.database.lastMaintenance - 1316501831
FF - user.js: places.history.expiration.transient_current_max_pages - 128581
FF - user.js: plugin.expose_full_path - true
FF - user.js: pref.browser.homepage.disable_button.restore_default - false
FF - user.js: privacy.donottrackheader.enabled - true
FF - user.js: privacy.sanitize.didShutdownSanitize - true
FF - user.js: privacy.sanitize.migrateFx3Prefs - true
FF - user.js: privacy.sanitize.sanitizeOnShutdown - true
FF - user.js: privacy.sanitize.timeSpan - 4
FF - user.js: security.disable_button.openDeviceManager - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: services.sync.clients.lastSync - 0
FF - user.js: services.sync.clients.lastSyncLocal - 0
FF - user.js: services.sync.migrated - true
FF - user.js: services.sync.tabs.lastSync - 0
FF - user.js: services.sync.tabs.lastSyncLocal - 0
FF - user.js: signon.rememberSignons - false
FF - user.js: storage.vacuum.last.index - 0
FF - user.js: storage.vacuum.last.places.sqlite - 1316501831
FF - user.js: ui.submenuDelay - 0
FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1319187283
FF - user.js: xpinstall.whitelist.add -
FF - user.js: xpinstall.whitelist.add.36 -
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-ICQToolbar - c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="E0A97AA61C842A2FBD6C6CBF29F88C8F2DFA869087DA0B378084C6F907EA5E23D46BE0CD710D99C9B15FF22E710DEBDB3B464AB88F2F73DAFA70BE813E0D127BA9A516E2EFC965D9177C7B17471141029C028426CAE53B3E1E31C9A1B8C7CDC39B3D0B31D41F851ED62DE9F1DFFB41F9013B2A1D0AAEF93884988C0A7F1F29504F6A37778382B3073B2EA4A9995BE774FCD7B1D6C1C90ED2AACE31E1C2A783A9C93A12E882026DBBF39116FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667A2D97226D213B555FEBC9E127BECC74C4DD877A36101643F8644B94A9D4FAC9901D916F2AF1D498F2CE5C12592BFDDC5EDA4B5685329CD6AB19B22F005055DE03E02AEDF0A6D1312E6BD07909E2D723D09ED417947948561D2010B950057B6AFE4E5A8E9C0037299BF414B0C56FE29DD7AB9A84A7F2111B554D4754E6A4FC08A8E5C9D686FAE17B81B5E5AD1AEEE76EB95B28D16EF12C77D161979F7D5565A76C562B8F6E4260408502B955D571AA02F21A527D7428D5753EBF442AC883E347D8B98BA75A1018E22AEE173EDAB8244F555073FD2509D41D29AB40FD1FB38D53052C077065E3A63A8765E7C87C10DD1906269B20A2EB0581F5F46B30CDD5D979F8344D6108434003C5B204D73DF040C53670975C81D1B47DDE7BA16C410A8A763FB2F573EB3B2B707884E18BD02938A177C420E9B18100AB758CB322CA679881688AF06013DDD31B31AB0A136584DBAB82C9895D24AABF05AC65318326C920FD5701C890AA7C2677120B444F045A75A1872303A8414EC21783ECFE9105E1CE5466B6B1A512FD02875A0EA6C4760FA7E99C25440880BB414C7BE645F3C2F21898C23B702923FDC987694089A5376850F2782F2FB7D774B16803958C478C1114C54B94323CBFD1FAC2F69E4E5F50667C5AD0D1DD7C3D4D947E118167743333F54CC4271F1C03F34B060FEFEF5D3C2A7B59B2F085380D4ED1E2CB2ACEBE5CDE29B2746C976780F9C434D2BF68855942FBFE7AA8F7F1EDAFB6126DACEA9699418EF9ABF78CBBD2BBC56BEB791EF2596CA1D0AB6B003C781D8AE99D1D44B9A3D5E71629FCC242085DD327E60388FB5182CD9FEFA8D1870924077D24F37008D301897BC49BA42F2C6AA70DDD5F662B81C68D448186C0D4B114FFEA3FE168B180D0EAC6C96DAFECD47B480AF3EFEF4285C79C16820B5C4533009DFE2FE35C55323694C38D1E8470A966F25CBB226683F42BCA86997F73544D853856A62F9979EF83CE9E93C45994877B4F40DBFE3727EEEF267D7F86568A0A7793116B0F0831B48F7CB5108728CEADFBFD9D3E5565BAAB44229C432D47C2C6C29F749E4C71B307EF48941DE98C69AF9B093849B3E824A1BB376C3263EA371AB"
.
[HKEY_LOCAL_MACHINE\system\ControlSet007\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe
.
**************************************************************************
.
Celkový čas: 2012-01-02 10:34:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-01-02 09:34
.
Před spuštěním: Volných bajtů: 946 081 771 520
Po spuštění: Volných bajtů: 945 423 835 136
.
- - End Of File - - 6558E5592B106E14CA968FE0AF4FB0E2

#8 Příspěvek od **vyosek** » 02 led 2012 10:38

Co nas pacient

jaruneczka · #9 Příspěvek od **jaruneczka** » 02 led 2012 10:41

pomalý start, a od silvestra se mi opakovaně objevuje výzva k nainstalování aktualisaci Net Framerwork, ačkoliv je mám nainstalované, nejdříve jsem si nevšimla čísla záplaty, až pak kdy jsem ji měla nainstalovanou 5x, proto jsem aktualisace vypla, výzva je dosud i při vypínání pc.
Vkládám /doufám, že mě nazastřelíte/ ještě RSIT log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jarka at 2012-01-02 10:49:19
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 902 GB (95%) free of 954 GB
Total RAM: 4087 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:49:25, on 2.1.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Jarka\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\trend micro\Jarka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (file missing)
O4 - HKUS\S-1-5-21-3058530099-2043524379-2683396900-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3058530099-2043524379-2683396900-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Úložná technologie Intel(R) Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Smart TimeLock Service (Smart TimeLock) - Gigabyte Technology CO., LTD. - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WMI Performance Adapter (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7405 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k apphost
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\Explorer.EXE
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
WLIDSvcM.exe 1908
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
taskeng.exe {AC8CB1FB-E4E0-4A05-9258-27327137037A}
C:\Users\Jarka\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
taskeng.exe {B717CF21-214C-4A03-BAE5-B6CDB406ED08}
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Jarka\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "www.centrum.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\extensions\
engine@conduit.com
{800b5000-a755-47e1-992b-48a1c1357f07}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}

C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\searchplugins\
icqplugin.xml
startsear.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-12-26 347424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-12-26 49440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2011-05-13 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2011-09-14 56712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-09-08 4030008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe [2011-12-19 619352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2011-09-27 59240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyDownloads]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Jarka\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-23 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Guard.Mail.ru.gui]
C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [2011-12-29 1564368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
C:\Windows\System32\LogiLDA.dll [2010-11-03 1580368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor]
C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [2009-11-25 95632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAC7302_Monitor]
C:\Windows\PixArt\PAC7302\Monitor.exe [2007-12-10 323584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files (x86)\QuickTime\QTTask.exe [2011-10-24 421888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-05-11 249344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"NoDrives"=0
"NoDriveTypeAutoRun"=153

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2012-01-02 10:49:19 ----D---- C:\rsit
2012-01-02 10:37:53 ----D---- C:\Users\Jarka\AppData\Roaming\IObit
2012-01-02 10:34:11 ----D---- C:\Windows\temp
2012-01-02 10:34:10 ----A---- C:\ComboFix.txt
2012-01-02 10:31:33 ----SHD---- C:\$RECYCLE.BIN
2012-01-02 10:23:30 ----A---- C:\Windows\zip.exe
2012-01-02 10:23:30 ----A---- C:\Windows\SWSC.exe
2012-01-02 10:23:30 ----A---- C:\Windows\SWREG.exe
2012-01-02 10:23:30 ----A---- C:\Windows\sed.exe
2012-01-02 10:23:30 ----A---- C:\Windows\PEV.exe
2012-01-02 10:23:30 ----A---- C:\Windows\NIRCMD.exe
2012-01-02 10:23:30 ----A---- C:\Windows\MBR.exe
2012-01-02 10:23:30 ----A---- C:\Windows\grep.exe
2012-01-02 10:22:50 ----D---- C:\Windows\ERDNT
2011-12-30 22:25:45 ----D---- C:\Users\Jarka\AppData\Roaming\Wise Registry Cleaner
2011-12-30 22:25:09 ----D---- C:\Program Files (x86)\Wise Registry Cleaner
2011-12-30 22:03:37 ----D---- C:\Users\Jarka\AppData\Roaming\Malwarebytes
2011-12-30 22:03:33 ----D---- C:\ProgramData\Malwarebytes
2011-12-30 21:45:07 ----D---- C:\Qoobox
2011-12-30 11:49:59 ----A---- C:\Windows\SYSWOW64\Remover.ini
2011-12-30 11:49:59 ----A---- C:\Windows\SYSWOW64\Remove.exe
2011-12-30 11:49:51 ----D---- C:\Program Files (x86)\KYE SYSTEMS CORP
2011-12-30 11:49:49 ----A---- C:\Windows\SYSWOW64\P7302USD.dll
2011-12-30 11:36:10 ----D---- C:\inetpub
2011-12-30 08:53:22 ----A---- C:\Windows\system32\RegistryDefragBootTime.exe
2011-12-29 15:35:07 ----D---- C:\Program Files (x86)\Guard-ICQ
2011-12-29 15:34:37 ----D---- C:\Program Files (x86)\ICQ7.7
2011-12-27 11:14:48 ----D---- C:\Windows\PixArt
2011-12-26 08:35:57 ----A---- C:\Windows\system32\javaws.exe
2011-12-26 08:35:57 ----A---- C:\Windows\system32\javaw.exe
2011-12-26 08:35:57 ----A---- C:\Windows\system32\deployJava1.dll
2011-12-26 08:35:32 ----D---- C:\Program Files\Java
2011-12-18 16:11:35 ----D---- C:\Users\Jarka\AppData\Roaming\Jewel Match 3
2011-12-14 07:33:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-12-14 07:33:27 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-12-14 07:33:27 ----A---- C:\Windows\system32\mshtmled.dll
2011-12-14 07:33:27 ----A---- C:\Windows\system32\iertutil.dll
2011-12-14 07:33:26 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-12-14 07:33:26 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-12-14 07:33:26 ----A---- C:\Windows\SYSWOW64\url.dll
2011-12-14 07:33:26 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-12-14 07:33:26 ----A---- C:\Windows\system32\wininet.dll
2011-12-14 07:33:26 ----A---- C:\Windows\system32\urlmon.dll
2011-12-14 07:33:26 ----A---- C:\Windows\system32\url.dll
2011-12-14 07:33:26 ----A---- C:\Windows\system32\jsproxy.dll
2011-12-14 07:33:26 ----A---- C:\Windows\system32\ieui.dll
2011-12-14 07:33:25 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-12-14 07:33:25 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-12-14 07:33:25 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-12-14 07:33:25 ----A---- C:\Windows\system32\jscript9.dll
2011-12-14 07:33:25 ----A---- C:\Windows\system32\jscript.dll
2011-12-14 07:33:24 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-12-14 07:33:22 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-12-14 07:33:22 ----A---- C:\Windows\system32\mshtml.dll
2011-12-14 07:33:22 ----A---- C:\Windows\system32\ieframe.dll
2011-12-14 07:32:30 ----A---- C:\Windows\system32\csrsrv.dll
2011-12-14 07:32:24 ----A---- C:\Windows\SYSWOW64\tzres.dll
2011-12-14 07:32:24 ----A---- C:\Windows\system32\tzres.dll
2011-12-14 07:32:10 ----A---- C:\Windows\SYSWOW64\EncDec.dll
2011-12-14 07:32:10 ----A---- C:\Windows\system32\EncDec.dll
2011-12-14 07:32:08 ----A---- C:\Windows\system32\win32k.sys
2011-12-12 08:59:48 ----D---- C:\Program Files (x86)\jv16 PowerTools 2011
2011-12-04 20:01:25 ----D---- C:\Program Files (x86)\Conduit
2011-12-04 20:01:24 ----D---- C:\Program Files (x86)\ConduitEngine
2011-12-04 20:01:22 ----D---- C:\Program Files (x86)\MyAshampoo
2011-12-04 20:01:16 ----D---- C:\ProgramData\ashampoo
2011-12-04 20:01:10 ----D---- C:\Program Files (x86)\Ashampoo

======List of files/folders modified in the last 1 month======

2012-01-02 10:49:25 ----D---- C:\Program Files\trend micro
2012-01-02 10:38:36 ----SHD---- C:\System Volume Information
2012-01-02 10:35:16 ----D---- C:\Windows\System32
2012-01-02 10:35:16 ----D---- C:\Windows\inf
2012-01-02 10:35:16 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-02 10:34:11 ----D---- C:\Windows\system32\drivers
2012-01-02 10:34:11 ----D---- C:\Windows
2012-01-02 10:31:31 ----A---- C:\Windows\system.ini
2012-01-02 10:31:27 ----D---- C:\Windows\system32\drivers\etc
2012-01-02 10:30:52 ----D---- C:\ProgramData\NVIDIA
2012-01-02 10:29:35 ----D---- C:\Windows\system32\config
2012-01-02 10:29:08 ----RD---- C:\Program Files (x86)
2012-01-02 10:29:07 ----D---- C:\Windows\Tasks
2012-01-02 10:27:46 ----D---- C:\Windows\SYSWOW64\drivers
2012-01-02 10:27:46 ----D---- C:\Windows\SysWOW64
2012-01-02 10:27:46 ----D---- C:\Windows\AppPatch
2012-01-02 10:27:44 ----D---- C:\Program Files\Common Files
2012-01-02 10:27:44 ----D---- C:\Program Files (x86)\Common Files
2012-01-02 09:28:32 ----D---- C:\Users\Jarka\AppData\Roaming\Skype
2012-01-02 09:27:25 ----D---- C:\Users\Jarka\AppData\Roaming\ICQ
2012-01-01 10:37:35 ----D---- C:\Windows\Prefetch
2011-12-31 21:25:20 ----D---- C:\Windows\system32\catroot2
2011-12-31 21:21:12 ----D---- C:\ProgramData
2011-12-31 21:10:01 ----D---- C:\ZÁLOHY
2011-12-31 20:27:46 ----D---- C:\Windows\rescache
2011-12-31 18:13:13 ----D---- C:\Windows\Microsoft.NET
2011-12-31 14:55:44 ----SHD---- C:\Windows\Installer
2011-12-31 14:55:44 ----D---- C:\Config.Msi
2011-12-31 14:55:31 ----RSD---- C:\Windows\assembly
2011-12-31 11:28:54 ----D---- C:\Users\Jarka\AppData\Roaming\JewelMatch2
2011-12-30 21:39:42 ----D---- C:\Stažené soubory
2011-12-30 16:55:44 ----D---- C:\Windows\SoftwareDistribution
2011-12-30 16:06:39 ----D---- C:\Windows\pss
2011-12-30 11:49:51 ----D---- C:\Windows\twain_32
2011-12-30 11:36:27 ----D---- C:\Windows\winsxs
2011-12-30 11:36:14 ----D---- C:\Windows\SYSWOW64\migration
2011-12-30 11:36:14 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-12-30 11:36:13 ----D---- C:\Windows\SYSWOW64\inetsrv
2011-12-30 11:36:12 ----D---- C:\Windows\system32\migration
2011-12-30 11:36:12 ----D---- C:\Windows\system32\inetsrv
2011-12-30 11:36:12 ----D---- C:\Windows\system32\cs-CZ
2011-12-30 10:59:01 ----HD---- C:\Program Files (x86)\Temp
2011-12-30 07:43:56 ----D---- C:\Windows\system32\catroot
2011-12-29 15:35:07 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-12-29 15:35:03 ----D---- C:\ProgramData\ICQ
2011-12-27 11:06:20 ----A---- C:\Windows\win.ini
2011-12-27 11:04:55 ----D---- C:\Windows\system32\Tasks
2011-12-26 20:17:44 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2011-12-26 20:17:44 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-12-26 08:35:32 ----RD---- C:\Program Files
2011-12-26 08:31:24 ----D---- C:\Program Files (x86)\Java
2011-12-22 09:02:01 ----D---- C:\Program Files\CCleaner
2011-12-18 16:14:23 ----D---- C:\Luba hry
2011-12-17 13:08:55 ----D---- C:\Windows\SYSWOW64\config
2011-12-17 13:03:22 ----D---- C:\ProgramData\IObit
2011-12-17 13:02:31 ----D---- C:\Program Files (x86)\IObit
2011-12-14 07:39:17 ----D---- C:\Windows\debug
2011-12-14 07:35:16 ----D---- C:\Program Files\Internet Explorer
2011-12-14 07:35:16 ----D---- C:\Program Files (x86)\Internet Explorer
2011-12-14 07:33:55 ----A---- C:\Windows\system32\MRT.exe
2011-12-13 19:11:00 ----D---- C:\Fotky
2011-12-05 08:54:30 ----D---- C:\Program Files\Defraggler

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 62496]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-10-02 537112]
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-09-07 121432]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 38288]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-08-04 187632]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-09-03 2480104]
R3 PAC7302;eMessenger 310; C:\Windows\system32\DRIVERS\PAC7302.SYS [2009-04-28 532480]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2011-05-13 48488]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-12-30 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2011-05-11 30528]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-08 974944]
R2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 980072]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 Smart TimeLock;Smart TimeLock Service; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-05-13 1492840]
S3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-05-11 1255736]
S4 AdvancedSystemCareService5;Advanced SystemCare Service 5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-19 494424]
S4 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S4 DES2 Service;DES2 Service for Energy Saving.; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
S4 Guard.Mail.ru;Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [2011-12-29 1564368]
S4 JMB36X;JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

#10 Příspěvek od **vyosek** » 02 led 2012 11:43

Odinstalujte Advanced SystemCare 5 a nasledne i vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

Tu aktualizaci muzete ignorovat a skryt ji aby se nezobrazovala - zatim neni nutna - s temi .NET jsou neustale problemy

Spustte HJT a provedeme fixnuti polozek

HJT najdete zde C:\Program Files\trend micro\Jarka.exe
Otevre se Vam okno, kliknete na Do a system scan only
V dalsim okne najdete radky které jsem Vam vypsal nize, vedle nich je ctverecek, do ktereho udelate zatrzitko
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (file missing)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (file missing)
Kliknete na Fix checked (vlevo dole)
HJT se Vas zepta zda opravdu ANO, s tim souhlasite a je hotovo

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyDownloads]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Guard.Mail.ru.gui]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

:files
C:\Users\Jarka\AppData\Roaming\IObit
C:\Program Files (x86)\IObit
C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\searchplugins\icqplugin.xml
C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\searchplugins\startsear.xml
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

jaruneczka · #11 Příspěvek od **jaruneczka** » 02 led 2012 11:54

...start pořád pomalý, zde log:

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyDownloads\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Guard.Mail.ru.gui\ not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task\ not found.
========== FILES ==========
File/Folder C:\Users\Jarka\AppData\Roaming\IObit not found.
C:\Program Files (x86)\IObit\Advanced SystemCare 5\Update folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 5\SecurityHole_Backup folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 5\LatestNews folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 5\BootTimeLog folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCServiceLog folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 5 folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Update folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\LatestNews folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Freeware\FreeSoftwareDownload folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Freeware folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Backup\Registry folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Backup folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4\Advanced System Care Pro key folder moved successfully.
C:\Program Files (x86)\IObit\Advanced SystemCare 4 folder moved successfully.
C:\Program Files (x86)\IObit folder moved successfully.
C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\searchplugins\icqplugin.xml moved successfully.
C:\Users\Jarka\AppData\Roaming\Mozilla\Firefox\Profiles\hw6zn1q5.default\searchplugins\startsear.xml moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jarka
->Temp folder emptied: 1394101 bytes
->Temporary Internet Files folder emptied: 379868 bytes
->Java cache emptied: 1744245 bytes
->FireFox cache emptied: 45814451 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 470 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 16353 bytes

Total Files Cleaned = 47,00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Jarka
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb

OTM by OldTimer - Version 3.1.19.0 log created on 01022012_114955

Files moved on Reboot...
C:\Users\Jarka\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

#12 Příspěvek od **vyosek** » 02 led 2012 11:59

Co trva dlouho? nez nabehne logo windows, nez nabehne plocha

jaruneczka · #13 Příspěvek od **jaruneczka** » 02 led 2012 12:04

...plocha. A u logo windows začne bedna "makat fest"

#14 Příspěvek od **vyosek** » 02 led 2012 12:08

nemate na plose nejake velke soubory\slozky

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

Do okna vlozte skript nize
Kód: Vybrat vše
```
:dir
%userprofile%\Desktop 
```
Kliknete na Look
Tlacitko Look se zmeni na Scanning a zsedne
Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

jaruneczka · #15 Příspěvek od **jaruneczka** » 02 led 2012 12:15

NA PLOŠE MÁ SYN POUZE IKONY HER-

SystemLook 30.07.11 by jpshortstuff
Log created at 12:15 on 02/01/2012 by Jarka
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== dir ==========

C:\Users\Jarka\Desktop - Parameters: "(none)"

---Files---
3512DQFO.bat --ah--- 37973 bytes [19:54 25/09/2011] [19:54 25/09/2011]
3log.txt --a---- 8294 bytes [10:52 02/01/2012] [10:52 02/01/2012]
Action ball.lnk --a---- 697 bytes [17:08 11/05/2011] [17:08 11/05/2011]
Air Hawk 3 - Desert Storm.lnk --a---- 866 bytes [11:01 08/06/2011] [11:01 08/06/2011]
AmazonAdve.lnk --a---- 1173 bytes [17:09 11/05/2011] [17:09 11/05/2011]
ApplePie.lnk --a---- 652 bytes [17:10 11/05/2011] [17:10 11/05/2011]
Azteca.lnk --a---- 998 bytes [17:10 11/05/2011] [17:10 11/05/2011]
Big Kahuna Reef 2.lnk --a---- 737 bytes [17:10 11/05/2011] [17:10 11/05/2011]
Birds.lnk --a---- 643 bytes [17:11 11/05/2011] [17:11 11/05/2011]
ComboFix.exe -r----- 4360044 bytes [09:20 02/01/2012] [09:23 02/01/2012]
CosmicBall.lnk --a---- 672 bytes [17:10 11/05/2011] [17:10 11/05/2011]
desktop.ini --ahs-- 282 bytes [12:28 11/05/2011] [18:49 25/10/2011]
Dragon.lnk --a---- 623 bytes [17:11 11/05/2011] [17:11 11/05/2011]
Egyptoball.lnk --a---- 667 bytes [17:11 11/05/2011] [17:11 11/05/2011]
Evoly.lnk --a---- 703 bytes [17:11 11/05/2011] [17:11 11/05/2011]
Fairy jewels.lnk --a---- 653 bytes [17:11 11/05/2011] [17:11 11/05/2011]
Fairy Nook.lnk --a---- 667 bytes [17:12 11/05/2011] [17:12 11/05/2011]
Fishdom.lnk --a---- 705 bytes [17:12 11/05/2011] [17:12 11/05/2011]
Fun And Bullets.lnk --a---- 801 bytes [15:04 29/07/2011] [15:04 29/07/2011]
JewelMatch2.lnk --a---- 687 bytes [17:12 11/05/2011] [17:12 11/05/2011]
JewelMatch3.lnk --a---- 747 bytes [15:12 18/12/2011] [15:15 18/12/2011]
JewelMatch_WinteR.lnk --a---- 847 bytes [17:12 11/05/2011] [17:12 11/05/2011]
JÍDELNÍČEK.txt --a---- 457 bytes [14:20 11/09/2011] [07:54 17/12/2011]
Magic Ball 4.lnk --a---- 815 bytes [17:13 11/05/2011] [17:13 11/05/2011]
OceanQuest.lnk --a---- 672 bytes [17:13 11/05/2011] [17:13 11/05/2011]
OTM.exe --a---- 523264 bytes [10:48 02/01/2012] [10:48 02/01/2012]
Peggle.lnk --a---- 660 bytes [17:13 11/05/2011] [17:13 11/05/2011]
PeggleWoW.lnk --a---- 1388 bytes [17:13 11/05/2011] [17:13 11/05/2011]
Ricochet.lnk --a---- 682 bytes [17:14 11/05/2011] [17:14 11/05/2011]
RomePuzzle.lnk --a---- 1083 bytes [17:14 11/05/2011] [17:14 11/05/2011]
RSITx64.exe --a---- 935175 bytes [09:48 02/01/2012] [09:49 02/01/2012]
Smash Frenzy 3.lnk --a---- 1183 bytes [06:57 30/10/2011] [06:57 30/10/2011]
Spril aqua.lnk --a---- 1142 bytes [17:14 11/05/2011] [17:14 11/05/2011]
StarDefender4.lnk --a---- 707 bytes [17:15 11/05/2011] [17:15 11/05/2011]
Strike ball.lnk --a---- 778 bytes [17:09 11/05/2011] [17:09 11/05/2011]
Submarine.lnk --a---- 662 bytes [17:12 11/05/2011] [17:12 11/05/2011]
SystemLook.exe --a---- 139264 bytes [11:14 02/01/2012] [11:14 02/01/2012]
SystemLook.txt --a---- 0 bytes [11:15 02/01/2012] [11:15 02/01/2012]
The Rise of Atlantis.lnk --a---- 767 bytes [17:16 11/05/2011] [17:16 11/05/2011]
Tropical Fish Shop- Annabel’s Adventure.lnk --a---- 942 bytes [18:20 12/06/2011] [18:20 12/06/2011]
Tumblebugs.lnk --a---- 682 bytes [17:16 11/05/2011] [17:16 11/05/2011]
Turboball.lnk --a---- 1007 bytes [17:16 11/05/2011] [17:16 11/05/2011]
Under puzzle.lnk --a---- 656 bytes [17:17 11/05/2011] [17:17 11/05/2011]
Zuma wars.lnk --a---- 1045 bytes [17:17 11/05/2011] [17:17 11/05/2011]
Zuma.lnk --a---- 958 bytes [17:17 11/05/2011] [17:17 11/05/2011]

---Folders---
None found.

-= EOF =-

VIRY.CZ

pro vyosek: prosím o kontrolu logu Combo fix-děkuji

pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji

Re: pro vyosek: prosím o kontrolu logu Combo fix-děkuji