Problém s Security Shield

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
sylar

Problém s Security Shield

#1 Příspěvek od sylar »

Zdravím,
před několika dny jsem řešil problém se Smart Fortress 2012, ještě jsem nestačil dát PC do ani pořádně do kupy a dnes se mi do PC dostal Security Shield.

Zajímalo by mne jak se dá proti těmto virům bránit. Používám MS Sec. Essen. a až na tyto dva případy jsem s viry po dlouhá léta problémy neměl. Temná zákoutí internetu neprolézám, všechny stránky, na kterých jsem za těch pár dnů byl znám a navštěvuji je roky. Je možné, aby se vir dostal do PC "odjinud"? Je také možné, že první útok od Smart Fortress zanechal v PC "nějakou značku", která "přitahuje" ostatní viry? Problém jsem zde řešil s jedním z kolegů a po dočištění jsme v logu z CF již nic nenašli.

Prohnal jsem ho ComboFixem a vylezlo z něj toto:

ComboFix 12-05-23.05 - Jiřík 23.05.2012 23:00:52.3.4 - x86 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2806.1980 [GMT 2:00]
Spuštěný z: d:\programy\AV & AS Tools\ComboFix\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jiřík\AppData\Local\vxpkfbxeen.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-23 do 2012-05-23 )))))))))))))))))))))))))))))))
.
.
2012-05-23 21:12 . 2012-05-23 21:13 -------- d-----w- c:\users\Jiřík\AppData\Local\temp
2012-05-23 21:12 . 2012-05-23 21:12 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-23 21:12 . 2012-05-23 21:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-23 14:18 . 2012-05-23 14:18 -------- d-----w- c:\program files\QS
2012-05-23 08:24 . 2012-05-23 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{9B134862-76A4-4E8D-9930-5702AF917067}
2012-05-23 08:24 . 2012-05-23 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{9F126254-5094-4DA0-84D4-4887D9CC0A76}
2012-05-22 21:25 . 2012-05-22 21:29 -------- d-----w- c:\users\Jiřík\AppData\Roaming\PSpad
2012-05-22 21:25 . 2012-05-22 21:25 -------- d-----w- c:\program files\PSPad editor
2012-05-22 20:03 . 2012-05-22 20:03 -------- d-----w- c:\program files\ProFact 3.0 Free
2012-05-22 18:57 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AF8513E3-C363-4589-BE76-33B0C2BB4115}\mpengine.dll
2012-05-22 18:47 . 2012-05-22 18:47 -------- d-----w- c:\program files\Common Files\Skype
2012-05-22 09:17 . 2012-05-22 09:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{15A0DAE2-90AA-4152-ADC7-5FDEE47F04C8}
2012-05-22 09:17 . 2012-05-22 09:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{79ABEC86-DD88-4FF4-9D8A-67FF97405047}
2012-05-21 10:13 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-21 10:07 . 2012-05-21 10:07 -------- d-----w- c:\users\Jiřík\AppData\Local\{C85F4E91-6DDF-4875-934C-29E5F829463C}
2012-05-21 10:07 . 2012-05-21 10:07 -------- d-----w- c:\users\Jiřík\AppData\Local\{8B3A4927-FF3E-43F4-95A8-E51836DA3EB5}
2012-05-20 09:57 . 2012-05-20 09:57 -------- d-----w- c:\users\Jiřík\AppData\Local\{DDA48ADA-14BC-4841-A9CE-4D2D2BC94FBD}
2012-05-20 09:56 . 2012-05-20 09:56 -------- d-----w- c:\users\Jiřík\AppData\Local\{EE018629-852E-4DF8-A25D-AF7925C73327}
2012-05-19 15:33 . 2012-05-23 17:24 -------- d-----w- c:\programdata\B7E858980001A19F000B270DB4EB23C1
2012-05-19 10:09 . 2012-05-19 10:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{7B53C057-4031-459F-8E30-F84E7017FECD}
2012-05-19 10:08 . 2012-05-19 10:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{E0BFB475-4316-4754-8CC0-6FEC21257753}
2012-05-18 22:08 . 2012-05-18 22:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{2576855F-C296-4F5C-9DD0-E11FDB294BE5}
2012-05-18 22:08 . 2012-05-18 22:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{58E713DB-D712-4DD2-A562-04A74BB0F63A}
2012-05-17 22:09 . 2012-05-17 22:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{98135271-BB76-48F6-9789-810DE1D55C93}
2012-05-17 22:09 . 2012-05-17 22:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{4A4568D7-8D7F-4310-8096-7645869224EA}
2012-05-17 10:04 . 2012-05-17 10:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{FE2D3A08-ABCF-4037-BA21-102564E0162C}
2012-05-17 10:03 . 2012-05-17 10:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{DC42BAE9-BD64-47D9-916D-3505C5BA6B2A}
2012-05-16 13:37 . 2012-05-16 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{74EE064C-D0FF-41A5-9804-2E06ADDA487F}
2012-05-16 13:37 . 2012-05-16 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{6F24B6A8-D97A-4124-BA8A-1696046E70C9}
2012-05-15 21:43 . 2012-05-15 21:43 -------- d-----w- c:\users\Jiřík\AppData\Local\{219FF913-99A3-4432-BEA0-C78431FA03BB}
2012-05-15 21:42 . 2012-05-15 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{525C8520-848C-4830-881E-ED5F02851AA8}
2012-05-15 19:09 . 2012-05-15 19:09 -------- d-----w- c:\program files\Common Files\Java
2012-05-15 19:08 . 2012-05-15 19:08 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-15 19:08 . 2012-05-15 19:08 -------- d-----w- c:\program files\Java
2012-05-15 09:11 . 2012-05-15 09:11 -------- d-----w- c:\users\Jiřík\AppData\Local\{0523F76F-D607-4AA1-9BD7-2F355C68641D}
2012-05-15 09:11 . 2012-05-15 09:11 -------- d-----w- c:\users\Jiřík\AppData\Local\{01D81106-0FB9-4EC8-B011-D5539F681752}
2012-05-14 09:41 . 2012-05-14 09:41 -------- d-----w- c:\users\Jiřík\AppData\Local\{1A0CE416-15CF-40ED-B56B-96121F67E049}
2012-05-14 09:40 . 2012-05-14 09:41 -------- d-----w- c:\users\Jiřík\AppData\Local\{EC7F6CB5-6439-4CA5-A2D2-9D31760AC7AE}
2012-05-13 21:16 . 2012-05-13 21:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{484486A1-D6AD-49E2-AC55-B8F4A1EEB588}
2012-05-13 21:16 . 2012-05-13 21:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{BC2DE636-FA51-4A49-BF1F-EAEB2D25D033}
2012-05-13 08:54 . 2012-05-13 08:54 -------- d-----w- c:\users\Jiřík\AppData\Local\{053FBDE7-7EB6-4C0C-8B3A-B452B63C8BFF}
2012-05-13 08:54 . 2012-05-13 08:54 -------- d-----w- c:\users\Jiřík\AppData\Local\{31E03B51-F601-41C8-AD51-0D0D700E2548}
2012-05-12 12:52 . 2012-05-12 12:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{BD698C92-FC75-4D78-B95A-073A71EF5BCD}
2012-05-12 12:52 . 2012-05-12 12:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{4E196BF1-9E38-4E27-AF57-E8A170C31023}
2012-05-12 08:32 . 2012-03-30 10:23 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 08:32 . 2012-03-31 04:29 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 08:32 . 2012-03-31 04:30 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-12 08:32 . 2012-03-31 04:29 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-12 08:32 . 2012-03-31 04:29 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-12 08:31 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-12 08:31 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 08:31 . 2012-03-31 02:36 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-05-12 08:31 . 2012-03-17 07:27 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 08:31 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-05-12 00:51 . 2012-05-12 00:51 -------- d-----w- c:\users\Jiřík\AppData\Local\{65E12B16-99E6-4B2D-A36F-623A7D1AA85F}
2012-05-12 00:51 . 2012-05-12 00:51 -------- d-----w- c:\users\Jiřík\AppData\Local\{022791BF-8348-49AF-B1CD-DCBFBD0D539A}
2012-05-11 08:15 . 2012-05-11 08:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{18BE2C29-9AF2-4465-B96B-203583D24863}
2012-05-11 08:15 . 2012-05-11 08:15 -------- d-----w- c:\users\Jiřík\AppData\Local\{7410E5E6-070C-48EC-A550-47751829D0F6}
2012-05-10 09:33 . 2012-05-10 09:33 -------- d-----w- c:\users\Jiřík\AppData\Local\{B759EC2D-F99F-45D4-B58F-D4CB26A94925}
2012-05-10 09:33 . 2012-05-10 09:33 -------- d-----w- c:\users\Jiřík\AppData\Local\{B1824038-8F58-4E6A-9F83-D2FFAAF5BE81}
2012-05-09 21:32 . 2012-05-09 21:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{E8D917C3-8319-4DE9-8521-D63EABD385B8}
2012-05-09 21:32 . 2012-05-09 21:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{0410FC84-4122-4E83-8677-A129DF3BBACF}
2012-05-09 09:32 . 2012-05-09 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{3627C6BF-EC15-4011-B50B-52AE500D59A5}
2012-05-09 09:31 . 2012-05-09 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{805FAD2C-FAE2-4CCB-BF9E-D971DA380097}
2012-05-08 21:31 . 2012-05-08 21:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{ADAFB1A4-C858-46FF-8C2C-D5D114807C22}
2012-05-08 21:31 . 2012-05-08 21:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{9DFBD8E5-4B6E-454C-922C-321D5448381E}
2012-05-08 09:30 . 2012-05-08 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{EBADFFFD-113C-4112-95ED-F252DB5E49B0}
2012-05-08 09:30 . 2012-05-08 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{C635A462-7072-45FA-9E8D-E05E803F50FB}
2012-05-07 21:30 . 2012-05-07 21:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{12A4B649-8286-4164-AEF3-470C8575020C}
2012-05-07 21:30 . 2012-05-07 21:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{6072EF52-2B36-4A9B-88B0-5B8A4D1C755F}
2012-05-07 09:29 . 2012-05-07 09:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{54039611-0B9C-466F-A889-C2A90C8EC490}
2012-05-07 09:29 . 2012-05-07 09:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{21BFCD9B-E847-43C5-92EF-1D376348CCB0}
2012-05-06 13:37 . 2012-05-06 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{498C584F-B327-48BC-A586-3AFC305FB094}
2012-05-06 13:37 . 2012-05-06 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{B3508A58-C5CE-41CE-92E0-9946AAA80354}
2012-05-05 22:52 . 2012-05-05 22:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{5EF9DD02-BDDC-4DAA-921E-897D44BC6FC0}
2012-05-05 22:52 . 2012-05-05 22:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{4B2028B7-4C6C-42B3-86AE-682D65CA75F9}
2012-05-05 09:08 . 2012-05-05 09:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{7D2D239C-9194-4A1C-A7FC-2AE1F7B40CAE}
2012-05-05 09:08 . 2012-05-05 09:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{DFDD4D05-7273-4C53-8B54-15C089D1D4F7}
2012-05-04 15:04 . 2012-05-04 15:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{46358F6E-5EA2-4742-9119-280D6EA6D4B1}
2012-05-04 15:04 . 2012-05-04 15:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{2B8A4F78-F4F1-4552-8C50-E1FF72C0B8BB}
2012-05-03 23:28 . 2012-05-03 23:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{E73704F5-19F8-4D1A-BE99-2FBB15B6E433}
2012-05-03 23:28 . 2012-05-03 23:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{3FE2DB16-E594-4D3E-BEDE-7F1EBE224F75}
2012-05-03 09:35 . 2012-05-03 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{74A01F40-6BEC-40C2-AF31-B4BE4FC777D4}
2012-05-03 09:35 . 2012-05-03 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{CE6085C5-D305-4087-B692-3901E9EE2B13}
2012-05-02 21:35 . 2012-05-02 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{0EFC50F6-8031-42FB-92DF-5C3BECE39F6F}
2012-05-02 21:34 . 2012-05-02 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{DFADE552-F56E-442F-BE00-C5FA4570E907}
2012-05-02 09:14 . 2012-05-02 09:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{AA572432-27FE-4055-8B97-08FC90A8F1B9}
2012-05-02 09:14 . 2012-05-02 09:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{437E9123-8E01-497A-B907-E8B045E894AE}
2012-05-01 10:13 . 2012-05-01 10:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{ABF213C5-0363-491E-9C42-59A7329EEE67}
2012-05-01 10:13 . 2012-05-01 10:13 -------- d-----w- c:\users\Jiřík\AppData\Local\{1EAA96EA-9869-4DBD-8EE9-3BFD08277928}
2012-04-30 21:34 . 2012-04-30 21:34 -------- d-----w- c:\users\Jiřík\AppData\Local\{AC02D5F6-2E3A-4BA4-8915-86013F79AD58}
2012-04-30 21:34 . 2012-04-30 21:34 -------- d-----w- c:\users\Jiřík\AppData\Local\{16325F96-FEA8-4742-A591-AECE6A14B827}
2012-04-30 09:32 . 2012-04-30 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{7F6DE3BD-71B0-4781-8B4B-2B34FA61F21F}
2012-04-30 09:32 . 2012-04-30 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{5E62F060-677C-4307-BC12-43864966E337}
2012-04-29 09:31 . 2012-04-29 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{91739962-7C1C-41CB-87ED-9B9AFCF278CE}
2012-04-29 09:30 . 2012-04-29 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{F64C6ABB-50B7-4CAD-B2F0-39C11C92E327}
2012-04-28 10:28 . 2012-04-28 10:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{B852656C-A10E-4A46-828C-56FFCB9AD6F9}
2012-04-28 10:28 . 2012-04-28 10:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{0E275C7E-14BF-4CA4-BB8F-5E3A26E4EB59}
2012-04-27 22:28 . 2012-04-27 22:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{DCF98277-45B8-4687-99D7-BB8F09843DA1}
2012-04-27 22:27 . 2012-04-27 22:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{6DBAA99A-4B5B-44B2-A164-81F03DDA811D}
2012-04-26 21:20 . 2012-04-26 21:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{D1F1A2C7-1290-4EE2-AE60-4A2E08D6306A}
2012-04-26 21:20 . 2012-04-26 21:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{C98A0689-4DFF-4AD5-84C5-71276F9E0517}
2012-04-26 09:19 . 2012-04-26 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{1C94AFB7-5627-4379-8226-0DA1B181268E}
2012-04-26 09:19 . 2012-04-26 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{8B8A32E3-1A9C-4609-8ADD-BC483C0E7408}
2012-04-25 19:36 . 2012-04-25 19:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{199DDBA9-CD6A-48EB-AF74-BED60A5C9085}
2012-04-25 19:36 . 2012-04-25 19:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{D0E5AE61-6216-448C-9210-DFC431973A5A}
2012-04-25 07:36 . 2012-04-25 07:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{C102BB5F-F33F-4960-8BCB-8CEAD29C778C}
2012-04-25 07:36 . 2012-04-25 07:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{A6373AD9-044E-4A60-9D5B-65ADEFED1614}
2012-04-24 09:22 . 2012-04-24 09:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{EB91095E-B1CA-44D6-8712-E1FC349A8839}
2012-04-24 09:21 . 2012-04-24 09:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{75D6CA05-9632-4928-A01B-824DA31E927C}
2012-04-23 21:21 . 2012-04-23 21:21 -------- d-----w- c:\users\Jiřík\AppData\Local\{0B5738E7-3155-4EEE-897D-F7E84A729D07}
2012-04-23 21:21 . 2012-04-23 21:21 -------- d-----w- c:\users\Jiřík\AppData\Local\{49C47BDE-AB07-40C5-B04E-7D8A0AB4C4EB}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-15 19:08 . 2011-12-07 12:53 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-05 16:34 . 2012-03-30 07:59 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 16:34 . 2011-07-03 15:27 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-20 18:44 . 2010-10-24 20:25 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-20 18:44 . 2010-10-24 20:25 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-08 16:37 . 2012-03-08 16:37 302448 ----a-w- c:\windows\WLXPGSS.SCR
2012-03-01 05:46 . 2012-04-12 10:23 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-12 10:23 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-12 10:23 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 10:23 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-12 10:31 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 10:31 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 10:31 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 10:31 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-02-22 3508624]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-29 21416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-19 1594664]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-11-19 83240]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2010-09-29 3058304]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"HotkeyMon"="AsusSender.exe" [2010-03-03 29184]
"HotkeyService"="AsusSender.exe" [2010-03-03 29184]
"SuperHybridEngine"="AsusSender.exe" [2010-03-03 29184]
"CapsHook"="AsusSender.exe" [2010-03-03 29184]
"GraphicsSwitch"="AsusSender.exe" [2010-03-03 29184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-10 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-10 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-24 9722472]
"iSeriesCharge"="c:\program files\ASUS\USBChargeSetting\iSeriesCharge.exe" [2010-08-18 96176]
"ASUSPRP"="c:\program files\ASUS\APRP\APRP.EXE" [2010-09-29 2018032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2010-03-31 11520]
R2 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2011-01-20 217088]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-05-21 293928]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-05-21 33320]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2011-01-20 36640]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-08-04 105576]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-07 1343400]
S0 AiDriver;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiDriver.sys [2010-05-20 13224]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-08-04 19656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-07-29 68208]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 59904]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 139648]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 16:34]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 17:23]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 17:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.
.
Celkový čas: 2012-05-23 23:17:02
ComboFix-quarantined-files.txt 2012-05-23 21:17
ComboFix2.txt 2012-05-19 16:57
.
Před spuštěním: Volných bajtů: 36 505 317 376
Po spuštění: Volných bajtů: 36 477 063 168
.
- - End Of File - - 1E539327EC2D6A8555807095AD4851A9
Naposledy upravil(a) Mc_Murphy dne 24 Kvě 2012 06:29, celkem upraveno 1 x.
Důvod: Log odstraněn z [Code].
Nahoru
sylar

Re: Problém s Security Shield

#2 Příspěvek od sylar »

ještě přikládám log z RSITu

Logfile of random's system information tool 1.09 (written by random/random)
Run by Jiřík at 2012-05-24 14:20:32
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 35 GB (59%) free of 59 GB
Total RAM: 2806 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:21:16, on 24.5.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ASUS\USBChargeSetting\iSeriesCharge.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\Mozilla Firefox 3\firefox.exe
C:\Program Files\Mozilla Firefox 3\plugin-container.exe
C:\windows\system32\SearchFilterHost.exe
C:\Users\Jiřík\Desktop\RSIT.exe
C:\Program Files\trend micro\Jiřík.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\windows\AsScrPro.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [HotkeyMon] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
O4 - HKLM\..\Run: [HotkeyService] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
O4 - HKLM\..\Run: [SuperHybridEngine] AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
O4 - HKLM\..\Run: [CapsHook] AsusSender.exe C:\Program Files\EeePC\CapsHook\CapsHook.exe
O4 - HKLM\..\Run: [GraphicsSwitch] AsusSender.exe C:\Program Files\Asus\GraphicsSwitch\GPUStatusMonitor.exe
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [iSeriesCharge] C:\Program Files\ASUS\USBChargeSetting\iSeriesCharge.exe
O4 - HKLM\..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\APRP.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\System32\nvinit.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Asus Launcher Service (AsusService) - Unknown owner - C:\Windows\System32\AsusService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: FsUsbExService - Teruten - C:\windows\system32\FsUsbExService.Exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 6938 bytes

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.18"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.235 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32]
"Description"=
"Path"=C:\windows\system32\npdeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

C:\Program Files\Mozilla Firefox 3\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox 3\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox 3\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox 3\searchplugins\
Cetrumcz_igeared.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\extensions\
{c45c406e-ab73-11d8-be73-000a95be3b12}
{e3f6c2cc-d8db-498c-af6c-499fb211db97}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-05-15 329504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-05-15 59168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D5D47440-0750-463D-BAEF-A47D02414806}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-06-05 186904]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-11-19 1594664]
"SynAsusAcpi"=C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [2009-11-19 83240]
"ASUS Screen Saver Protector"=C:\windows\AsScrPro.exe [2010-09-29 3058304]
"UCam_Menu"=C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]
"HotkeyMon"=AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe []
"HotkeyService"=AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe []
"SuperHybridEngine"=AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe []
"CapsHook"=AsusSender.exe C:\Program Files\EeePC\CapsHook\CapsHook.exe []
"GraphicsSwitch"=AsusSender.exe C:\Program Files\Asus\GraphicsSwitch\GPUStatusMonitor.exe []
"IgfxTray"=C:\windows\system32\igfxtray.exe [2010-05-10 141848]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2010-05-10 173592]
"Persistence"=C:\windows\system32\igfxpers.exe [2010-05-10 150552]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-08-24 9722472]
"iSeriesCharge"=C:\Program Files\ASUS\USBChargeSetting\iSeriesCharge.exe [2010-08-18 96176]
"ASUSPRP"=C:\Program Files\ASUS\APRP\APRP.EXE [2010-09-29 2018032]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 931200]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"=C:\Program Files\Samsung\Kies\KiesHelper.exe [2012-02-22 943504]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [2012-02-22 3508624]
"KiesPDLR"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2012-03-29 21416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinit.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2010-05-10 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\windows\system32\webcheck.dll [2011-07-03 203776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "C:\Program Files\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 1 month======

2012-05-24 14:20:33 ----D---- C:\Program Files\trend micro
2012-05-24 14:20:32 ----D---- C:\rsit
2012-05-23 23:17:08 ----SHD---- C:\$RECYCLE.BIN
2012-05-23 23:17:05 ----D---- C:\windows\temp
2012-05-23 23:17:03 ----A---- C:\ComboFix.txt
2012-05-23 16:18:55 ----D---- C:\Program Files\QS
2012-05-22 23:25:29 ----D---- C:\Users\Jiřík\AppData\Roaming\PSpad
2012-05-22 23:25:16 ----D---- C:\Program Files\PSPad editor
2012-05-22 22:03:56 ----D---- C:\Program Files\ProFact 3.0 Free
2012-05-22 20:47:07 ----D---- C:\Program Files\Common Files\Skype
2012-05-19 18:34:28 ----A---- C:\windows\zip.exe
2012-05-19 18:34:28 ----A---- C:\windows\SWSC.exe
2012-05-19 18:34:28 ----A---- C:\windows\SWREG.exe
2012-05-19 18:34:28 ----A---- C:\windows\sed.exe
2012-05-19 18:34:28 ----A---- C:\windows\PEV.exe
2012-05-19 18:34:28 ----A---- C:\windows\NIRCMD.exe
2012-05-19 18:34:28 ----A---- C:\windows\MBR.exe
2012-05-19 18:34:28 ----A---- C:\windows\grep.exe
2012-05-19 18:34:20 ----D---- C:\windows\ERDNT
2012-05-19 18:33:54 ----D---- C:\Qoobox
2012-05-19 18:17:38 ----D---- C:\windows\Minidump
2012-05-19 18:11:53 ----A---- C:\windows\ntbtlog.txt
2012-05-19 17:33:00 ----D---- C:\ProgramData\B7E858980001A19F000B270DB4EB23C1
2012-05-15 21:09:04 ----D---- C:\Program Files\Common Files\Java
2012-05-15 21:08:39 ----A---- C:\windows\system32\npdeployJava1.dll
2012-05-15 21:08:39 ----A---- C:\windows\system32\javaws.exe
2012-05-15 21:08:39 ----A---- C:\windows\system32\javaw.exe
2012-05-15 21:08:39 ----A---- C:\windows\system32\java.exe
2012-05-15 21:08:12 ----D---- C:\Program Files\Java
2012-05-12 10:32:09 ----A---- C:\windows\system32\drivers\tcpip.sys
2012-05-12 10:31:55 ----A---- C:\windows\system32\ntkrnlpa.exe
2012-05-12 10:31:54 ----A---- C:\windows\system32\win32k.sys
2012-05-12 10:31:54 ----A---- C:\windows\system32\ntoskrnl.exe
2012-05-12 10:31:52 ----A---- C:\windows\system32\drivers\partmgr.sys
2012-05-12 10:31:51 ----A---- C:\windows\system32\DWrite.dll
2012-04-25 16:41:56 ----D---- C:\ProgramData\Mozilla

======List of files/folders modified in the last 1 month======

2012-05-24 14:20:33 ----RD---- C:\Program Files
2012-05-24 14:20:09 ----A---- C:\windows\wincmd.ini
2012-05-24 10:35:13 ----D---- C:\windows\system32\config
2012-05-24 10:32:40 ----D---- C:\windows\System32
2012-05-24 10:32:40 ----D---- C:\windows\inf
2012-05-24 10:32:40 ----A---- C:\windows\system32\PerfStringBackup.INI
2012-05-23 23:17:06 ----AD---- C:\windows\system32\drivers
2012-05-23 23:17:05 ----D---- C:\Windows
2012-05-23 23:13:22 ----A---- C:\windows\system.ini
2012-05-23 23:13:10 ----D---- C:\windows\system32\drivers\etc
2012-05-23 23:07:51 ----D---- C:\windows\AppPatch
2012-05-23 23:07:49 ----D---- C:\Program Files\Common Files
2012-05-23 22:45:13 ----A---- C:\windows\wcx_ftp.ini
2012-05-23 20:28:49 ----SHD---- C:\System Volume Information
2012-05-22 22:14:14 ----D---- C:\Users\Jiřík\AppData\Roaming\Skype
2012-05-22 20:47:14 ----SHD---- C:\windows\Installer
2012-05-22 20:09:57 ----D---- C:\windows\winsxs
2012-05-22 19:59:49 ----D---- C:\Program Files\ASUS
2012-05-22 19:58:24 ----RSD---- C:\windows\assembly
2012-05-19 19:47:08 ----D---- C:\windows\Prefetch
2012-05-19 18:48:53 ----D---- C:\ProgramData
2012-05-19 17:48:21 ----D---- C:\windows\system32\Tasks
2012-05-18 08:54:30 ----RD---- C:\Program Files\Skype
2012-05-18 08:54:17 ----D---- C:\ProgramData\Skype
2012-05-15 21:08:16 ----A---- C:\windows\system32\deployJava1.dll
2012-05-15 12:53:30 ----D---- C:\windows\Microsoft.NET
2012-05-15 11:07:21 ----D---- C:\Program Files\Microsoft Silverlight
2012-05-15 01:13:32 ----D---- C:\Program Files\Windows Journal
2012-05-14 11:58:34 ----A---- C:\windows\system32\MRT.exe
2012-05-14 11:45:00 ----D---- C:\windows\system32\catroot
2012-05-14 11:44:59 ----D---- C:\windows\system32\catroot2
2012-05-05 18:34:24 ----A---- C:\windows\system32\FlashPlayerApp.exe
2012-05-01 12:18:03 ----D---- C:\Program Files\Microsoft Security Client
2012-04-25 16:41:53 ----D---- C:\Program Files\Mozilla Firefox 3

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AiDriver;ASUS Charger Driver; C:\windows\system32\DRIVERS\AiDriver.sys [2010-05-20 13224]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2009-06-05 330264]
R0 MpFilter;Microsoft Malware Protection Driver; C:\windows\system32\DRIVERS\MpFilter.sys [2012-03-20 171064]
R0 nvpciflt;nvpciflt; C:\windows\system32\DRIVERS\nvpciflt.sys [2010-08-04 19656]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsUpIO;AsUpIO; C:\windows\system32\drivers\AsUpIO.sys [2010-03-31 11520]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\windows\system32\DRIVERS\bcmwl6.sys [2010-05-08 2710592]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\windows\system32\FsUsbExDisk.SYS [2011-01-20 36640]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2010-05-10 4806144]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2010-08-24 3178472]
R3 kbfiltr;Keyboard Filter; C:\windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 13880]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\windows\system32\DRIVERS\L1C62x86.sys [2010-07-29 68208]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 59904]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 139648]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2009-11-19 230448]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athr.sys [2009-07-14 1096704]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2011-04-28 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 btwampfl;Bluetooth AMP USB Filter; C:\windows\system32\drivers\btwampfl.sys [2010-05-21 293928]
S3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys [2010-05-21 88104]
S3 btwavdt;Bluetooth AVDT; C:\windows\system32\drivers\btwavdt.sys [2010-05-21 111144]
S3 btwl2cap;Bluetooth L2CAP Service; C:\windows\system32\DRIVERS\btwl2cap.sys [2010-05-21 33320]
S3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys [2010-05-21 18728]
S3 catchme;catchme; \??\C:\Users\JIK~1\AppData\Local\Temp\catchme.sys []
S3 dgderdrv;dgderdrv; C:\windows\System32\drivers\dgderdrv.sys []
S3 NisDrv;Microsoft Network Inspection System; C:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\windows\system32\drivers\nvhda32v.sys [2010-08-04 105576]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 sisagp;Filtr SIS sběrnice AGP; C:\windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM); C:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter; C:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers; C:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
S3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM); C:\windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;Filtr VIA sběrnice AGP; C:\windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AsusService;Asus Launcher Service; C:\Windows\System32\AsusService.exe [2009-08-19 219136]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2010-05-21 652576]
R2 FsUsbExService;FsUsbExService; C:\windows\system32\FsUsbExService.Exe [2011-01-20 217088]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-06-05 354840]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-03-26 11552]
R2 nvsvc;NVIDIA Display Driver Service; C:\windows\system32\nvvsvc.exe [2010-07-30 129640]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-09-22 249136]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 1713536]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-02-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
S3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2011-01-07 1343400]

-----------------EOF-----------------
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#3 Příspěvek od vyosek »

Zdravim :)

:arrow: Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
  • Ukoncete vsechny programy
  • Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
  • Pockejte na dokonceni PreScanu
  • Zvolte moznost Prohledat (scan)
  • Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#4 Příspěvek od sylar »

Udělal jsem vše dle návodu, ale po kliknutí na "zpráva" mi vyskočí hláška "systém nemůže najít uvedenou cestu" a za tím se otevře prázdný poznámkový blok.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#5 Příspěvek od vyosek »

:arrow: Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222
  • Provedte aktualizaci
  • Provedte uplny sken - nic nemazte :!:
  • MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#6 Příspěvek od sylar »

už se scanuje, jakmile to bude hodím to sem. V meziřečí se chci zeptat, k čemu je scannování počítače všemi doporučenými a jim podobnými programy? Všechny "čistí" počítač a každý z nich odhaluje jiný typ virů nebo se nějak vzájemně doplňují a jeden program vychází z logu jiného? Ptám se čistě ze zvědavosti, protože jsem už zde několik virů řešil a postup byl vždy jiný, jinak dlouhý tak bych se v tom chtěl trošku zorientovat :oops:
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#7 Příspěvek od vyosek »

Postup zalezi na nekolika faktorech
  • Kazdy skener ukaze krapet neco jineho, nektery je dukladnejsi. Nektere skenery jsou uzce specializovane atd
  • Pokud presne vim co je tam za havet, nasadim presny typ utility, o kterem vim ze havet maze
  • Pokud nevim co presne tam je, pouziju obecny skener a z nej pote havet naleznu a smazu
  • Pokud se havet dane utilite brani, musi se pouzit dalsi
  • Defakto vse je jen o zkusenostech, praxi, pozornem oku, googlu a znalostech utilit
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#8 Příspěvek od sylar »

Rozumím, děkuji za vysvětlení.

Skončil sken a vylezlo z toho toto:

Malwarebytes Anti-Malware 1.61.0.1400
http://www.malwarebytes.org

Verze databáze: v2012.05.24.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Jiřík :: JIRIK-PC [administrátor]

24.5.2012 16:31:56
mbam-log-2012-05-24 (18-09-32).txt

Typ: Úplná kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 331084
Uplynulý čas: 1 hodin, 37 minut, 7 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Qoobox\Quarantine\C\Users\Jiřík\AppData\Local\vxpkfbxeen.exe.vir (Trojan.LameShield) -> Žádná instrukce nebyla provedena.

(konec)

Ten soubor vxpkfbxeen.exe.vir mi hlásil už i CF a samotný MS Sec. Essent.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#9 Příspěvek od vyosek »

:arrow: MBAM ten vir nasel v karantene ComboFixu, tam je zcela neskody

:arrow: Stahnete SytemLook http://jpshortstuff.247fixes.com/SystemLook.exe a ulozte jej na plochu
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    :dir
C:\ProgramData\B7E858980001A19F000B270DB4EB23C1 /sub
c:\users\Jiřík\AppData\Local\{5EF9DD02-BDDC-4DAA-921E-897D44BC6FC0} /sub
c:\users\Jiřík\AppData\Local\{4B2028B7-4C6C-42B3-86AE-682D65CA75F9} /sub
c:\users\Jiřík\AppData\Local\{7D2D239C-9194-4A1C-A7FC-2AE1F7B40CAE} /sub
  • Kliknete na Look
  • Tlacitko Look se zmeni na Scanning a zsedne
  • Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
  • Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#10 Příspěvek od sylar »

Omlouvám se, ale protože jsem potřeboval vypnout PC a poslední scan trval poměrně dlouho a byl jsem si jistý, že se jedná o infikovaný soubor dal jsem smazat, projel posledním programem PC znova a ten již nic nenašel. Vím, že jsem měl počkat na vaši radu. Mohu provést scan z nějakého obecného scanneru pro zjištění, že je vše OK nebo jsem udělal blbost s tím výmazem?
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#11 Příspěvek od vyosek »

:arrow: vymaz byl defakto zbytecny - soubor se jen prestehoval z karanteny CF do karanteny MBAMu :D

:arrow: udelejte tedka ten SystemLook
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#12 Příspěvek od sylar »

Rozumím, tak hlavně, že to není průšvih.

Po vložení kódu do okna a kliknutí na "look" mi to ihne vyhodí tento log, žádný scan se neprovede.

SystemLook 30.07.11 by jpshortstuff
Log created at 21:57 on 24/05/2012 by Jiřík
Administrator - Elevation successful

========== dir ==========

C:\ProgramData\B7E858980001A19F000B270DB4EB23C1 - Parameters: "/sub"

---Files---
B7E858980001A19F000B270DB4EB23C1 --a---- 328 bytes [15:33 19/05/2012] [15:45 19/05/2012]

No folders found.

c:\users\Jiřík\AppData\Local\{5EF9DD02-BDDC-4DAA-921E-897D44BC6FC0} - Parameters: "/sub"

---Files---
None found.

No folders found.

c:\users\Jiřík\AppData\Local\{4B2028B7-4C6C-42B3-86AE-682D65CA75F9} - Parameters: "/sub"

---Files---
None found.

No folders found.

c:\users\Jiřík\AppData\Local\{7D2D239C-9194-4A1C-A7FC-2AE1F7B40CAE} - Parameters: "/sub"

---Files---
None found.

No folders found.

-= EOF =-
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#13 Příspěvek od vyosek »

:arrow: Pokud nemate, tak presunte Combofix primo na disk c:\
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"SunJavaUpdateSched"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Driver::
gupdate
gupdatem

File::
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

DirLook::
C:\ProgramData\B7E858980001A19F000B270DB4EB23C1

ClearJavaCache::

AtJob::

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt tez primo na disk c:\
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sylar

Re: Problém s Security Shield

#14 Příspěvek od sylar »

PRovedeno, zde je log z CF

ComboFix 12-05-23.05 - Jiřík 24.05.2012 22:37:29.4.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2806.1657 [GMT 2:00]
Spuštěný z: c:\users\Ji°Ýk\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Ji°Ýk\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-24 do 2012-05-24 )))))))))))))))))))))))))))))))
.
.
2012-05-24 20:48 . 2012-05-24 20:48 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-24 20:48 . 2012-05-24 20:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-24 19:05 . 2012-05-24 19:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{94AC2557-C575-446A-AB32-007A56EEDBE1}
2012-05-24 19:05 . 2012-05-24 19:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{11E9F390-4480-4B58-BF39-D5D8977AB21E}
2012-05-24 14:28 . 2012-05-24 14:28 -------- d-----w- c:\users\Jiřík\AppData\Roaming\Malwarebytes
2012-05-24 14:27 . 2012-05-24 14:27 -------- d-----w- c:\programdata\Malwarebytes
2012-05-24 14:13 . 2012-05-24 14:13 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFB445E2-0B82-4F44-9FB7-E74D056F8888}\MpKsl8dd9a00a.sys
2012-05-24 12:20 . 2012-05-24 12:21 -------- d-----w- c:\program files\trend micro
2012-05-24 12:20 . 2012-05-24 12:20 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFB445E2-0B82-4F44-9FB7-E74D056F8888}\offreg.dll
2012-05-24 07:11 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFB445E2-0B82-4F44-9FB7-E74D056F8888}\mpengine.dll
2012-05-24 07:05 . 2012-05-24 07:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{9FF5709B-6345-449C-B9FC-367453389C56}
2012-05-24 07:04 . 2012-05-24 07:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{29DEFA1A-9652-45E8-8018-93722F6A6B52}
2012-05-23 21:17 . 2012-05-24 20:48 -------- d-----w- c:\users\Jiřík\AppData\Local\temp
2012-05-23 08:24 . 2012-05-23 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{9B134862-76A4-4E8D-9930-5702AF917067}
2012-05-23 08:24 . 2012-05-23 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{9F126254-5094-4DA0-84D4-4887D9CC0A76}
2012-05-22 21:25 . 2012-05-22 21:29 -------- d-----w- c:\users\Jiřík\AppData\Roaming\PSpad
2012-05-22 21:25 . 2012-05-23 22:27 -------- d-----w- c:\program files\PSPad editor
2012-05-22 20:03 . 2012-05-22 20:03 -------- d-----w- c:\program files\ProFact 3.0 Free
2012-05-22 18:57 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-22 18:47 . 2012-05-22 18:47 -------- d-----w- c:\program files\Common Files\Skype
2012-05-22 09:17 . 2012-05-22 09:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{15A0DAE2-90AA-4152-ADC7-5FDEE47F04C8}
2012-05-22 09:17 . 2012-05-22 09:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{79ABEC86-DD88-4FF4-9D8A-67FF97405047}
2012-05-21 10:07 . 2012-05-21 10:07 -------- d-----w- c:\users\Jiřík\AppData\Local\{C85F4E91-6DDF-4875-934C-29E5F829463C}
2012-05-21 10:07 . 2012-05-21 10:07 -------- d-----w- c:\users\Jiřík\AppData\Local\{8B3A4927-FF3E-43F4-95A8-E51836DA3EB5}
2012-05-20 09:57 . 2012-05-20 09:57 -------- d-----w- c:\users\Jiřík\AppData\Local\{DDA48ADA-14BC-4841-A9CE-4D2D2BC94FBD}
2012-05-20 09:56 . 2012-05-20 09:56 -------- d-----w- c:\users\Jiřík\AppData\Local\{EE018629-852E-4DF8-A25D-AF7925C73327}
2012-05-19 15:33 . 2012-05-23 17:24 -------- d-----w- c:\programdata\B7E858980001A19F000B270DB4EB23C1
2012-05-19 10:09 . 2012-05-19 10:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{7B53C057-4031-459F-8E30-F84E7017FECD}
2012-05-19 10:08 . 2012-05-19 10:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{E0BFB475-4316-4754-8CC0-6FEC21257753}
2012-05-18 22:08 . 2012-05-18 22:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{2576855F-C296-4F5C-9DD0-E11FDB294BE5}
2012-05-18 22:08 . 2012-05-18 22:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{58E713DB-D712-4DD2-A562-04A74BB0F63A}
2012-05-17 22:09 . 2012-05-17 22:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{98135271-BB76-48F6-9789-810DE1D55C93}
2012-05-17 22:09 . 2012-05-17 22:09 -------- d-----w- c:\users\Jiřík\AppData\Local\{4A4568D7-8D7F-4310-8096-7645869224EA}
2012-05-17 10:04 . 2012-05-17 10:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{FE2D3A08-ABCF-4037-BA21-102564E0162C}
2012-05-17 10:03 . 2012-05-17 10:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{DC42BAE9-BD64-47D9-916D-3505C5BA6B2A}
2012-05-16 13:37 . 2012-05-16 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{74EE064C-D0FF-41A5-9804-2E06ADDA487F}
2012-05-16 13:37 . 2012-05-16 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{6F24B6A8-D97A-4124-BA8A-1696046E70C9}
2012-05-15 21:43 . 2012-05-15 21:43 -------- d-----w- c:\users\Jiřík\AppData\Local\{219FF913-99A3-4432-BEA0-C78431FA03BB}
2012-05-15 21:42 . 2012-05-15 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{525C8520-848C-4830-881E-ED5F02851AA8}
2012-05-15 19:09 . 2012-05-15 19:09 -------- d-----w- c:\program files\Common Files\Java
2012-05-15 19:08 . 2012-05-15 19:08 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-15 19:08 . 2012-05-15 19:08 -------- d-----w- c:\program files\Java
2012-05-15 09:11 . 2012-05-15 09:11 -------- d-----w- c:\users\Jiřík\AppData\Local\{0523F76F-D607-4AA1-9BD7-2F355C68641D}
2012-05-15 09:11 . 2012-05-15 09:11 -------- d-----w- c:\users\Jiřík\AppData\Local\{01D81106-0FB9-4EC8-B011-D5539F681752}
2012-05-14 09:41 . 2012-05-14 09:41 -------- d-----w- c:\users\Jiřík\AppData\Local\{1A0CE416-15CF-40ED-B56B-96121F67E049}
2012-05-14 09:40 . 2012-05-14 09:41 -------- d-----w- c:\users\Jiřík\AppData\Local\{EC7F6CB5-6439-4CA5-A2D2-9D31760AC7AE}
2012-05-13 21:16 . 2012-05-13 21:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{484486A1-D6AD-49E2-AC55-B8F4A1EEB588}
2012-05-13 21:16 . 2012-05-13 21:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{BC2DE636-FA51-4A49-BF1F-EAEB2D25D033}
2012-05-13 08:54 . 2012-05-13 08:54 -------- d-----w- c:\users\Jiřík\AppData\Local\{053FBDE7-7EB6-4C0C-8B3A-B452B63C8BFF}
2012-05-13 08:54 . 2012-05-13 08:54 -------- d-----w- c:\users\Jiřík\AppData\Local\{31E03B51-F601-41C8-AD51-0D0D700E2548}
2012-05-12 12:52 . 2012-05-12 12:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{BD698C92-FC75-4D78-B95A-073A71EF5BCD}
2012-05-12 12:52 . 2012-05-12 12:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{4E196BF1-9E38-4E27-AF57-E8A170C31023}
2012-05-12 08:32 . 2012-03-30 10:23 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 08:32 . 2012-03-31 04:29 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 08:32 . 2012-03-31 04:30 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-12 08:32 . 2012-03-31 04:29 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-12 08:32 . 2012-03-31 04:29 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-12 08:31 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-12 08:31 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 08:31 . 2012-03-31 02:36 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-05-12 08:31 . 2012-03-17 07:27 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 08:31 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-05-12 00:51 . 2012-05-12 00:51 -------- d-----w- c:\users\Jiřík\AppData\Local\{65E12B16-99E6-4B2D-A36F-623A7D1AA85F}
2012-05-12 00:51 . 2012-05-12 00:51 -------- d-----w- c:\users\Jiřík\AppData\Local\{022791BF-8348-49AF-B1CD-DCBFBD0D539A}
2012-05-11 08:15 . 2012-05-11 08:16 -------- d-----w- c:\users\Jiřík\AppData\Local\{18BE2C29-9AF2-4465-B96B-203583D24863}
2012-05-11 08:15 . 2012-05-11 08:15 -------- d-----w- c:\users\Jiřík\AppData\Local\{7410E5E6-070C-48EC-A550-47751829D0F6}
2012-05-10 09:33 . 2012-05-10 09:33 -------- d-----w- c:\users\Jiřík\AppData\Local\{B759EC2D-F99F-45D4-B58F-D4CB26A94925}
2012-05-10 09:33 . 2012-05-10 09:33 -------- d-----w- c:\users\Jiřík\AppData\Local\{B1824038-8F58-4E6A-9F83-D2FFAAF5BE81}
2012-05-09 21:32 . 2012-05-09 21:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{E8D917C3-8319-4DE9-8521-D63EABD385B8}
2012-05-09 21:32 . 2012-05-09 21:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{0410FC84-4122-4E83-8677-A129DF3BBACF}
2012-05-09 09:32 . 2012-05-09 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{3627C6BF-EC15-4011-B50B-52AE500D59A5}
2012-05-09 09:31 . 2012-05-09 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{805FAD2C-FAE2-4CCB-BF9E-D971DA380097}
2012-05-08 21:31 . 2012-05-08 21:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{ADAFB1A4-C858-46FF-8C2C-D5D114807C22}
2012-05-08 21:31 . 2012-05-08 21:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{9DFBD8E5-4B6E-454C-922C-321D5448381E}
2012-05-08 09:30 . 2012-05-08 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{EBADFFFD-113C-4112-95ED-F252DB5E49B0}
2012-05-08 09:30 . 2012-05-08 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{C635A462-7072-45FA-9E8D-E05E803F50FB}
2012-05-07 21:30 . 2012-05-07 21:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{12A4B649-8286-4164-AEF3-470C8575020C}
2012-05-07 21:30 . 2012-05-07 21:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{6072EF52-2B36-4A9B-88B0-5B8A4D1C755F}
2012-05-07 09:29 . 2012-05-07 09:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{54039611-0B9C-466F-A889-C2A90C8EC490}
2012-05-07 09:29 . 2012-05-07 09:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{21BFCD9B-E847-43C5-92EF-1D376348CCB0}
2012-05-06 13:37 . 2012-05-06 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{498C584F-B327-48BC-A586-3AFC305FB094}
2012-05-06 13:37 . 2012-05-06 13:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{B3508A58-C5CE-41CE-92E0-9946AAA80354}
2012-05-05 22:52 . 2012-05-05 22:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{5EF9DD02-BDDC-4DAA-921E-897D44BC6FC0}
2012-05-05 22:52 . 2012-05-05 22:52 -------- d-----w- c:\users\Jiřík\AppData\Local\{4B2028B7-4C6C-42B3-86AE-682D65CA75F9}
2012-05-05 09:08 . 2012-05-05 09:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{7D2D239C-9194-4A1C-A7FC-2AE1F7B40CAE}
2012-05-05 09:08 . 2012-05-05 09:08 -------- d-----w- c:\users\Jiřík\AppData\Local\{DFDD4D05-7273-4C53-8B54-15C089D1D4F7}
2012-05-04 15:04 . 2012-05-04 15:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{46358F6E-5EA2-4742-9119-280D6EA6D4B1}
2012-05-04 15:04 . 2012-05-04 15:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{2B8A4F78-F4F1-4552-8C50-E1FF72C0B8BB}
2012-05-03 23:28 . 2012-05-03 23:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{E73704F5-19F8-4D1A-BE99-2FBB15B6E433}
2012-05-03 23:28 . 2012-05-03 23:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{3FE2DB16-E594-4D3E-BEDE-7F1EBE224F75}
2012-05-03 09:35 . 2012-05-03 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{74A01F40-6BEC-40C2-AF31-B4BE4FC777D4}
2012-05-03 09:35 . 2012-05-03 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{CE6085C5-D305-4087-B692-3901E9EE2B13}
2012-05-02 21:35 . 2012-05-02 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{0EFC50F6-8031-42FB-92DF-5C3BECE39F6F}
2012-05-02 21:34 . 2012-05-02 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{DFADE552-F56E-442F-BE00-C5FA4570E907}
2012-05-02 09:14 . 2012-05-02 09:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{AA572432-27FE-4055-8B97-08FC90A8F1B9}
2012-05-02 09:14 . 2012-05-02 09:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{437E9123-8E01-497A-B907-E8B045E894AE}
2012-05-01 10:13 . 2012-05-01 10:14 -------- d-----w- c:\users\Jiřík\AppData\Local\{ABF213C5-0363-491E-9C42-59A7329EEE67}
2012-05-01 10:13 . 2012-05-01 10:13 -------- d-----w- c:\users\Jiřík\AppData\Local\{1EAA96EA-9869-4DBD-8EE9-3BFD08277928}
2012-04-30 21:34 . 2012-04-30 21:34 -------- d-----w- c:\users\Jiřík\AppData\Local\{AC02D5F6-2E3A-4BA4-8915-86013F79AD58}
2012-04-30 21:34 . 2012-04-30 21:34 -------- d-----w- c:\users\Jiřík\AppData\Local\{16325F96-FEA8-4742-A591-AECE6A14B827}
2012-04-30 09:32 . 2012-04-30 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{7F6DE3BD-71B0-4781-8B4B-2B34FA61F21F}
2012-04-30 09:32 . 2012-04-30 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{5E62F060-677C-4307-BC12-43864966E337}
2012-04-29 09:31 . 2012-04-29 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{91739962-7C1C-41CB-87ED-9B9AFCF278CE}
2012-04-29 09:30 . 2012-04-29 09:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{F64C6ABB-50B7-4CAD-B2F0-39C11C92E327}
2012-04-28 10:28 . 2012-04-28 10:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{B852656C-A10E-4A46-828C-56FFCB9AD6F9}
2012-04-28 10:28 . 2012-04-28 10:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{0E275C7E-14BF-4CA4-BB8F-5E3A26E4EB59}
2012-04-27 22:28 . 2012-04-27 22:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{DCF98277-45B8-4687-99D7-BB8F09843DA1}
2012-04-27 22:27 . 2012-04-27 22:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{6DBAA99A-4B5B-44B2-A164-81F03DDA811D}
2012-04-26 21:20 . 2012-04-26 21:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{D1F1A2C7-1290-4EE2-AE60-4A2E08D6306A}
2012-04-26 21:20 . 2012-04-26 21:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{C98A0689-4DFF-4AD5-84C5-71276F9E0517}
2012-04-26 09:19 . 2012-04-26 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{1C94AFB7-5627-4379-8226-0DA1B181268E}
2012-04-26 09:19 . 2012-04-26 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{8B8A32E3-1A9C-4609-8ADD-BC483C0E7408}
2012-04-25 19:36 . 2012-04-25 19:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{199DDBA9-CD6A-48EB-AF74-BED60A5C9085}
2012-04-25 19:36 . 2012-04-25 19:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{D0E5AE61-6216-448C-9210-DFC431973A5A}
2012-04-25 07:36 . 2012-04-25 07:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{C102BB5F-F33F-4960-8BCB-8CEAD29C778C}
2012-04-25 07:36 . 2012-04-25 07:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{A6373AD9-044E-4A60-9D5B-65ADEFED1614}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-15 19:08 . 2011-12-07 12:53 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-05 16:34 . 2012-03-30 07:59 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 16:34 . 2011-07-03 15:27 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-20 18:44 . 2010-10-24 20:25 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-20 18:44 . 2010-10-24 20:25 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-08 16:37 . 2012-03-08 16:37 302448 ----a-w- c:\windows\WLXPGSS.SCR
2012-03-01 05:46 . 2012-04-12 10:23 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-12 10:23 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-12 10:23 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 10:23 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-12 10:31 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 10:31 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 10:31 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 10:31 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-19_16.53.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-26 21:10 . 2012-05-24 07:03 38068 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2012-05-24 08:26 42182 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-01-06 22:39 . 2012-05-24 08:26 12024 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1543903154-3669594855-119763372-1001_UserData.bin
- 2009-07-14 02:05 . 2012-05-17 22:51 99842 c:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2012-05-24 08:32 99842 c:\windows\System32\perfc009.dat
+ 2010-09-29 18:28 . 2012-05-23 14:18 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-29 18:28 . 2012-05-19 09:41 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-29 18:28 . 2012-05-19 09:41 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-09-29 18:28 . 2012-05-23 14:18 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:41 . 2012-05-23 14:18 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:41 . 2012-05-19 09:41 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:34 . 2012-05-16 08:40 87200 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2009-07-14 04:34 . 2012-05-22 20:08 87200 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2012-05-19 16:11 . 2012-05-19 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-05-24 08:24 . 2012-05-24 08:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-05-24 08:24 . 2012-05-24 08:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-05-19 16:11 . 2012-05-19 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-01-06 17:10 . 2012-05-24 12:14 310516 c:\windows\System32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:05 . 2012-05-17 22:51 583046 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2012-05-24 08:32 583046 c:\windows\System32\perfh009.dat
+ 2009-06-20 19:14 . 2012-05-24 08:32 599208 c:\windows\System32\perfh005.dat
- 2009-06-20 19:14 . 2012-05-17 22:51 599208 c:\windows\System32\perfh005.dat
+ 2009-06-20 19:14 . 2012-05-24 08:32 115368 c:\windows\System32\perfc005.dat
- 2009-06-20 19:14 . 2012-05-17 22:51 115368 c:\windows\System32\perfc005.dat
+ 2009-07-14 04:47 . 2012-05-24 07:57 293788 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 04:47 . 2012-05-19 16:11 293788 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-05-22 18:47 . 2012-05-22 18:47 371272 c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe
- 2012-05-18 06:54 . 2012-05-18 06:54 371272 c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe
- 2009-07-14 04:34 . 2012-05-15 09:11 6988362 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:34 . 2012-05-22 18:48 6988362 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-01-10 16:14 . 2012-05-24 07:57 13696184 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1543903154-3669594855-119763372-1001-8192.dat
+ 2011-07-04 09:50 . 2012-05-22 18:10 141682732 c:\windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-02-22 3508624]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-29 21416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-19 1594664]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-11-19 83240]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2010-09-29 3058304]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"HotkeyMon"="AsusSender.exe" [2010-03-03 29184]
"HotkeyService"="AsusSender.exe" [2010-03-03 29184]
"SuperHybridEngine"="AsusSender.exe" [2010-03-03 29184]
"CapsHook"="AsusSender.exe" [2010-03-03 29184]
"GraphicsSwitch"="AsusSender.exe" [2010-03-03 29184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-10 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-10 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-24 9722472]
"iSeriesCharge"="c:\program files\ASUS\USBChargeSetting\iSeriesCharge.exe" [2010-08-18 96176]
"ASUSPRP"="c:\program files\ASUS\APRP\APRP.EXE" [2010-09-29 2018032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-05-21 293928]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-05-21 33320]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-08-04 105576]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-07 1343400]
S0 AiDriver;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiDriver.sys [2010-05-20 13224]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-08-04 19656]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2010-03-31 11520]
S1 MpKsl8dd9a00a;MpKsl8dd9a00a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFB445E2-0B82-4F44-9FB7-E74D056F8888}\MpKsl8dd9a00a.sys [2012-05-24 29904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2011-01-20 217088]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2011-01-20 36640]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-07-29 68208]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 59904]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 139648]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - MPKSL8DD9A00A
*NewlyCreated* - TRUESIGHT
*Deregistered* - TrueSight
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 16:34]
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 17:23]
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-03 17:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
Celkový čas: 2012-05-24 22:52:51
ComboFix-quarantined-files.txt 2012-05-24 20:52
ComboFix2.txt 2012-05-19 16:57
.
Před spuštěním: Volných bajtů: 37 423 837 184
Po spuštění: Volných bajtů: 37 360 427 008
.
- - End Of File - - 98C373EE695467C07829B2C9DEB51D97
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s Security Shield

#15 Příspěvek od vyosek »

:arrow: Zas se CFku nelibi diakritika :roll:

:arrow: Presunte ComboFix primo na disk c:\ a tam i vytvorte CFScript, ktery bude obsahovat nize uvedene prikazy

Kód: Vybrat vše

KillAll::

Folder::
c:\users\Jiřík\AppData\Local\{11E9F390-4480-4B58-BF39-D5D8977AB21E}
c:\users\Jiřík\AppData\Local\{9FF5709B-6345-449C-B9FC-367453389C56}
c:\users\Jiřík\AppData\Local\{29DEFA1A-9652-45E8-8018-93722F6A6B52}
c:\users\Jiřík\AppData\Local\{9B134862-76A4-4E8D-9930-5702AF917067}
c:\users\Jiřík\AppData\Local\{9F126254-5094-4DA0-84D4-4887D9CC0A76}
c:\users\Jiřík\AppData\Local\{15A0DAE2-90AA-4152-ADC7-5FDEE47F04C8}
c:\users\Jiřík\AppData\Local\{79ABEC86-DD88-4FF4-9D8A-67FF97405047}
c:\users\Jiřík\AppData\Local\{C85F4E91-6DDF-4875-934C-29E5F829463C}
c:\users\Jiřík\AppData\Local\{8B3A4927-FF3E-43F4-95A8-E51836DA3EB5}
c:\users\Jiřík\AppData\Local\{DDA48ADA-14BC-4841-A9CE-4D2D2BC94FBD}
c:\users\Jiřík\AppData\Local\{EE018629-852E-4DF8-A25D-AF7925C73327}
c:\users\Jiřík\AppData\Local\{7B53C057-4031-459F-8E30-F84E7017FECD}
c:\users\Jiřík\AppData\Local\{E0BFB475-4316-4754-8CC0-6FEC21257753}
c:\users\Jiřík\AppData\Local\{2576855F-C296-4F5C-9DD0-E11FDB294BE5}
c:\users\Jiřík\AppData\Local\{58E713DB-D712-4DD2-A562-04A74BB0F63A}
c:\users\Jiřík\AppData\Local\{98135271-BB76-48F6-9789-810DE1D55C93}
c:\users\Jiřík\AppData\Local\{4A4568D7-8D7F-4310-8096-7645869224EA}
c:\users\Jiřík\AppData\Local\{FE2D3A08-ABCF-4037-BA21-102564E0162C}
c:\users\Jiřík\AppData\Local\{DC42BAE9-BD64-47D9-916D-3505C5BA6B2A}
c:\users\Jiřík\AppData\Local\{74EE064C-D0FF-41A5-9804-2E06ADDA487F}
c:\users\Jiřík\AppData\Local\{6F24B6A8-D97A-4124-BA8A-1696046E70C9}
c:\users\Jiřík\AppData\Local\{219FF913-99A3-4432-BEA0-C78431FA03BB}
c:\users\Jiřík\AppData\Local\{525C8520-848C-4830-881E-ED5F02851AA8}
c:\users\Jiřík\AppData\Local\{0523F76F-D607-4AA1-9BD7-2F355C68641D}
c:\users\Jiřík\AppData\Local\{01D81106-0FB9-4EC8-B011-D5539F681752}
c:\users\Jiřík\AppData\Local\{1A0CE416-15CF-40ED-B56B-96121F67E049}
c:\users\Jiřík\AppData\Local\{EC7F6CB5-6439-4CA5-A2D2-9D31760AC7AE}
c:\users\Jiřík\AppData\Local\{484486A1-D6AD-49E2-AC55-B8F4A1EEB588}
c:\users\Jiřík\AppData\Local\{BC2DE636-FA51-4A49-BF1F-EAEB2D25D033}
c:\users\Jiřík\AppData\Local\{053FBDE7-7EB6-4C0C-8B3A-B452B63C8BFF}
c:\users\Jiřík\AppData\Local\{31E03B51-F601-41C8-AD51-0D0D700E2548}
c:\users\Jiřík\AppData\Local\{BD698C92-FC75-4D78-B95A-073A71EF5BCD}
c:\users\Jiřík\AppData\Local\{4E196BF1-9E38-4E27-AF57-E8A170C31023}
c:\users\Jiřík\AppData\Local\{65E12B16-99E6-4B2D-A36F-623A7D1AA85F}
c:\users\Jiřík\AppData\Local\{022791BF-8348-49AF-B1CD-DCBFBD0D539A}
c:\users\Jiřík\AppData\Local\{18BE2C29-9AF2-4465-B96B-203583D24863}
c:\users\Jiřík\AppData\Local\{7410E5E6-070C-48EC-A550-47751829D0F6}
c:\users\Jiřík\AppData\Local\{B759EC2D-F99F-45D4-B58F-D4CB26A94925}
c:\users\Jiřík\AppData\Local\{B1824038-8F58-4E6A-9F83-D2FFAAF5BE81}
c:\users\Jiřík\AppData\Local\{E8D917C3-8319-4DE9-8521-D63EABD385B8}
c:\users\Jiřík\AppData\Local\{0410FC84-4122-4E83-8677-A129DF3BBACF}
c:\users\Jiřík\AppData\Local\{3627C6BF-EC15-4011-B50B-52AE500D59A5}
c:\users\Jiřík\AppData\Local\{805FAD2C-FAE2-4CCB-BF9E-D971DA380097}
c:\users\Jiřík\AppData\Local\{ADAFB1A4-C858-46FF-8C2C-D5D114807C22}
c:\users\Jiřík\AppData\Local\{9DFBD8E5-4B6E-454C-922C-321D5448381E}
c:\users\Jiřík\AppData\Local\{EBADFFFD-113C-4112-95ED-F252DB5E49B0}
c:\users\Jiřík\AppData\Local\{C635A462-7072-45FA-9E8D-E05E803F50FB}
c:\users\Jiřík\AppData\Local\{12A4B649-8286-4164-AEF3-470C8575020C}
c:\users\Jiřík\AppData\Local\{6072EF52-2B36-4A9B-88B0-5B8A4D1C755F}
c:\users\Jiřík\AppData\Local\{54039611-0B9C-466F-A889-C2A90C8EC490}
c:\users\Jiřík\AppData\Local\{21BFCD9B-E847-43C5-92EF-1D376348CCB0}
c:\users\Jiřík\AppData\Local\{498C584F-B327-48BC-A586-3AFC305FB094}
c:\users\Jiřík\AppData\Local\{B3508A58-C5CE-41CE-92E0-9946AAA80354}
c:\users\Jiřík\AppData\Local\{5EF9DD02-BDDC-4DAA-921E-897D44BC6FC0}
c:\users\Jiřík\AppData\Local\{4B2028B7-4C6C-42B3-86AE-682D65CA75F9}
c:\users\Jiřík\AppData\Local\{7D2D239C-9194-4A1C-A7FC-2AE1F7B40CAE}
c:\users\Jiřík\AppData\Local\{DFDD4D05-7273-4C53-8B54-15C089D1D4F7}
c:\users\Jiřík\AppData\Local\{46358F6E-5EA2-4742-9119-280D6EA6D4B1}
c:\users\Jiřík\AppData\Local\{2B8A4F78-F4F1-4552-8C50-E1FF72C0B8BB}
c:\users\Jiřík\AppData\Local\{E73704F5-19F8-4D1A-BE99-2FBB15B6E433}
c:\users\Jiřík\AppData\Local\{3FE2DB16-E594-4D3E-BEDE-7F1EBE224F75}
c:\users\Jiřík\AppData\Local\{74A01F40-6BEC-40C2-AF31-B4BE4FC777D4}
c:\users\Jiřík\AppData\Local\{CE6085C5-D305-4087-B692-3901E9EE2B13}
c:\users\Jiřík\AppData\Local\{0EFC50F6-8031-42FB-92DF-5C3BECE39F6F}
c:\users\Jiřík\AppData\Local\{DFADE552-F56E-442F-BE00-C5FA4570E907}
c:\users\Jiřík\AppData\Local\{AA572432-27FE-4055-8B97-08FC90A8F1B9}
c:\users\Jiřík\AppData\Local\{437E9123-8E01-497A-B907-E8B045E894AE}
c:\users\Jiřík\AppData\Local\{ABF213C5-0363-491E-9C42-59A7329EEE67}
c:\users\Jiřík\AppData\Local\{1EAA96EA-9869-4DBD-8EE9-3BFD08277928}
c:\users\Jiřík\AppData\Local\{AC02D5F6-2E3A-4BA4-8915-86013F79AD58}
c:\users\Jiřík\AppData\Local\{16325F96-FEA8-4742-A591-AECE6A14B827}
c:\users\Jiřík\AppData\Local\{7F6DE3BD-71B0-4781-8B4B-2B34FA61F21F}
c:\users\Jiřík\AppData\Local\{5E62F060-677C-4307-BC12-43864966E337}
c:\users\Jiřík\AppData\Local\{91739962-7C1C-41CB-87ED-9B9AFCF278CE}
c:\users\Jiřík\AppData\Local\{F64C6ABB-50B7-4CAD-B2F0-39C11C92E327}
c:\users\Jiřík\AppData\Local\{B852656C-A10E-4A46-828C-56FFCB9AD6F9}
c:\users\Jiřík\AppData\Local\{0E275C7E-14BF-4CA4-BB8F-5E3A26E4EB59}
c:\users\Jiřík\AppData\Local\{DCF98277-45B8-4687-99D7-BB8F09843DA1}
c:\users\Jiřík\AppData\Local\{6DBAA99A-4B5B-44B2-A164-81F03DDA811D}
c:\users\Jiřík\AppData\Local\{D1F1A2C7-1290-4EE2-AE60-4A2E08D6306A}
c:\users\Jiřík\AppData\Local\{C98A0689-4DFF-4AD5-84C5-71276F9E0517}
c:\users\Jiřík\AppData\Local\{1C94AFB7-5627-4379-8226-0DA1B181268E}
c:\users\Jiřík\AppData\Local\{8B8A32E3-1A9C-4609-8ADD-BC483C0E7408}
c:\users\Jiřík\AppData\Local\{199DDBA9-CD6A-48EB-AF74-BED60A5C9085}
c:\users\Jiřík\AppData\Local\{D0E5AE61-6216-448C-9210-DFC431973A5A}
c:\users\Jiřík\AppData\Local\{C102BB5F-F33F-4960-8BCB-8CEAD29C778C}
c:\users\Jiřík\AppData\Local\{A6373AD9-044E-4A60-9D5B-65ADEFED1614}
c:\users\Jiřík\AppData\Local\{94AC2557-C575-446A-AB32-007A56EEDBE1}

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"SunJavaUpdateSched"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Driver::
gupdate
gupdatem

File::
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

DirLook::
C:\ProgramData\B7E858980001A19F000B270DB4EB23C1

ClearJavaCache::

AtJob::

Reboot::
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“