Opakovaný problém se security shieldem

[sylar]

Zdravím,
už po několikáté za poslední měsíc se mi do pc dostal virus Security Shield. Mám v PC MS security essential, MBAM a Spyware terminator. Ani jeden z těchto jej nezachytil a už z toho začínám být trošku zoufalý, protože se mi nedaří jej preventivně zjistit, vždy mi vleze do PC, ze kterého jej dostanu, ale je to otravné.

Nemáte někdo otestovanou nějakou utilitku, která by tento druh viru dokázala zablokovat, aby se nedostal do PC?

Prohnal jsem pc combofixem, ten předtím dokázal SS vždy odstranit, jen bych chtěl poprosit o jeho kontrolu, příp. dočištění.

ComboFix 12-07-02.01 - Jiřík 03.07.2012 20:43:18.3.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2806.1743 [GMT 2:00]
Spuštěný z: e:\programy\AV & AS Tools\ComboFix\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jiřík\AppData\Local\gewdu.exe
c:\windows\host32.exe
c:\windows\system32\ntos.exe
c:\windows\system32\sdra64.exe
c:\windows\system32\twext.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-03 do 2012-07-03 )))))))))))))))))))))))))))))))
.
.
2012-07-03 18:57 . 2012-07-03 18:59 -------- d-----w- c:\users\Jiřík\AppData\Local\temp
2012-07-03 18:57 . 2012-07-03 18:57 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-07-03 18:57 . 2012-07-03 18:57 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-07-03 18:57 . 2012-07-03 18:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-03 18:43 . 2012-07-03 18:43 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\MpKsl84d204d1.sys
2012-07-03 18:42 . 2012-07-03 18:42 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\offreg.dll
2012-07-03 09:42 . 2012-07-03 09:43 -------- d-----w- c:\users\Jiřík\AppData\Local\{C6C60DAC-0636-4AC6-ADB4-E85168A88579}
2012-07-03 09:42 . 2012-07-03 09:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{1DA63F7A-A1CE-48CB-90E4-7BAF289A2149}
2012-07-02 21:42 . 2012-07-02 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{B93CE2B6-0019-4159-9DB6-BE775EFEFE80}
2012-07-02 21:42 . 2012-07-02 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{BAFBA110-50A1-472E-AEE1-655D945F47D2}
2012-07-02 09:43 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\mpengine.dll
2012-07-02 09:32 . 2012-07-02 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{84EA3ED7-B8C2-477B-BE1C-99AD718B58A6}
2012-07-02 09:32 . 2012-07-02 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{F17C4434-AF1F-4471-B040-93CBF10175B2}
2012-07-01 10:56 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-01 10:46 . 2012-07-01 10:46 -------- d-----w- c:\users\Jiřík\AppData\Local\{C9DC6D15-F7FE-4A23-84A3-CCB1FA937C0A}
2012-07-01 10:46 . 2012-07-01 10:46 -------- d-----w- c:\users\Jiřík\AppData\Local\{FAC9C04D-F26C-4BFF-A1AB-DB676D1B2C91}
2012-06-30 21:19 . 2012-06-30 21:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{5BD53E4F-5D81-41C7-8673-E6ABA8766743}
2012-06-30 21:19 . 2012-06-30 21:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{5CD6FE40-353F-4803-8ECA-C7848B1CD6AF}
2012-06-30 09:19 . 2012-06-30 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{807AB174-7A97-4929-8591-142209CA6033}
2012-06-30 09:18 . 2012-06-30 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{E7BE416B-4D55-4E6D-8A91-727014EF929D}
2012-06-29 21:18 . 2012-06-29 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{722AFB0D-3F0A-4F37-8686-D1983F2AB53E}
2012-06-29 21:18 . 2012-06-29 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{335C6285-3E8F-453E-A5FF-C9C92C3DF550}
2012-06-29 07:58 . 2012-06-29 07:58 -------- d-----w- c:\users\Jiřík\AppData\Local\{D8E88D10-A45E-483F-869B-65E2D001F9B2}
2012-06-29 07:58 . 2012-06-29 07:58 -------- d-----w- c:\users\Jiřík\AppData\Local\{F35EEFA7-0A34-4806-9CED-EBE70B6BB9F7}
2012-06-28 18:45 . 2012-06-28 18:45 -------- d-----w- c:\users\Jiřík\AppData\Local\{C57D98CC-9DE6-4797-BA6A-AA4C27A9D39E}
2012-06-28 18:45 . 2012-06-28 18:45 -------- d-----w- c:\users\Jiřík\AppData\Local\{F8B59CC4-AA38-465D-AD74-44036AF90A24}
2012-06-28 06:44 . 2012-06-28 06:44 -------- d-----w- c:\users\Jiřík\AppData\Local\{29708C8C-4730-4165-80D7-534B8FCF4CB5}
2012-06-28 06:44 . 2012-06-28 06:44 -------- d-----w- c:\users\Jiřík\AppData\Local\{8081EB31-27F0-4C7E-BCE3-C440D24A334E}
2012-06-27 08:24 . 2012-06-27 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{E96BDD85-5C7F-48C7-B157-71D8C52FAF16}
2012-06-27 08:24 . 2012-06-27 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{69ABCA19-61F0-4819-896A-7B24F7E04748}
2012-06-26 09:25 . 2012-06-26 09:25 -------- d-----w- c:\users\Jiřík\AppData\Local\{99B2FCD3-B7C8-48DE-8460-F5AD79279863}
2012-06-26 09:24 . 2012-06-26 09:25 -------- d-----w- c:\users\Jiřík\AppData\Local\{561CB933-FAB2-437F-9791-C65723AED7D8}
2012-06-25 21:24 . 2012-06-25 21:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{5068C74F-B24E-43BD-AA62-37262DBB98C8}
2012-06-25 21:24 . 2012-06-25 21:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{C6CCA311-BC5A-4638-B3C5-7409CBF8579F}
2012-06-25 09:20 . 2012-06-25 09:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{6BE7F911-6798-4ABF-BDED-7517E922F43C}
2012-06-25 09:20 . 2012-06-25 09:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{99940F11-F9EE-4ED6-988F-2C7F598223DF}
2012-06-24 11:32 . 2012-06-24 11:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{A7642129-BEBF-44B5-8AC9-7EF562E030FD}
2012-06-24 11:32 . 2012-06-24 11:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{58C8C2F2-5EC2-4D97-B6B9-CAB201CF989A}
2012-06-24 10:14 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-24 10:14 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-24 10:14 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-24 10:14 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-24 10:14 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-24 10:14 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-24 10:14 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-24 10:14 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-24 10:14 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-23 23:31 . 2012-06-23 23:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{C922A2A3-0324-4ACA-A931-0DA22630B4E7}
2012-06-23 23:31 . 2012-06-23 23:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{26A11720-5662-4A72-A43D-6BF9A597A043}
2012-06-23 10:10 . 2012-06-23 10:10 -------- d-----w- c:\users\Jiřík\AppData\Local\Macromedia
2012-06-23 09:05 . 2012-06-23 09:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{F7608C33-0898-42E2-BA5C-B42E21E1D3DC}
2012-06-23 09:05 . 2012-06-23 09:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{31170C2C-DECF-47C2-9354-D44EF4A62521}
2012-06-22 19:00 . 2012-06-22 19:01 -------- d-----w- c:\users\Jiřík\AppData\Local\{3564A15D-1AB1-40FE-AF2B-3561F241DB3C}
2012-06-22 19:00 . 2012-06-22 19:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{069B90D2-984D-4460-93C1-6D1F81332CBB}
2012-06-22 18:30 . 2012-06-22 18:30 -------- d-----w- C:\Temp
2012-06-22 17:10 . 2012-06-22 17:10 -------- d-----w- c:\users\Jiřík\AppData\Roaming\Philipp Winterberg
2012-06-22 16:35 . 2012-06-22 16:35 -------- d-----w- c:\windows\system32\System32
2012-06-22 16:21 . 2012-06-22 16:36 -------- d-----w- c:\users\Jiřík\AppData\Local\Samsung
2012-06-22 16:14 . 2011-06-07 09:13 4659712 ----a-w- c:\windows\system32\Redemption.dll
2012-06-22 16:14 . 2011-06-07 09:13 821824 ----a-w- c:\windows\system32\dgderapi.dll
2012-06-22 16:03 . 2011-06-28 05:32 81122288 ----a-w- c:\users\Jiřík\AppData\Roaming\Microsoft\Windows\Templates\SamsungKiesSetup.exe
2012-06-22 15:57 . 2010-12-21 05:55 12288 ----a-w- c:\windows\system32\drivers\sscewhnt.sys
2012-06-22 15:57 . 2010-12-21 05:55 12288 ----a-w- c:\windows\system32\drivers\sscewh.sys
2012-06-22 15:57 . 2010-12-21 05:55 14848 ----a-w- c:\windows\system32\drivers\sscemdfl.sys
2012-06-22 15:48 . 2012-06-22 15:52 -------- d-----w- c:\program files\Common Files\Samsung
2012-06-22 07:00 . 2012-06-22 07:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{3D41961F-5E7B-4E12-BFD1-78B2E04142F6}
2012-06-22 07:00 . 2012-06-22 07:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{6BAACDEE-01D0-4A79-A301-7A942BB14988}
2012-06-21 08:28 . 2012-06-21 08:29 -------- d-----w- c:\program files\Google
2012-06-21 08:22 . 2012-06-21 08:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{E305411E-78CC-49A3-89DD-ED088CBAF8C6}
2012-06-21 08:22 . 2012-06-21 08:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{B6617227-2F8D-4C7A-AE86-7B2DA8BB5C01}
2012-06-20 15:27 . 2012-06-20 15:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{228B48E2-1862-4ED8-AA87-7AEC5F155564}
2012-06-20 15:27 . 2012-06-20 15:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{DB8E7832-0D64-4E56-9B49-3FD1C887C6E0}
2012-06-19 21:35 . 2012-06-19 21:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{5A8BA3D9-15DA-49CB-9356-6975F1EC236D}
2012-06-19 21:35 . 2012-06-19 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{6A832182-8DEA-4644-AE4D-358FF691B0DA}
2012-06-19 09:04 . 2012-06-19 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{15D71C09-423D-4EC2-8D8C-BC4854E20DD4}
2012-06-19 09:04 . 2012-06-19 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{9DF65E0F-834D-4503-B6F3-5F54718A632D}
2012-06-18 20:37 . 2012-06-18 20:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{D5F814CA-B626-43BD-9A5A-34C8C2813D14}
2012-06-18 08:37 . 2012-06-18 08:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{53E5FA49-6A8E-4607-AFDC-2355D9831485}
2012-06-17 20:29 . 2012-06-17 20:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{6A232E38-B46D-439E-9E5E-06965D760AC0}
2012-06-17 08:28 . 2012-06-17 08:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{4D60B972-ACC0-4311-8952-1A3A6F4DE1D8}
2012-06-16 09:13 . 2012-06-16 09:13 -------- d-----w- c:\users\Jiřík\AppData\Local\{81CCF0BD-6148-4BD8-B169-0D2B7EC04B17}
2012-06-15 19:24 . 2012-06-15 19:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{BC1D7244-A0F2-4300-8954-6EC2C34FEA1C}
2012-06-15 07:17 . 2012-06-15 07:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{BE38DEB7-4A01-48FD-B84B-32973D845FB3}
2012-06-14 08:57 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-14 08:57 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-14 08:56 . 2012-05-15 01:05 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-06-14 08:56 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-14 08:56 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-14 08:56 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-14 08:56 . 2012-05-01 04:44 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-06-14 08:56 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-06-14 08:56 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-14 08:56 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-14 08:49 . 2012-06-14 08:50 -------- d-----w- c:\users\Jiřík\AppData\Local\{2BA424A7-3010-4DBD-AB12-CBDB75E213F1}
2012-06-14 08:49 . 2012-06-14 08:49 -------- d-----w- c:\users\Jiřík\AppData\Local\{B308F4F8-928F-41D7-9056-6212DD00324B}
2012-06-13 14:32 . 2012-05-26 19:03 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60C0E2A0-3EE2-43C2-89C2-75C9D322C383}\gapaengine.dll
2012-06-13 11:48 . 2012-06-13 11:48 -------- d-----w- c:\users\Jiřík\AppData\Local\{18C326F9-CED6-468E-9946-C2B2BD23F83A}
2012-06-12 20:28 . 2012-06-12 20:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{A03EDB52-CD06-4D68-AC82-9D322BD9C73A}
2012-06-12 20:28 . 2012-06-12 20:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{B3BB11BD-C714-4E49-BEE0-6C2A214E6FFB}
2012-06-12 08:27 . 2012-06-12 08:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{C30FEDCA-1E51-416A-986B-2AB2D4B28B89}
2012-06-12 08:27 . 2012-06-12 08:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{00BB6A58-0430-40EE-9C62-A41CF2B67F32}
2012-06-11 09:36 . 2012-06-11 09:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{18D20A9C-0563-4D2A-B253-50321BEF982B}
2012-06-11 09:36 . 2012-06-11 09:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{E43B0CD0-CCC9-4187-BD6F-965AC8803C60}
2012-06-10 21:35 . 2012-06-10 21:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{BFA7DA85-5888-4649-B905-ACE34193C98F}
2012-06-10 21:35 . 2012-06-10 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{159DC43B-0080-4C5A-A14C-1569A4E95BAE}
2012-06-10 09:35 . 2012-06-10 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{5F814161-AA8B-4399-89C1-12088C31EE02}
2012-06-10 09:35 . 2012-06-10 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{07A887D9-4A72-4C34-AF5C-0666D6A0B2EB}
2012-06-09 09:30 . 2012-06-09 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{202A39D6-29AC-4BD5-9A3B-AE622206863C}
2012-06-09 09:29 . 2012-06-09 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{07B79871-4F9F-46AC-8B90-6EE66D0557DD}
2012-06-08 09:18 . 2012-06-08 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{9151E13A-B6E2-4AD3-B549-FBEF8498CAD6}
2012-06-08 09:18 . 2012-06-08 09:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{B903F68A-BC8F-499E-AF88-C854CA2F3F4E}
2012-06-07 21:18 . 2012-06-07 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{83C43C16-4F12-491A-8A2E-AD3186890BDE}
2012-06-07 21:18 . 2012-06-07 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{54B199B0-5D3A-445B-B8CF-56644D97BD88}
2012-06-07 09:04 . 2012-06-07 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{EF0CF2CC-BD90-4188-8023-2BFE668C5DC1}
2012-06-07 09:04 . 2012-06-07 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{CBE74C41-CEB3-40D7-AC87-C544A3D75B57}
2012-06-06 18:09 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-06-06 18:09 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-06-06 12:27 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2012-06-06 12:27 . 2012-07-03 09:01 -------- d-----w- c:\programdata\Spyware Terminator
2012-06-06 12:27 . 2012-06-06 12:27 -------- d-----w- c:\users\Jiřík\AppData\Roaming\Spyware Terminator
2012-06-06 12:25 . 2012-06-23 09:05 -------- d-----w- c:\program files\Spyware Terminator
2012-06-06 09:30 . 2012-06-06 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{D72618F2-21A2-4763-8ED9-B17650CB43DA}
2012-06-06 09:29 . 2012-06-06 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{1430EB17-AB18-4579-BEBC-B04A369F7751}
2012-06-06 09:16 . 2012-06-06 09:16 -------- d-----w- c:\program files\trend micro
2012-06-05 21:18 . 2012-06-05 21:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{FE870475-B483-470D-AAD9-FBB9B04937BA}
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 09:47 . 2012-05-26 19:23 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 09:47 . 2012-05-26 19:23 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-29 07:38 . 2011-06-07 09:13 330240 ----a-w- c:\windows\MASetupCaller.dll
2012-05-28 20:32 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-05-27 10:05 . 2012-05-27 10:05 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-05-26 19:29 . 2012-05-26 19:29 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-05-26 19:29 . 2012-05-26 19:29 161792 ----a-w- c:\windows\system32\msls31.dll
2012-05-26 19:29 . 2012-05-26 19:29 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-05-26 19:29 . 2012-05-26 19:29 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-05-26 19:29 . 2012-05-26 19:29 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-05-26 19:29 . 2012-05-26 19:29 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-05-26 19:29 . 2012-05-26 19:29 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-05-26 19:29 . 2012-05-26 19:29 367104 ----a-w- c:\windows\system32\html.iec
2012-05-26 19:29 . 2012-05-26 19:29 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-05-26 19:29 . 2012-05-26 19:29 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-26 19:29 . 2012-05-26 19:29 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-05-26 19:29 . 2012-05-26 19:29 152064 ----a-w- c:\windows\system32\wextract.exe
2012-05-26 19:29 . 2012-05-26 19:29 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-05-26 19:29 . 2012-05-26 19:29 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-05-26 19:29 . 2012-05-26 19:29 11776 ----a-w- c:\windows\system32\mshta.exe
2012-05-26 19:29 . 2012-05-26 19:29 101888 ----a-w- c:\windows\system32\admparse.dll
2012-05-26 19:03 . 2012-05-26 19:04 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-06-08 3521464]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-06-08 21432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-19 1594664]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-11-19 83240]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2010-09-29 3058304]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-10 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-10 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-24 9722472]
"iSeriesCharge"="c:\program files\ASUS\USBChargeSetting\iSeriesCharge.exe" [2010-08-18 96176]
"ASUSPRP"="c:\program files\ASUS\APRP\APRP.EXE" [2010-09-29 2018032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2012-03-27 2786480]
"SpywareTerminatorUpdater"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2012-03-27 3669680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [x]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [x]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [x]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AiDriver;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiDriver.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [x]
S1 MpKsl84d204d1;MpKsl84d204d1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\MpKsl84d204d1.sys [x]
S1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\Spyware Terminator\st_rsser.exe [x]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL84D204D1
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 09:47]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-21 08:28]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-21 08:28]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60747&qkw=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\program files\Samsung\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-07-03 21:04:33
ComboFix-quarantined-files.txt 2012-07-03 19:04
ComboFix2.txt 2012-05-31 13:31
.
Před spuštěním: Volných bajtů: 37 645 828 096
Po spuštění: Volných bajtů: 37 836 845 056
.
- - End Of File - - BE3626DFC2A1C5E19B6E6B7C271DE183

[Rudy]

Také zdravím!
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Firefox::
FF - ProfilePath - c:\users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatche ... 60747&qkw=

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Uložte do adresáře e:\programy\AV & AS Tools\ComboFix jako CFScript.txt. Pak jej myší v průzkumníku windows (nebo jiném souborovém manažéru) přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[sylar]

Děkuji, provedl jsem. Zasílám nový log z CF.
Jak jsem psal, vypadá to, že CF dokáže security shield vždy odstranit, problém je, že za pár dnů je zpátky a celé je to stále dokola. Nemohl byste mi poradit nějakou prevenci, program, utilitku, která by dokázala SS zabránit vstup do PC? Sám ani nevím odkud se mi do PC dostává, žádné neznámé stránky ze zákoutí internetu nenavštěvuji, alespoŇ ne vědomě, v poslední době jsem ani nepoužíval žádná výměnná média, je mi to opravdu záhadou.

ComboFix 12-07-02.01 - Jiřík 03.07.2012 22:05:12.4.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2806.1504 [GMT 2:00]
Spuštěný z: e:\programy\AV & AS Tools\ComboFix\ComboFix.exe
Použité ovládací přepínače :: e:\programy\AV & AS Tools\ComboFix\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-03 do 2012-07-03 )))))))))))))))))))))))))))))))
.
.
2012-07-03 20:19 . 2012-07-03 20:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-07-03 20:19 . 2012-07-03 20:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-07-03 20:19 . 2012-07-03 20:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-03 19:16 . 2012-07-03 19:16 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-07-03 19:04 . 2012-07-03 20:22 -------- d-----w- c:\users\Jiřík\AppData\Local\temp
2012-07-03 18:43 . 2012-07-03 18:43 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\MpKsl84d204d1.sys
2012-07-03 18:42 . 2012-07-03 18:42 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\offreg.dll
2012-07-03 09:42 . 2012-07-03 09:43 -------- d-----w- c:\users\Jiřík\AppData\Local\{C6C60DAC-0636-4AC6-ADB4-E85168A88579}
2012-07-03 09:42 . 2012-07-03 09:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{1DA63F7A-A1CE-48CB-90E4-7BAF289A2149}
2012-07-02 21:42 . 2012-07-02 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{B93CE2B6-0019-4159-9DB6-BE775EFEFE80}
2012-07-02 21:42 . 2012-07-02 21:42 -------- d-----w- c:\users\Jiřík\AppData\Local\{BAFBA110-50A1-472E-AEE1-655D945F47D2}
2012-07-02 09:43 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\mpengine.dll
2012-07-02 09:32 . 2012-07-02 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{84EA3ED7-B8C2-477B-BE1C-99AD718B58A6}
2012-07-02 09:32 . 2012-07-02 09:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{F17C4434-AF1F-4471-B040-93CBF10175B2}
2012-07-01 10:56 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-01 10:46 . 2012-07-01 10:46 -------- d-----w- c:\users\Jiřík\AppData\Local\{C9DC6D15-F7FE-4A23-84A3-CCB1FA937C0A}
2012-07-01 10:46 . 2012-07-01 10:46 -------- d-----w- c:\users\Jiřík\AppData\Local\{FAC9C04D-F26C-4BFF-A1AB-DB676D1B2C91}
2012-06-30 21:19 . 2012-06-30 21:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{5BD53E4F-5D81-41C7-8673-E6ABA8766743}
2012-06-30 21:19 . 2012-06-30 21:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{5CD6FE40-353F-4803-8ECA-C7848B1CD6AF}
2012-06-30 09:19 . 2012-06-30 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{807AB174-7A97-4929-8591-142209CA6033}
2012-06-30 09:18 . 2012-06-30 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{E7BE416B-4D55-4E6D-8A91-727014EF929D}
2012-06-29 21:18 . 2012-06-29 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{722AFB0D-3F0A-4F37-8686-D1983F2AB53E}
2012-06-29 21:18 . 2012-06-29 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{335C6285-3E8F-453E-A5FF-C9C92C3DF550}
2012-06-29 07:58 . 2012-06-29 07:58 -------- d-----w- c:\users\Jiřík\AppData\Local\{D8E88D10-A45E-483F-869B-65E2D001F9B2}
2012-06-29 07:58 . 2012-06-29 07:58 -------- d-----w- c:\users\Jiřík\AppData\Local\{F35EEFA7-0A34-4806-9CED-EBE70B6BB9F7}
2012-06-28 18:45 . 2012-06-28 18:45 -------- d-----w- c:\users\Jiřík\AppData\Local\{C57D98CC-9DE6-4797-BA6A-AA4C27A9D39E}
2012-06-28 18:45 . 2012-06-28 18:45 -------- d-----w- c:\users\Jiřík\AppData\Local\{F8B59CC4-AA38-465D-AD74-44036AF90A24}
2012-06-28 06:44 . 2012-06-28 06:44 -------- d-----w- c:\users\Jiřík\AppData\Local\{29708C8C-4730-4165-80D7-534B8FCF4CB5}
2012-06-28 06:44 . 2012-06-28 06:44 -------- d-----w- c:\users\Jiřík\AppData\Local\{8081EB31-27F0-4C7E-BCE3-C440D24A334E}
2012-06-27 08:24 . 2012-06-27 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{E96BDD85-5C7F-48C7-B157-71D8C52FAF16}
2012-06-27 08:24 . 2012-06-27 08:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{69ABCA19-61F0-4819-896A-7B24F7E04748}
2012-06-26 09:25 . 2012-06-26 09:25 -------- d-----w- c:\users\Jiřík\AppData\Local\{99B2FCD3-B7C8-48DE-8460-F5AD79279863}
2012-06-26 09:24 . 2012-06-26 09:25 -------- d-----w- c:\users\Jiřík\AppData\Local\{561CB933-FAB2-437F-9791-C65723AED7D8}
2012-06-25 21:24 . 2012-06-25 21:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{5068C74F-B24E-43BD-AA62-37262DBB98C8}
2012-06-25 21:24 . 2012-06-25 21:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{C6CCA311-BC5A-4638-B3C5-7409CBF8579F}
2012-06-25 09:20 . 2012-06-25 09:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{6BE7F911-6798-4ABF-BDED-7517E922F43C}
2012-06-25 09:20 . 2012-06-25 09:20 -------- d-----w- c:\users\Jiřík\AppData\Local\{99940F11-F9EE-4ED6-988F-2C7F598223DF}
2012-06-24 11:32 . 2012-06-24 11:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{A7642129-BEBF-44B5-8AC9-7EF562E030FD}
2012-06-24 11:32 . 2012-06-24 11:32 -------- d-----w- c:\users\Jiřík\AppData\Local\{58C8C2F2-5EC2-4D97-B6B9-CAB201CF989A}
2012-06-24 10:14 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-24 10:14 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-24 10:14 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-24 10:14 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-24 10:14 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-24 10:14 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-24 10:14 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-24 10:14 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-24 10:14 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-23 23:31 . 2012-06-23 23:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{C922A2A3-0324-4ACA-A931-0DA22630B4E7}
2012-06-23 23:31 . 2012-06-23 23:31 -------- d-----w- c:\users\Jiřík\AppData\Local\{26A11720-5662-4A72-A43D-6BF9A597A043}
2012-06-23 10:10 . 2012-06-23 10:10 -------- d-----w- c:\users\Jiřík\AppData\Local\Macromedia
2012-06-23 09:05 . 2012-06-23 09:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{F7608C33-0898-42E2-BA5C-B42E21E1D3DC}
2012-06-23 09:05 . 2012-06-23 09:05 -------- d-----w- c:\users\Jiřík\AppData\Local\{31170C2C-DECF-47C2-9354-D44EF4A62521}
2012-06-22 19:00 . 2012-06-22 19:01 -------- d-----w- c:\users\Jiřík\AppData\Local\{3564A15D-1AB1-40FE-AF2B-3561F241DB3C}
2012-06-22 19:00 . 2012-06-22 19:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{069B90D2-984D-4460-93C1-6D1F81332CBB}
2012-06-22 18:30 . 2012-06-22 18:30 -------- d-----w- C:\Temp
2012-06-22 17:10 . 2012-06-22 17:10 -------- d-----w- c:\users\Jiřík\AppData\Roaming\Philipp Winterberg
2012-06-22 16:35 . 2012-06-22 16:35 -------- d-----w- c:\windows\system32\System32
2012-06-22 16:21 . 2012-06-22 16:36 -------- d-----w- c:\users\Jiřík\AppData\Local\Samsung
2012-06-22 16:14 . 2011-06-07 09:13 4659712 ----a-w- c:\windows\system32\Redemption.dll
2012-06-22 16:14 . 2011-06-07 09:13 821824 ----a-w- c:\windows\system32\dgderapi.dll
2012-06-22 16:03 . 2011-06-28 05:32 81122288 ----a-w- c:\users\Jiřík\AppData\Roaming\Microsoft\Windows\Templates\SamsungKiesSetup.exe
2012-06-22 15:57 . 2010-12-21 05:55 12288 ----a-w- c:\windows\system32\drivers\sscewhnt.sys
2012-06-22 15:57 . 2010-12-21 05:55 12288 ----a-w- c:\windows\system32\drivers\sscewh.sys
2012-06-22 15:57 . 2010-12-21 05:55 14848 ----a-w- c:\windows\system32\drivers\sscemdfl.sys
2012-06-22 15:48 . 2012-06-22 15:52 -------- d-----w- c:\program files\Common Files\Samsung
2012-06-22 07:00 . 2012-06-22 07:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{3D41961F-5E7B-4E12-BFD1-78B2E04142F6}
2012-06-22 07:00 . 2012-06-22 07:00 -------- d-----w- c:\users\Jiřík\AppData\Local\{6BAACDEE-01D0-4A79-A301-7A942BB14988}
2012-06-21 08:28 . 2012-06-21 08:29 -------- d-----w- c:\program files\Google
2012-06-21 08:22 . 2012-06-21 08:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{E305411E-78CC-49A3-89DD-ED088CBAF8C6}
2012-06-21 08:22 . 2012-06-21 08:22 -------- d-----w- c:\users\Jiřík\AppData\Local\{B6617227-2F8D-4C7A-AE86-7B2DA8BB5C01}
2012-06-20 15:27 . 2012-06-20 15:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{228B48E2-1862-4ED8-AA87-7AEC5F155564}
2012-06-20 15:27 . 2012-06-20 15:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{DB8E7832-0D64-4E56-9B49-3FD1C887C6E0}
2012-06-19 21:35 . 2012-06-19 21:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{5A8BA3D9-15DA-49CB-9356-6975F1EC236D}
2012-06-19 21:35 . 2012-06-19 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{6A832182-8DEA-4644-AE4D-358FF691B0DA}
2012-06-19 09:04 . 2012-06-19 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{15D71C09-423D-4EC2-8D8C-BC4854E20DD4}
2012-06-19 09:04 . 2012-06-19 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{9DF65E0F-834D-4503-B6F3-5F54718A632D}
2012-06-18 20:37 . 2012-06-18 20:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{D5F814CA-B626-43BD-9A5A-34C8C2813D14}
2012-06-18 08:37 . 2012-06-18 08:37 -------- d-----w- c:\users\Jiřík\AppData\Local\{53E5FA49-6A8E-4607-AFDC-2355D9831485}
2012-06-17 20:29 . 2012-06-17 20:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{6A232E38-B46D-439E-9E5E-06965D760AC0}
2012-06-17 08:28 . 2012-06-17 08:29 -------- d-----w- c:\users\Jiřík\AppData\Local\{4D60B972-ACC0-4311-8952-1A3A6F4DE1D8}
2012-06-16 09:13 . 2012-06-16 09:13 -------- d-----w- c:\users\Jiřík\AppData\Local\{81CCF0BD-6148-4BD8-B169-0D2B7EC04B17}
2012-06-15 19:24 . 2012-06-15 19:24 -------- d-----w- c:\users\Jiřík\AppData\Local\{BC1D7244-A0F2-4300-8954-6EC2C34FEA1C}
2012-06-15 07:17 . 2012-06-15 07:17 -------- d-----w- c:\users\Jiřík\AppData\Local\{BE38DEB7-4A01-48FD-B84B-32973D845FB3}
2012-06-14 08:57 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-14 08:57 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-14 08:56 . 2012-05-15 01:05 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-06-14 08:56 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-14 08:56 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-14 08:56 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-14 08:56 . 2012-05-01 04:44 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-06-14 08:56 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-06-14 08:56 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-14 08:56 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-14 08:49 . 2012-06-14 08:50 -------- d-----w- c:\users\Jiřík\AppData\Local\{2BA424A7-3010-4DBD-AB12-CBDB75E213F1}
2012-06-14 08:49 . 2012-06-14 08:49 -------- d-----w- c:\users\Jiřík\AppData\Local\{B308F4F8-928F-41D7-9056-6212DD00324B}
2012-06-13 14:32 . 2012-05-26 19:03 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60C0E2A0-3EE2-43C2-89C2-75C9D322C383}\gapaengine.dll
2012-06-13 11:48 . 2012-06-13 11:48 -------- d-----w- c:\users\Jiřík\AppData\Local\{18C326F9-CED6-468E-9946-C2B2BD23F83A}
2012-06-12 20:28 . 2012-06-12 20:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{A03EDB52-CD06-4D68-AC82-9D322BD9C73A}
2012-06-12 20:28 . 2012-06-12 20:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{B3BB11BD-C714-4E49-BEE0-6C2A214E6FFB}
2012-06-12 08:27 . 2012-06-12 08:28 -------- d-----w- c:\users\Jiřík\AppData\Local\{C30FEDCA-1E51-416A-986B-2AB2D4B28B89}
2012-06-12 08:27 . 2012-06-12 08:27 -------- d-----w- c:\users\Jiřík\AppData\Local\{00BB6A58-0430-40EE-9C62-A41CF2B67F32}
2012-06-11 09:36 . 2012-06-11 09:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{18D20A9C-0563-4D2A-B253-50321BEF982B}
2012-06-11 09:36 . 2012-06-11 09:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{E43B0CD0-CCC9-4187-BD6F-965AC8803C60}
2012-06-10 21:35 . 2012-06-10 21:36 -------- d-----w- c:\users\Jiřík\AppData\Local\{BFA7DA85-5888-4649-B905-ACE34193C98F}
2012-06-10 21:35 . 2012-06-10 21:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{159DC43B-0080-4C5A-A14C-1569A4E95BAE}
2012-06-10 09:35 . 2012-06-10 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{5F814161-AA8B-4399-89C1-12088C31EE02}
2012-06-10 09:35 . 2012-06-10 09:35 -------- d-----w- c:\users\Jiřík\AppData\Local\{07A887D9-4A72-4C34-AF5C-0666D6A0B2EB}
2012-06-09 09:30 . 2012-06-09 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{202A39D6-29AC-4BD5-9A3B-AE622206863C}
2012-06-09 09:29 . 2012-06-09 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{07B79871-4F9F-46AC-8B90-6EE66D0557DD}
2012-06-08 09:18 . 2012-06-08 09:19 -------- d-----w- c:\users\Jiřík\AppData\Local\{9151E13A-B6E2-4AD3-B549-FBEF8498CAD6}
2012-06-08 09:18 . 2012-06-08 09:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{B903F68A-BC8F-499E-AF88-C854CA2F3F4E}
2012-06-07 21:18 . 2012-06-07 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{83C43C16-4F12-491A-8A2E-AD3186890BDE}
2012-06-07 21:18 . 2012-06-07 21:18 -------- d-----w- c:\users\Jiřík\AppData\Local\{54B199B0-5D3A-445B-B8CF-56644D97BD88}
2012-06-07 09:04 . 2012-06-07 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{EF0CF2CC-BD90-4188-8023-2BFE668C5DC1}
2012-06-07 09:04 . 2012-06-07 09:04 -------- d-----w- c:\users\Jiřík\AppData\Local\{CBE74C41-CEB3-40D7-AC87-C544A3D75B57}
2012-06-06 18:09 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-06-06 18:09 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-06-06 12:27 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2012-06-06 12:27 . 2012-07-03 09:01 -------- d-----w- c:\programdata\Spyware Terminator
2012-06-06 12:27 . 2012-06-06 12:27 -------- d-----w- c:\users\Jiřík\AppData\Roaming\Spyware Terminator
2012-06-06 12:25 . 2012-06-23 09:05 -------- d-----w- c:\program files\Spyware Terminator
2012-06-06 09:30 . 2012-06-06 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{D72618F2-21A2-4763-8ED9-B17650CB43DA}
2012-06-06 09:29 . 2012-06-06 09:30 -------- d-----w- c:\users\Jiřík\AppData\Local\{1430EB17-AB18-4579-BEBC-B04A369F7751}
2012-06-06 09:16 . 2012-06-06 09:16 -------- d-----w- c:\program files\trend micro
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 09:47 . 2012-05-26 19:23 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 09:47 . 2012-05-26 19:23 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-29 07:38 . 2011-06-07 09:13 330240 ----a-w- c:\windows\MASetupCaller.dll
2012-05-28 20:32 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-05-27 10:05 . 2012-05-27 10:05 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-05-26 19:29 . 2012-05-26 19:29 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-05-26 19:29 . 2012-05-26 19:29 161792 ----a-w- c:\windows\system32\msls31.dll
2012-05-26 19:29 . 2012-05-26 19:29 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-05-26 19:29 . 2012-05-26 19:29 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-05-26 19:29 . 2012-05-26 19:29 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-05-26 19:29 . 2012-05-26 19:29 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-05-26 19:29 . 2012-05-26 19:29 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-05-26 19:29 . 2012-05-26 19:29 367104 ----a-w- c:\windows\system32\html.iec
2012-05-26 19:29 . 2012-05-26 19:29 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-05-26 19:29 . 2012-05-26 19:29 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-26 19:29 . 2012-05-26 19:29 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-05-26 19:29 . 2012-05-26 19:29 152064 ----a-w- c:\windows\system32\wextract.exe
2012-05-26 19:29 . 2012-05-26 19:29 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-05-26 19:29 . 2012-05-26 19:29 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-05-26 19:29 . 2012-05-26 19:29 11776 ----a-w- c:\windows\system32\mshta.exe
2012-05-26 19:29 . 2012-05-26 19:29 101888 ----a-w- c:\windows\system32\admparse.dll
2012-05-26 19:03 . 2012-05-26 19:04 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-06-08 3521464]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-06-08 21432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-19 1594664]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-11-19 83240]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2010-09-29 3058304]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-10 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-10 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-08-24 9722472]
"iSeriesCharge"="c:\program files\ASUS\USBChargeSetting\iSeriesCharge.exe" [2010-08-18 96176]
"ASUSPRP"="c:\program files\ASUS\APRP\APRP.EXE" [2010-09-29 2018032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2012-03-27 2786480]
"SpywareTerminatorUpdater"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2012-03-27 3669680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [x]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [x]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [x]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AiDriver;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiDriver.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [x]
S1 MpKsl84d204d1;MpKsl84d204d1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6514C5C8-3B44-4EAE-93BB-779E68C44635}\MpKsl84d204d1.sys [x]
S1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\Spyware Terminator\st_rsser.exe [x]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - FSUSBEXDISK
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 09:47]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-21 08:28]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-21 08:28]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jiřík\AppData\Roaming\Mozilla\Firefox\Profiles\iqd87t3h.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60747&qkw=
.
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5480)
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\windows\system32\nvvsvc.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\program files\Mozilla Firefox 3\firefox.exe
c:\program files\Mozilla Firefox 3\plugin-container.exe
c:\windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
c:\windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
.
**************************************************************************
.
Celkový čas: 2012-07-03 22:30:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-07-03 20:29
ComboFix2.txt 2012-05-31 13:31
.
Před spuštěním: Volných bajtů: 38 704 168 960
Po spuštění: Volných bajtů: 38 642 401 280
.
- - End Of File - - 2298FEBEE50CEBF2110821FE81931EA0

[Rudy]

Log je již OK. Zkuste vypnout obnovu systému, restartovat PC a obnovu opět zapnout. Je možné, že se šmejd skrývá někde v záloze. Nějaká speciální ochrana proti SS neexistuje, pouze běžný antivir. Zřejmě se pohybujete tam, kde toho šmejda chytíte.

[sylar]

Zkusil jsem vypnout/zapnout obnovu, uvidíme jestli to už bude OK. Spíše se tedy divím, že si s ním např. MBAM nedokáže poradit a zastavit jej, protože co jsem hledal informace tak žádný nový vir to zase není.

Moc děkuji za kontrolu logu a pomoc.

[Rudy]

Nemáte zač!