Win32/Remtasu.V trojský kůň

[MichalM]

RKILL

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 11/13/2012 06:24:14 PM in x86 mode.
Windows Version: Windows 7 Professional Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 11/13/2012 06:24:22 PM
Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s)

[vyosek]

RogueKiller nechte byt a pustte tam ComboFix

[MichalM]

a tady je ten poslední log

ComboFix 12-11-13.02 - Michal 13.11.2012 18:33:19.1.8 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3063.1715 [GMT 1:00]
Spuštěný z: c:\users\Michal\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Michal\AppData\Roaming\Microsoft\Windows\h0zMgUiAj.dat
c:\users\Michal\AppData\Roaming\Microsoft\Windows\h0zMgUiAj.xtr
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\msxml4-KB973688-enu.LOG
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-13 do 2012-11-13 )))))))))))))))))))))))))))))))
.
.
2012-11-13 17:37 . 2012-11-13 17:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-13 16:47 . 2012-11-13 16:48 -------- d-----w- C:\rsit
2012-11-13 16:47 . 2012-11-13 16:48 -------- d-----w- c:\program files\trend micro
2012-11-13 16:23 . 2012-11-13 16:23 -------- d-----w- c:\programdata\Malwarebytes
2012-11-13 13:52 . 2012-11-13 16:57 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8F17875A-FD1E-47FC-A950-18ABD12D023F}\offreg.dll
2012-11-13 13:38 . 2012-10-17 00:32 6918632 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8F17875A-FD1E-47FC-A950-18ABD12D023F}\mpengine.dll
2012-11-12 18:04 . 2012-11-12 18:04 -------- d-----w- c:\program files\Bohemia Interactive
2012-11-12 13:22 . 2012-11-12 13:22 -------- d-----w- c:\program files\PANDORA.TV
2012-11-12 13:22 . 2012-11-12 13:22 -------- d-sh--r- c:\windows\system32\nivida
2012-11-11 17:37 . 2012-11-11 17:37 -------- d--h--w- c:\program files\Common Files\EAInstaller
2012-11-11 11:43 . 2012-11-11 21:50 -------- d-----w- C:\Moje soubory
2012-11-11 11:05 . 2012-11-12 13:14 -------- d-----w- c:\program files\Common Files\Steam
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----w- c:\program files\Common Files\Skype
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----r- c:\program files\Skype
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----w- c:\programdata\Skype
2012-11-11 10:00 . 2009-06-22 17:58 89600 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
2012-11-11 09:49 . 2012-11-11 09:49 -------- d-----w- c:\program files\HP
2012-11-11 09:49 . 2012-11-11 09:49 -------- d-----w- c:\program files\Hewlett-Packard
2012-11-11 09:46 . 2012-11-11 09:46 -------- d-----w- c:\programdata\HP
2012-11-11 09:46 . 2012-11-11 09:46 -------- d-----w- c:\programdata\Hewlett-Packard
2012-11-10 13:41 . 2012-11-10 13:41 -------- d-----w- c:\program files\Common Files\Java
2012-11-10 13:41 . 2012-11-10 13:41 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-11-10 13:41 . 2012-11-10 13:41 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-10 13:41 . 2012-11-10 13:41 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-10 13:41 . 2012-11-10 13:41 -------- d-----w- c:\program files\Java
2012-11-10 13:22 . 2012-11-10 13:22 -------- d-----w- c:\program files\OpenOffice.org 3
2012-11-10 12:44 . 2012-11-10 12:44 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2012-11-10 12:41 . 2012-11-10 12:41 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-11-10 12:38 . 2012-11-10 12:38 -------- d-----w- c:\program files\MSXML 4.0
2012-11-10 12:13 . 2009-02-26 18:18 29552 ----a-w- c:\windows\system32\mdimon.dll
2012-11-10 12:13 . 2006-10-26 18:58 30512 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2012-11-10 12:13 . 2009-02-27 02:42 31640 ----a-w- c:\windows\system32\msonpmon.dll
2012-11-10 12:13 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2012-11-10 12:12 . 2012-11-10 12:42 -------- d-----w- c:\program files\Microsoft Works
2012-11-10 12:12 . 2012-11-10 12:12 -------- d-----w- c:\windows\PCHEALTH
2012-11-10 12:10 . 2012-11-10 12:10 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2012-11-10 12:10 . 2012-11-10 12:55 -------- d-----w- c:\programdata\Microsoft Help
2012-11-10 12:09 . 2012-11-10 12:09 -------- d-----r- C:\MSOCache
2012-11-10 11:56 . 2012-11-10 12:45 -------- d-----w- c:\program files\Microsoft Silverlight
2012-11-10 11:55 . 2012-11-10 11:55 466008 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-11-10 11:55 . 2012-11-10 11:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-11-10 11:54 . 2012-11-11 17:16 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-11-10 11:51 . 2012-11-10 11:51 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-11-10 11:47 . 2011-12-07 17:32 216064 ----a-w- c:\windows\system32\lagarith.dll
2012-11-10 11:47 . 2011-06-24 14:44 243200 ----a-w- c:\windows\system32\xvidvfw.dll
2012-11-10 11:47 . 2011-06-24 14:28 650752 ----a-w- c:\windows\system32\xvidcore.dll
2012-11-10 11:47 . 2012-06-09 17:21 178688 ----a-w- c:\windows\system32\unrar.dll
2012-11-10 11:47 . 2011-12-21 17:14 151552 ----a-w- c:\windows\system32\ac3acm.acm
2012-11-10 11:46 . 2012-07-20 18:00 112640 ----a-w- c:\windows\system32\ff_vfw.dll
2012-11-10 11:46 . 2012-11-10 11:47 -------- d-----w- c:\program files\K-Lite Codec Pack
2012-11-10 11:45 . 2012-11-10 11:45 -------- d-----w- c:\program files\Common Files\Adobe
2012-11-10 11:43 . 2012-05-05 10:54 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-11-10 11:43 . 2012-10-12 06:34 86528 ----a-w- c:\windows\system32\pdfcmon.dll
2012-11-10 11:43 . 2012-05-05 10:54 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-11-10 11:43 . 2012-05-05 10:54 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-11-10 11:43 . 2012-11-10 11:43 -------- d-----w- c:\program files\PDFCreator
2012-11-10 11:42 . 2012-11-10 11:42 -------- d-----w- c:\program files\XnView
2012-11-10 11:29 . 2012-11-10 11:53 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-10 11:29 . 2012-11-10 11:53 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-10 11:29 . 2012-11-10 11:29 -------- d-----w- c:\windows\system32\Macromed
2012-11-10 11:21 . 2012-11-10 11:21 -------- d-----w- c:\programdata\LightScribe
2012-11-10 11:06 . 2012-11-10 11:14 -------- d-----w- c:\program files\Nero
2012-11-10 11:06 . 2012-11-10 11:19 -------- d-----w- c:\program files\Common Files\Nero
2012-11-10 11:06 . 2012-11-10 11:11 -------- d-----w- c:\programdata\Nero
2012-11-10 11:05 . 2012-11-10 11:05 -------- d-----w- c:\program files\Common Files\LightScribe
2012-11-10 10:44 . 2012-11-10 10:44 -------- d-----w- c:\program files\ESET
2012-11-10 10:37 . 2012-11-10 10:37 -------- d-----w- C:\totalcmd
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\UC.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\RAR.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\LHA.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\ARJ.PIF
2012-11-10 10:12 . 2012-08-21 20:12 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-11-10 10:12 . 2012-08-24 17:05 136560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-11-10 10:12 . 2012-08-24 17:02 369856 ----a-w- c:\windows\system32\drivers\cng.sys
2012-11-10 10:12 . 2012-08-24 16:57 247808 ----a-w- c:\windows\system32\schannel.dll
2012-11-10 10:12 . 2012-08-24 16:57 220160 ----a-w- c:\windows\system32\ncrypt.dll
2012-11-10 10:12 . 2012-08-24 16:56 1039360 ----a-w- c:\windows\system32\lsasrv.dll
2012-11-10 10:12 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-11-10 10:12 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-11-10 10:12 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-11-10 10:12 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-11-10 10:12 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-11-10 10:12 . 2012-05-04 09:59 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-11-10 09:38 . 2012-11-10 09:38 -------- d-----w- c:\windows\system32\SPReview
2012-11-10 09:38 . 2012-11-10 09:38 -------- d-----w- c:\windows\system32\EventProviders
2012-11-10 09:35 . 2010-11-20 12:36 46080 ----a-w- c:\windows\system32\NAPCRYPT.DLL
2012-11-10 09:34 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-11-10 09:34 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-11-10 09:20 . 2012-11-10 09:20 -------- d-----w- c:\program files\Intel
2012-11-10 09:20 . 2008-07-16 15:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2012-11-10 09:19 . 2012-11-10 09:19 -------- d-----w- C:\Intel
2012-11-10 09:17 . 2012-11-10 12:12 -------- d-----w- c:\program files\Microsoft.NET
2012-11-10 09:17 . 2012-11-12 16:36 -------- d-sh--w- c:\windows\Installer
2012-11-10 09:14 . 2012-11-10 09:14 -------- d-----w- c:\windows\system32\Wat
2012-11-10 08:53 . 2012-11-10 08:53 -------- d-----w- c:\users\UpdatusUser
2012-11-10 08:53 . 2012-11-13 16:32 -------- d-----w- c:\programdata\NVIDIA
2012-11-10 08:53 . 2012-10-02 19:29 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-11-10 08:53 . 2012-10-02 19:29 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-11-10 08:53 . 2012-10-02 19:29 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-11-10 08:53 . 2012-10-02 19:29 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-11-10 08:53 . 2012-10-02 19:29 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-11-10 08:53 . 2012-10-02 19:28 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-11-10 08:53 . 2012-10-10 20:14 52584 ----a-w- c:\windows\system32\OpenCL.dll
2012-11-10 08:52 . 2012-11-10 08:52 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-11-10 08:52 . 2012-11-10 08:53 -------- d-----w- c:\program files\NVIDIA Corporation
2012-11-10 08:44 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-11-10 08:44 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2012-11-10 08:44 . 2012-03-01 05:33 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-11-10 08:42 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2012-11-10 08:31 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-11-10 08:24 . 2011-02-03 05:54 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-11-10 08:24 . 2010-11-20 12:29 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-11-10 08:24 . 2010-11-20 11:56 107520 ----a-w- c:\windows\system32\cdd.dll
2012-11-10 08:24 . 2012-05-31 11:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-11-10 08:04 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-11-10 08:04 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-11-10 08:04 . 2010-11-20 10:21 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys
2012-11-10 08:02 . 2012-11-13 16:38 -------- d-----w- c:\windows\system32\wbem\Performance
2012-11-10 07:49 . 2012-11-10 08:00 -------- d-----w- c:\windows\Panther
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-10 09:46 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-11-10 08:43 . 2012-11-10 08:43 203776 ----a-w- c:\windows\system32\webcheck.dll
2012-10-10 20:15 . 2012-10-10 20:15 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15 . 2012-10-10 20:15 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14 . 2012-10-10 20:14 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14 . 2009-07-13 22:09 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14 . 2012-10-10 20:14 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14 . 2012-10-10 20:14 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14 . 2012-10-10 20:14 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14 . 2012-10-10 20:14 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14 . 2012-10-10 20:14 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14 . 2012-10-10 20:14 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14 . 2012-10-10 20:14 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14 . 2012-10-10 20:14 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-02 12:15 . 2012-10-02 12:15 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-08-23 15:52 . 2012-11-10 10:22 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2012-10-24 17:50 . 2012-11-10 11:51 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Steam"="d:\steam\steam.exe" [2012-11-11 1353080]
"KMPlayer"="c:\users\Michal\AppData\Roaming\nivida\KMPlayer.exe" [2012-11-03 568832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"KMPlayer"="c:\windows\system32\nivida\KMPlayer.exe" [2012-11-03 568832]
.
c:\users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
KM Player.exe [2012-11-3 568832]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Total Commander.lnk - c:\totalcmd\TOTALCMD.EXE [2012-11-10 3520256]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 MSICDSetup;MSICDSetup;X:\CDriver.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 PanService;PandoraService;c:\program files\PANDORA.TV\PanService\PandoraService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - TRUESIGHT
*Deregistered* - TrueSight
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-10 11:53]
.
2012-11-10 c:\windows\Tasks\NeroLiveEpgUpdate-pckluci_Michal.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\p9d5qa3v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-BattlEye for A2 - d:\steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-11-13 18:38:28
ComboFix-quarantined-files.txt 2012-11-13 17:38
.
Před spuštěním: Volných bajtů: 276 857 700 352
Po spuštění: Volných bajtů: 278 434 570 240
.
- - End Of File - - 27A30F6A17DF730FEF94A3FB1A0BE19C

[MichalM]

tk PC funguje, ale nemůžu najít ESET.. myslíte, že se smazal?

[vyosek]

Zabezpeceni zatim nereste, PC je jeste zavirovan

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Collect::
  c:\users\Michal\AppData\Roaming\nivida\KMPlayer.exe
  c:\users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KM Player.exe
  
  Folder::
  c:\users\Michal\AppData\Roaming\nivida
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  "Steam"=-
  "KMPlayer"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Adobe ARM"="-
  "GrooveMonitor"=-
  "SunJavaUpdateSched"=-
  "KMPlayer"=-
  
  File::
  c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Total Commander.lnk
  c:\windows\Tasks\Adobe Flash Player Updater.job
  c:\windows\Tasks\NeroLiveEpgUpdate-pckluci_Michal.job
  
  Driver::
  MSICDSetup
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[MichalM]

tk sem to tam přetáh, combo se spustilo znovu, pak se počítač restartoval a tady je další log

ComboFix 12-11-13.02 - Michal 13.11.2012 19:10:27.2.8 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3063.1805 [GMT 1:00]
Spuštěný z: c:\users\Michal\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Michal\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Total Commander.lnk"
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\NeroLiveEpgUpdate-pckluci_Michal.job"
.
file zipped: c:\users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KM Player.exe
file zipped: c:\users\Michal\AppData\Roaming\nivida\KMPlayer.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Total Commander.lnk
c:\users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KM Player.exe
c:\users\Michal\AppData\Roaming\nivida
c:\users\Michal\AppData\Roaming\nivida\KMPlayer.exe
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\NeroLiveEpgUpdate-pckluci_Michal.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MSICDSETUP
-------\Service_MSICDSetup
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-13 do 2012-11-13 )))))))))))))))))))))))))))))))
.
.
2012-11-13 16:47 . 2012-11-13 16:48 -------- d-----w- C:\rsit
2012-11-13 16:47 . 2012-11-13 16:48 -------- d-----w- c:\program files\trend micro
2012-11-13 16:23 . 2012-11-13 16:23 -------- d-----w- c:\programdata\Malwarebytes
2012-11-13 13:52 . 2012-11-13 16:57 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8F17875A-FD1E-47FC-A950-18ABD12D023F}\offreg.dll
2012-11-13 13:38 . 2012-10-17 00:32 6918632 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8F17875A-FD1E-47FC-A950-18ABD12D023F}\mpengine.dll
2012-11-12 18:04 . 2012-11-12 18:04 -------- d-----w- c:\program files\Bohemia Interactive
2012-11-12 13:22 . 2012-11-12 13:22 -------- d-----w- c:\program files\PANDORA.TV
2012-11-12 13:22 . 2012-11-12 13:22 -------- d-sh--r- c:\windows\system32\nivida
2012-11-11 17:37 . 2012-11-11 17:37 -------- d--h--w- c:\program files\Common Files\EAInstaller
2012-11-11 11:43 . 2012-11-11 21:50 -------- d-----w- C:\Moje soubory
2012-11-11 11:05 . 2012-11-12 13:14 -------- d-----w- c:\program files\Common Files\Steam
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----w- c:\program files\Common Files\Skype
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----r- c:\program files\Skype
2012-11-11 10:30 . 2012-11-11 10:30 -------- d-----w- c:\programdata\Skype
2012-11-11 10:00 . 2009-06-22 17:58 89600 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
2012-11-11 09:49 . 2012-11-11 09:49 -------- d-----w- c:\program files\HP
2012-11-11 09:49 . 2012-11-11 09:49 -------- d-----w- c:\program files\Hewlett-Packard
2012-11-11 09:46 . 2012-11-11 09:46 -------- d-----w- c:\programdata\HP
2012-11-11 09:46 . 2012-11-11 09:46 -------- d-----w- c:\programdata\Hewlett-Packard
2012-11-10 13:41 . 2012-11-10 13:41 -------- d-----w- c:\program files\Common Files\Java
2012-11-10 13:41 . 2012-11-10 13:41 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-11-10 13:41 . 2012-11-10 13:41 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-10 13:41 . 2012-11-10 13:41 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-10 13:41 . 2012-11-10 13:41 -------- d-----w- c:\program files\Java
2012-11-10 13:22 . 2012-11-10 13:22 -------- d-----w- c:\program files\OpenOffice.org 3
2012-11-10 12:44 . 2012-11-10 12:44 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2012-11-10 12:41 . 2012-11-10 12:41 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-11-10 12:38 . 2012-11-10 12:38 -------- d-----w- c:\program files\MSXML 4.0
2012-11-10 12:13 . 2009-02-26 18:18 29552 ----a-w- c:\windows\system32\mdimon.dll
2012-11-10 12:13 . 2006-10-26 18:58 30512 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2012-11-10 12:13 . 2009-02-27 02:42 31640 ----a-w- c:\windows\system32\msonpmon.dll
2012-11-10 12:13 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2012-11-10 12:12 . 2012-11-10 12:42 -------- d-----w- c:\program files\Microsoft Works
2012-11-10 12:12 . 2012-11-10 12:12 -------- d-----w- c:\windows\PCHEALTH
2012-11-10 12:10 . 2012-11-10 12:10 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2012-11-10 12:10 . 2012-11-10 12:55 -------- d-----w- c:\programdata\Microsoft Help
2012-11-10 12:09 . 2012-11-10 12:09 -------- d-----r- C:\MSOCache
2012-11-10 11:56 . 2012-11-10 12:45 -------- d-----w- c:\program files\Microsoft Silverlight
2012-11-10 11:55 . 2012-11-10 11:55 466008 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-11-10 11:55 . 2012-11-10 11:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-11-10 11:54 . 2012-11-11 17:16 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-11-10 11:51 . 2012-11-10 11:51 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-11-10 11:47 . 2011-12-07 17:32 216064 ----a-w- c:\windows\system32\lagarith.dll
2012-11-10 11:47 . 2011-06-24 14:44 243200 ----a-w- c:\windows\system32\xvidvfw.dll
2012-11-10 11:47 . 2011-06-24 14:28 650752 ----a-w- c:\windows\system32\xvidcore.dll
2012-11-10 11:47 . 2012-06-09 17:21 178688 ----a-w- c:\windows\system32\unrar.dll
2012-11-10 11:47 . 2011-12-21 17:14 151552 ----a-w- c:\windows\system32\ac3acm.acm
2012-11-10 11:46 . 2012-07-20 18:00 112640 ----a-w- c:\windows\system32\ff_vfw.dll
2012-11-10 11:46 . 2012-11-10 11:47 -------- d-----w- c:\program files\K-Lite Codec Pack
2012-11-10 11:45 . 2012-11-10 11:45 -------- d-----w- c:\program files\Common Files\Adobe
2012-11-10 11:43 . 2012-05-05 10:54 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-11-10 11:43 . 2012-10-12 06:34 86528 ----a-w- c:\windows\system32\pdfcmon.dll
2012-11-10 11:43 . 2012-05-05 10:54 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-11-10 11:43 . 2012-05-05 10:54 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-11-10 11:43 . 2012-11-10 11:43 -------- d-----w- c:\program files\PDFCreator
2012-11-10 11:42 . 2012-11-10 11:42 -------- d-----w- c:\program files\XnView
2012-11-10 11:29 . 2012-11-10 11:53 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-10 11:29 . 2012-11-10 11:53 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-10 11:29 . 2012-11-10 11:29 -------- d-----w- c:\windows\system32\Macromed
2012-11-10 11:21 . 2012-11-10 11:21 -------- d-----w- c:\programdata\LightScribe
2012-11-10 11:06 . 2012-11-10 11:14 -------- d-----w- c:\program files\Nero
2012-11-10 11:06 . 2012-11-10 11:19 -------- d-----w- c:\program files\Common Files\Nero
2012-11-10 11:06 . 2012-11-10 11:11 -------- d-----w- c:\programdata\Nero
2012-11-10 11:05 . 2012-11-10 11:05 -------- d-----w- c:\program files\Common Files\LightScribe
2012-11-10 10:44 . 2012-11-10 10:44 -------- d-----w- c:\program files\ESET
2012-11-10 10:37 . 2012-11-10 10:37 -------- d-----w- C:\totalcmd
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\UC.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\RAR.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\LHA.PIF
2012-11-10 10:37 . 2009-09-24 06:50 545 ----a-w- c:\windows\ARJ.PIF
2012-11-10 10:12 . 2012-08-21 20:12 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-11-10 10:12 . 2012-08-24 17:05 136560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-11-10 10:12 . 2012-08-24 17:02 369856 ----a-w- c:\windows\system32\drivers\cng.sys
2012-11-10 10:12 . 2012-08-24 16:57 247808 ----a-w- c:\windows\system32\schannel.dll
2012-11-10 10:12 . 2012-08-24 16:57 220160 ----a-w- c:\windows\system32\ncrypt.dll
2012-11-10 10:12 . 2012-08-24 16:56 1039360 ----a-w- c:\windows\system32\lsasrv.dll
2012-11-10 10:12 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-11-10 10:12 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-11-10 10:12 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-11-10 10:12 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-11-10 10:12 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-11-10 10:12 . 2012-05-04 09:59 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-11-10 09:38 . 2012-11-10 09:38 -------- d-----w- c:\windows\system32\SPReview
2012-11-10 09:38 . 2012-11-10 09:38 -------- d-----w- c:\windows\system32\EventProviders
2012-11-10 09:35 . 2010-11-20 12:36 46080 ----a-w- c:\windows\system32\NAPCRYPT.DLL
2012-11-10 09:34 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-11-10 09:34 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-11-10 09:20 . 2012-11-10 09:20 -------- d-----w- c:\program files\Intel
2012-11-10 09:20 . 2008-07-16 15:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2012-11-10 09:19 . 2012-11-10 09:19 -------- d-----w- C:\Intel
2012-11-10 09:17 . 2012-11-10 12:12 -------- d-----w- c:\program files\Microsoft.NET
2012-11-10 09:17 . 2012-11-12 16:36 -------- d-sh--w- c:\windows\Installer
2012-11-10 09:14 . 2012-11-10 09:14 -------- d-----w- c:\windows\system32\Wat
2012-11-10 08:53 . 2012-11-10 08:53 -------- d-----w- c:\users\UpdatusUser
2012-11-10 08:53 . 2012-11-13 18:15 -------- d-----w- c:\programdata\NVIDIA
2012-11-10 08:53 . 2012-10-02 19:29 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-11-10 08:53 . 2012-10-02 19:29 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-11-10 08:53 . 2012-10-02 19:29 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-11-10 08:53 . 2012-10-02 19:29 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-11-10 08:53 . 2012-10-02 19:29 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-11-10 08:53 . 2012-10-02 19:28 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-11-10 08:53 . 2012-10-10 20:14 52584 ----a-w- c:\windows\system32\OpenCL.dll
2012-11-10 08:52 . 2012-11-10 08:52 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-11-10 08:52 . 2012-11-10 08:53 -------- d-----w- c:\program files\NVIDIA Corporation
2012-11-10 08:44 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-11-10 08:44 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2012-11-10 08:44 . 2012-03-01 05:33 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-11-10 08:42 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2012-11-10 08:31 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-11-10 08:24 . 2011-02-03 05:54 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-11-10 08:24 . 2010-11-20 12:29 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-11-10 08:24 . 2010-11-20 11:56 107520 ----a-w- c:\windows\system32\cdd.dll
2012-11-10 08:24 . 2012-05-31 11:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-11-10 08:04 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-11-10 08:04 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-11-10 08:04 . 2010-11-20 10:21 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys
2012-11-10 08:02 . 2012-11-13 16:38 -------- d-----w- c:\windows\system32\wbem\Performance
2012-11-10 07:49 . 2012-11-10 08:00 -------- d-----w- c:\windows\Panther
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-10 09:46 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-11-10 08:43 . 2012-11-10 08:43 203776 ----a-w- c:\windows\system32\webcheck.dll
2012-10-10 20:15 . 2012-10-10 20:15 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15 . 2012-10-10 20:15 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14 . 2012-10-10 20:14 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14 . 2009-07-13 22:09 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14 . 2012-10-10 20:14 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14 . 2012-10-10 20:14 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14 . 2012-10-10 20:14 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14 . 2012-10-10 20:14 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14 . 2012-10-10 20:14 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14 . 2012-10-10 20:14 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14 . 2012-10-10 20:14 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14 . 2012-10-10 20:14 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-02 12:15 . 2012-10-02 12:15 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-08-23 15:52 . 2012-11-10 10:22 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2012-10-24 17:50 . 2012-11-10 11:51 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 CFcatchme;CFcatchme;c:\users\Michal\AppData\Local\Temp\CFcatchme.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 PanService;PandoraService;c:\program files\PANDORA.TV\PanService\PandoraService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\p9d5qa3v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\PANDORA.TV\PanService\PanProcess.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2012-11-13 19:18:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-13 18:18
ComboFix2.txt 2012-11-13 17:38
.
Před spuštěním: Volných bajtů: 278 760 439 808
Po spuštění: Volných bajtů: 278 353 264 640
.
- - End Of File - - 9B43CEC97EF08EFB31F1B346E046FA99
Nahr nˇ probŘhlo ŁspŘçnŘ

[vyosek]

Fajn, jak se chova PC

[MichalM]

no zaplo se všechno jako normálně, eset se zapnul tk jak má, vypadá to dobře, tkže ste mě zachránil?

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

[MichalM]

Děkuju moc, opravdu jste mě zachránil, jste skvělej, díky moc

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy

A na zaklade Pravidla o zamykani temat