Prosím o kontrolu - změna domovské stránky

[virusak]

Dobrý večer, prosím pěkně o kontrolu logu z RSIT. Místo klasického seznamu se objevuje AdFly nějaký. I po výmazu komplet historie a restartu pc se nic nemění, předem díky za odpovědi.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Michal at 2013-02-04 19:26:15
Microsoft® Windows Vista™ Home Basic
System drive C: has 40 GB (59%) free of 67 GB
Total RAM: 1015 MB (26% free)


======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\wfl572lz.default

prefs.js - "browser.startup.homepage" - "http://adf.ly/IN27G"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.146 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 501400]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-08-06 1006264]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-02-21 1183744]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-06-13 138008]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-06-13 154392]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-06-13 133912]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2007-05-08 331552]
"PTHOSTTR"=C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [2007-01-09 145184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-06-07 833072]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-05-11 472632]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"HP Health Check Scheduler"=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-06-05 71176]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-09 115816]
"IS CfgWiz"=C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe [2007-01-12 431752]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [2007-03-14 83608]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-06-11 163840]
"HP Software Update"=c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
"CanonSolutionMenuEx"=C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [2010-04-02 1185112]
"MSConfig"=C:\Windows\system32\msconfig.exe [2006-11-02 222208]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"=C:\Windows\SMINST\launcher.exe [2007-06-06 44168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2006-11-02 1196032]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2007-04-19 484904]
"{EB45E8AD-6464-59B1-9772-928D5B25D1A9}"=C:\Users\Michal\AppData\Roaming\Avsu\tebaf.exe [2013-02-01 322128]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP]
C:\Windows\system32\DeviceNP.dll [2007-06-08 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-06-07 204800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-02-04 19:26:19 ----D---- C:\Program Files\trend micro
2013-02-04 19:26:15 ----D---- C:\rsit
2013-02-03 12:12:43 ----D---- C:\Users\Michal\AppData\Roaming\Tufiyk
2013-02-03 12:12:43 ----D---- C:\Users\Michal\AppData\Roaming\Avsu
2013-01-30 19:16:40 ----HD---- C:\ProgramData\CanonIJSolutionMenuEX
2013-01-30 19:16:28 ----D---- C:\ProgramData\CanonIJPLM
2013-01-30 19:12:35 ----A---- C:\Windows\system32\CNMXLMAA.DLL
2013-01-30 18:57:07 ----D---- C:\ProgramData\CanonIJMSetup
2013-01-30 18:56:53 ----D---- C:\ProgramData\CanonIJWSpt
2013-01-30 18:56:32 ----HD---- C:\ProgramData\CanonBJ
2013-01-30 18:55:33 ----HD---- C:\Windows\system32\CanonIJ Uninstaller Information
2013-01-30 18:54:43 ----A---- C:\Windows\system32\CNC280L.dll
2013-01-30 18:54:43 ----A---- C:\Windows\system32\CNC280I.dll
2013-01-30 18:54:42 ----A---- C:\Windows\system32\CNC280C.dll
2013-01-30 18:54:41 ----A---- C:\Windows\system32\CNHMCA.dll
2013-01-30 18:54:41 ----A---- C:\Windows\system32\CNC280U.dll
2013-01-30 18:53:24 ----A---- C:\Windows\system32\CNMLMAA.DLL
2013-01-30 18:53:17 ----A---- C:\Windows\system32\CNC280O.dll
2013-01-30 18:53:12 ----A---- C:\Windows\system32\CNMIUAA.DLL
2013-01-30 18:53:02 ----HD---- C:\Program Files\CanonBJ
2013-01-30 18:51:02 ----D---- C:\Program Files\Canon
2013-01-30 18:01:52 ----A---- C:\Windows\system32\unrar.dll
2013-01-30 18:01:42 ----D---- C:\Program Files\K-Lite Codec Pack
2013-01-30 17:56:05 ----D---- C:\Users\Michal\AppData\Roaming\Adobe
2013-01-30 17:55:50 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-01-28 19:51:23 ----A---- C:\Windows\system32\vbscript.dll
2013-01-28 19:51:12 ----A---- C:\Windows\system32\browserchoice.exe
2013-01-28 19:50:37 ----A---- C:\Windows\system32\WSDApi.dll
2013-01-28 19:50:14 ----D---- C:\Program Files\MSXML 4.0
2013-01-28 19:49:53 ----A---- C:\Windows\system32\qmgr.dll
2013-01-28 19:49:38 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2013-01-28 13:36:41 ----N---- C:\Windows\system32\MpSigStub.exe
2013-01-28 12:17:05 ----D---- C:\Users\Michal\AppData\Roaming\Mozilla
2013-01-28 12:14:27 ----D---- C:\ProgramData\Mozilla
2013-01-28 12:14:23 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-01-28 12:12:39 ----D---- C:\Program Files\Mozilla Firefox
2013-01-28 10:59:22 ----D---- C:\Users\Michal\AppData\Roaming\Google
2013-01-28 10:57:06 ----SHD---- C:\$RECYCLE.BIN
2013-01-28 10:56:46 ----D---- C:\Users\Michal\AppData\Roaming\Identities
2013-01-28 10:54:45 ----D---- C:\Users\Michal\AppData\Roaming\Macromedia
2013-01-28 10:54:30 ----D---- C:\Users\Michal\AppData\Roaming\Hewlett-Packard
2013-01-28 10:51:26 ----D---- C:\ProgramData\Google
2013-01-28 10:51:22 ----D---- C:\Program Files\Google
2013-01-28 10:49:58 ----D---- C:\Program Files\Macrovision Corp
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresizeW7.dll
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresizePX.dll
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresizeP6.dll
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresizeM6.dll
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresizeA6.dll
2013-01-28 10:49:03 ----A---- C:\Windows\system32\IVIresize.dll
2013-01-28 10:46:37 ----D---- C:\Program Files\Common Files\InterVideo
2013-01-28 10:46:11 ----D---- C:\Users\Michal\AppData\Roaming\InstallShield
2013-01-28 10:45:59 ----D---- C:\Program Files\InterVideo
2013-01-28 10:44:16 ----SD---- C:\Users\Michal\AppData\Roaming\Microsoft
2013-01-28 10:31:08 ----D---- C:\Windows\SoftwareDistribution
2013-01-28 10:25:13 ----ASH---- C:\hiberfil.sys
2013-01-28 10:25:12 ----D---- C:\Windows\Prefetch
2013-01-28 10:25:10 ----SHD---- C:\System Volume Information
2013-01-28 10:25:10 ----ASH---- C:\pagefile.sys

======List of files/folders modified in the last 1 month======

2013-02-04 19:26:37 ----D---- C:\Windows\Temp
2013-02-04 19:26:19 ----RD---- C:\Program Files
2013-02-04 19:24:43 ----D---- C:\Windows\System32
2013-02-04 19:24:42 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-02-04 19:24:41 ----D---- C:\Windows\inf
2013-02-04 19:19:29 ----D---- C:\Windows\SMINST
2013-02-04 19:17:55 ----D---- C:\Windows\system32\WDI
2013-02-02 12:58:10 ----D---- C:\WINDOWS
2013-01-31 18:19:06 ----SHD---- C:\Windows\Installer
2013-01-31 18:19:04 ----D---- C:\ProgramData\Sonic
2013-01-31 18:18:54 ----D---- C:\Program Files\Common Files\Sonic Shared
2013-01-30 19:21:43 ----D---- C:\ProgramData\Microsoft Help
2013-01-30 19:16:40 ----HD---- C:\ProgramData
2013-01-30 19:13:50 ----D---- C:\Windows\system32\catroot
2013-01-30 19:13:44 ----D---- C:\Windows\system32\catroot2
2013-01-30 19:06:06 ----D---- C:\Windows\system32\Tasks
2013-01-30 18:58:05 ----D---- C:\Windows\system32\drivers
2013-01-30 18:58:04 ----RSD---- C:\Windows\Media
2013-01-30 18:57:57 ----D---- C:\Windows\twain_32
2013-01-30 18:57:18 ----SD---- C:\ProgramData\Microsoft
2013-01-30 18:57:14 ----D---- C:\Windows\system32\drivers\UMDF
2013-01-30 17:55:57 ----D---- C:\Windows\Tasks
2013-01-28 19:51:24 ----D---- C:\Windows\winsxs
2013-01-28 13:39:57 ----D---- C:\Program Files\Norton Internet Security
2013-01-28 12:20:23 ----D---- C:\Program Files\Common Files\Symantec Shared
2013-01-28 12:18:26 ----D---- C:\ProgramData\Symantec
2013-01-28 10:56:32 ----D---- C:\Windows\system
2013-01-28 10:54:26 ----HD---- C:\System.sav
2013-01-28 10:54:26 ----D---- C:\Windows\SOURCES
2013-01-28 10:54:26 ----D---- C:\SwSetup
2013-01-28 10:48:36 ----HD---- C:\Program Files\InstallShield Installation Information
2013-01-28 10:46:37 ----D---- C:\Program Files\Common Files
2013-01-28 10:46:12 ----D---- C:\Windows\system32\restore
2013-01-28 10:45:56 ----D---- C:\Program Files\Common Files\InstallShield
2013-01-28 10:44:15 ----RD---- C:\Users
2013-01-28 10:37:53 ----D---- C:\Windows\rescache
2013-01-28 10:34:23 ----D---- C:\Windows\Panther
2013-01-28 10:31:35 ----D---- C:\Windows\Registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys [2007-03-21 304920]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2007-05-01 43528]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\ADIHdAud.sys [2007-03-09 309248]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2007-04-16 1161152]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-06-19 690432]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2007-05-24 223616]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-06-07 1683456]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-06-07 181432]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-06-19 690432]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2007-08-06 19456]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2006-11-02 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2007-08-06 220160]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2007-08-06 29184]
S3 DAMDrv;DAMDrv; C:\Windows\system32\DRIVERS\DAMDrv.sys [2007-06-08 30008]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20070108.003\IDSvix86.sys [2006-12-27 212280]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-06-19 2219520]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2006-11-02 49664]
S3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2007-08-06 115000]
S3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2006-11-02 41064]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2006-11-02 128104]
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AEADIFilters;Andrea ADI Filters Service; C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2007-04-16 9216]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2010-04-05 116104]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976]
R4 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-01-29 554616]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-30 251400]
S4 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
S4 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
S4 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
S4 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-03-05 110592]
S4 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-01-12 49248]
S4 FLCDLOCK;HP ProtectTools Device Locking / Auditing; C:\Windows\system32\flcdlock.exe [2007-06-08 172131]
S4 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-06-05 61440]
S4 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
S4 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S4 ISPwdSvc;Symantec IS Password Validation; C:\Program Files\Norton Internet Security\isPwdSvc.exe [2007-01-13 80504]
S4 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
S4 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-01-29 2918008]
S4 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-01-28 115608]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
S4 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-05-22 1010424]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2006-04-14 240416]
S4 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-05-03 74656]
S4 SymAppCore;Symantec AppCore Service; C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2007-01-04 47712]

-----------------EOF-----------------

[Rudy]

Zdravím!
Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php MBAM a dejte log. Předem nic nemažte.

[virusak]

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Verze: v2013.02.04.07

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16448
Michal :: MICHAL-PC [administrátor]

4.2.2013 19:48:14
MBAM-log-2013-02-04 (20-38-47).txt

Typ: Kompletní kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 278663
Uplynulý čas: 50 minut, 12 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{EB45E8AD-6464-59B1-9772-928D5B25D1A9} (Trojan.ZbotR.Gen) -> Data: C:\Users\Michal\AppData\Roaming\Avsu\tebaf.exe -> Nebyla provedena žádná instrukce.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\Users\Michal\AppData\Local\Temp\tmpb7676a5a\b.exe (Trojan.Agent) -> Nebyla provedena žádná instrukce.
C:\Users\Michal\AppData\Roaming\Avsu\tebaf.exe (Trojan.ZbotR.Gen) -> Nebyla provedena žádná instrukce.

(konec)

[Rudy]

Vše, co MBAM nalezl, smažte.

[virusak]

Zdravím, takže vše smazáno ale přesto výsledek stejný. Stále nabíhá AdFly.

[Rudy]

Stáhněte, nainstalujte a spusťte Superantispyware: http://www.stahuj.centrum.cz/utility_a_ ... tispyware/ . Udělejte sken a smažte vše, co najde.

[virusak]

Takže spuštěna kontrola a žádný nález, už vážně nevím co by to mohlo být

[Rudy]

Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[virusak]

ComboFix 13-02-07.02 - Michal 10.02.2013 12:03:38.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.420.1029.18.1015.412 [GMT 1:00]
Spuštěný z: c:\users\Michal\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\msxml4-KB973688-enu.LOG
c:\windows\security\Database\tmp.edb
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-10 do 2013-02-10 )))))))))))))))))))))))))))))))
.
.
2013-02-10 11:10 . 2013-02-10 11:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-10 09:16 . 2013-02-10 09:16 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-02-05 09:40 . 2013-02-05 09:40 -------- d-----w- c:\program files\DIFX
2013-02-05 09:36 . 2013-02-05 09:59 -------- d-----w- C:\Ross-Tech
2013-02-04 18:46 . 2013-02-04 18:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-02-04 18:46 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-02-04 18:26 . 2013-02-04 18:26 -------- d-----w- c:\program files\trend micro
2013-02-04 18:26 . 2013-02-04 18:27 -------- d-----w- C:\rsit
2013-01-30 18:12 . 2010-08-25 04:00 290816 ----a-w- c:\windows\system32\CNMXLMAA.DLL
2013-01-30 17:56 . 2010-08-25 04:00 73216 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPPAA.DLL
2013-01-30 17:56 . 2010-08-25 04:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPDAA.DLL
2013-01-30 17:55 . 2013-01-30 17:55 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2013-01-30 17:54 . 2010-03-18 18:25 307200 ----a-w- c:\windows\system32\CNC280L.dll
2013-01-30 17:54 . 2010-03-18 16:12 114688 ----a-w- c:\windows\system32\CNC280I.dll
2013-01-30 17:54 . 2010-03-18 16:12 1335296 ----a-w- c:\windows\system32\CNC280C.dll
2013-01-30 17:54 . 2010-03-18 16:11 106496 ----a-w- c:\windows\system32\CNC280U.dll
2013-01-30 17:54 . 2008-08-25 17:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2013-01-30 17:53 . 2010-08-25 04:00 290816 ----a-w- c:\windows\system32\CNMLMAA.DLL
2013-01-30 17:53 . 2010-01-13 13:03 94208 ----a-w- c:\windows\system32\CNC280O.dll
2013-01-30 17:53 . 2010-03-11 07:56 180224 ----a-w- c:\windows\system32\CNMIUAA.DLL
2013-01-30 17:51 . 2013-01-30 17:57 -------- d-----w- c:\program files\Canon
2013-01-30 17:01 . 2012-06-09 18:21 178688 ----a-w- c:\windows\system32\unrar.dll
2013-01-30 17:01 . 2013-01-30 17:01 -------- d-----w- c:\program files\K-Lite Codec Pack
2013-01-30 16:55 . 2013-01-30 16:55 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-30 16:55 . 2013-01-30 16:55 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-28 18:51 . 2013-01-28 18:51 434176 ----a-w- c:\windows\system32\vbscript.dll
2013-01-28 18:51 . 2013-01-28 18:51 293376 ----a-w- c:\windows\system32\browserchoice.exe
2013-01-28 18:50 . 2013-01-28 18:50 321536 ----a-w- c:\windows\system32\WSDApi.dll
2013-01-28 18:50 . 2013-01-28 18:50 -------- d-----w- c:\program files\MSXML 4.0
2013-01-28 18:49 . 2013-01-28 18:49 750080 ----a-w- c:\windows\system32\qmgr.dll
2013-01-28 18:49 . 2013-01-28 18:49 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2013-01-28 12:37 . 2006-11-02 12:33 2565432 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll ERROR(0x00000005)
2013-01-28 12:36 . 2013-01-15 01:49 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{410C1A51-7690-4F64-8797-0945DFD6F2CA}\mpengine.dll ERROR(0x00000005)
2013-01-28 12:36 . 2012-05-31 10:25 237072 ------w- c:\windows\system32\MpSigStub.exe
2013-01-28 11:14 . 2013-02-09 19:32 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-01-28 09:51 . 2013-01-28 12:39 -------- d-----w- c:\program files\Google
2013-01-28 09:49 . 2013-01-28 09:49 -------- d-----w- c:\program files\Macrovision Corp
2013-01-28 09:49 . 2002-11-22 01:57 204800 ----a-w- c:\windows\system32\IVIresizeW7.dll
2013-01-28 09:49 . 2002-11-22 01:57 200704 ----a-w- c:\windows\system32\IVIresizeA6.dll
2013-01-28 09:49 . 2002-11-22 01:57 192512 ----a-w- c:\windows\system32\IVIresizeP6.dll
2013-01-28 09:49 . 2002-11-22 01:57 192512 ----a-w- c:\windows\system32\IVIresizeM6.dll
2013-01-28 09:49 . 2002-11-22 01:57 188416 ----a-w- c:\windows\system32\IVIresizePX.dll
2013-01-28 09:49 . 2002-11-22 01:57 20480 ----a-w- c:\windows\system32\IVIresize.dll
2013-01-28 09:46 . 2013-01-28 09:46 -------- d-----w- c:\program files\Common Files\InterVideo
2013-01-28 09:45 . 2013-01-28 09:48 -------- d-----w- c:\program files\InterVideo
2013-01-28 09:45 . 2001-09-05 03:18 77824 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2013-01-28 09:45 . 2001-09-05 03:18 225280 ----a-w- c:\program files\Common Files\InstallShield\IScript\IScript.dll
2013-01-28 09:45 . 2001-09-05 03:14 176128 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2013-01-28 09:45 . 2001-09-05 03:13 32768 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2013-01-28 09:45 . 2000-01-04 05:39 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2013-01-28 09:44 . 2013-02-05 09:40 -------- d-----w- c:\users\Michal
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-06 19:08 . 2013-01-28 11:14 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-11-02 1196032]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 4763008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 133912]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-05-08 331552]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 833072]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"IS CfgWiz"="c:\program files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2007-01-12 431752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-06-11 163840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-06-06 44168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2013-1-28 192512]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 07:04 49152 ----a-r- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - COMHOST
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 11:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-30 16:55]
.
2013-02-10 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task d280e873-eae6-4ee8-aa67-19ef32a8e1e7.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2013-02-10 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task e46647b9-1e67-4fbb-b210-9051592e8a42.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://adf.ly/IN27G
mStart Page = hxxp://www.hp.com
TCP: DhcpNameServer = 188.75.128.188 10.0.150.150
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\wfl572lz.default\
FF - prefs.js: browser.startup.homepage - hxxp://adf.ly/IN27G
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: browser.startup.homepage - hxxp://adf.ly/IN27G
FF - user.js: browser.startup.page - 1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-10 12:11
Windows 6.0.6000 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
Binary file raw_enum.dat matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Celkový čas: 2013-02-10 12:12:36
ComboFix-quarantined-files.txt 2013-02-10 11:12
.
Před spuštěním: Volných bajtů: 42 868 998 144
Po spuštění: Volných bajtů: 42 711 601 152
.
- - End Of File - - 0FCEB8B416DF8E0443F7D12049B10B31

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

Firefox::
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\wfl572lz.default\
FF - prefs.js: browser.startup.homepage - hxxp://adf.ly/IN27G
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: browser.startup.homepage - hxxp://adf.ly/IN27G
FF - user.js: browser.startup.page - 1

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[virusak]

Vyřešeno, díky moc

[Rudy]

Nemáte zač!