Pomalé PC.......

[Rudy]

Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[Georg.H]

zde je

ComboFix 13-07-12.01 - Georg Hanke 12.07.2013 20:21:40.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.176 [GMT 2:00]
Spuštěný z: c:\documents and settings\Georg Hanke\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Georg Hanke\sqlite3.dll
c:\windows\msmqinst.log
c:\windows\system32\Cache
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-12 do 2013-07-12 )))))))))))))))))))))))))))))))
.
.
2013-07-12 18:10 . 2013-07-12 18:10 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{C37CF5E5-015C-4802-B03C-85726820B620}\MpKsl55b8ccf6.sys
2013-07-12 18:10 . 2013-07-12 18:10 -------- d-----w- c:\documents and settings\All Users\Oblíbené položky
2013-07-12 10:04 . 2013-07-12 10:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TEMP
2013-07-12 09:54 . 2013-07-12 09:54 60872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{C37CF5E5-015C-4802-B03C-85726820B620}\offreg.dll
2013-07-12 09:54 . 2013-07-12 09:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\StarApp
2013-07-12 09:53 . 2013-07-12 10:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SearchNewTab
2013-07-12 09:53 . 2013-07-12 09:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\BetterSoft
2013-07-12 09:52 . 2013-07-12 10:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\saaffee- syaove
2013-07-12 09:52 . 2013-07-12 10:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2013-07-12 06:51 . 2013-06-12 04:18 7068072 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{C37CF5E5-015C-4802-B03C-85726820B620}\mpengine.dll
2013-07-10 15:01 . 2013-06-12 04:18 7068072 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-05 22:49 . 2013-07-05 22:49 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\MSI
2013-07-05 22:40 . 2013-07-05 22:40 -------- d-----w- c:\program files\ICQ7.7
2013-07-05 22:36 . 2013-07-06 08:17 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\ICQM
2013-07-05 22:36 . 2013-07-06 08:13 -------- d-----w- c:\program files\ICQM
2013-07-05 22:25 . 2013-07-06 08:25 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\ICQ-Profile
2013-07-05 19:01 . 2006-12-20 19:05 520192 ------w- c:\windows\system32\ati2sgag.exe
2013-07-05 19:01 . 2006-12-17 02:41 307200 ----a-r- c:\windows\system32\atiiiexx.dll
2013-07-05 19:00 . 2013-07-05 19:01 -------- d-----w- c:\program files\ATI Technologies
2013-07-05 18:59 . 2006-12-20 19:05 77824 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2013-07-05 18:59 . 2006-12-20 19:05 32768 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2013-07-05 18:59 . 2006-12-20 19:05 221184 ------w- c:\program files\Common Files\InstallShield\IScript\IScript.dll
2013-07-05 18:59 . 2006-12-20 19:05 221184 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2013-07-05 18:59 . 2006-12-20 19:05 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2013-07-05 08:53 . 2013-07-05 08:53 -------- d-----w- c:\program files\T-Mobile
2013-07-04 14:59 . 2013-07-04 14:59 -------- d-----w- c:\program files\Setup Files
2013-07-04 14:39 . 2013-07-04 14:39 -------- d-----w- c:\program files\Intel
2013-07-04 14:39 . 2010-06-17 10:02 53248 ----a-w- c:\windows\system32\CSVer.dll
2013-07-04 14:39 . 2013-07-04 14:39 -------- d-----w- C:\Intel
2013-07-04 14:37 . 2010-09-23 13:46 102416 ----a-w- c:\windows\system32\RTNUninst32.dll
2013-07-04 14:34 . 2009-03-03 18:18 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2013-07-04 14:27 . 2010-11-03 16:15 359016 ----a-w- c:\windows\vncutil.exe
2013-07-04 14:27 . 2013-05-24 15:40 84552 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll
2013-07-04 14:27 . 2011-11-22 14:28 11368 ----a-w- c:\windows\system32\RtkCoLDRXP.dll
2013-07-04 14:27 . 2010-11-03 16:14 129640 ----a-w- c:\windows\RtkAudioService.exe
2013-07-04 14:27 . 2012-06-22 13:48 25816 ----a-w- c:\windows\system32\drivers\RTAIODAT.DAT
2013-07-04 14:27 . 2009-11-18 05:17 1395800 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2013-07-04 14:27 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2013-07-04 14:25 . 2013-07-04 14:25 -------- d-----w- C:\SuperChargerProfile
2013-07-04 14:21 . 2013-07-04 14:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Trend Micro
2013-07-04 14:21 . 2013-07-04 14:21 -------- d-----w- c:\program files\Trend Micro SafeSync
2013-07-04 14:10 . 2012-08-22 08:19 11832 ----a-w- c:\windows\acpimof.dll
2013-07-04 14:09 . 2013-07-04 14:25 -------- d-----w- c:\program files\MSI
2013-07-04 13:56 . 2013-07-04 13:56 -------- d-----w- c:\program files\Lavalys
2013-07-02 15:14 . 2013-07-02 15:14 -------- d-----w- c:\program files\AGEIA Technologies
2013-07-02 15:13 . 2013-06-21 09:56 253952 ----a-w- c:\windows\system32\nvrsth.dll
2013-07-02 15:11 . 2013-06-21 12:02 893728 ----a-w- c:\windows\system32\nvdispgenco3232049.dll
2013-07-02 15:11 . 2013-06-21 12:02 1024288 ----a-w- c:\windows\system32\nvdispco3232049.dll
2013-07-02 14:55 . 2013-07-02 14:55 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\NVIDIA
2013-06-27 18:30 . 2013-06-27 18:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DriverGenius
2013-06-27 18:16 . 2013-06-27 18:16 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-06-27 18:16 . 2013-06-27 18:16 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\eSupport.com
2013-06-27 18:12 . 2013-06-27 18:12 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\Babylon
2013-06-27 18:12 . 2013-06-27 18:12 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Babylon
2013-06-21 20:29 . 2013-06-21 20:29 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\Samsung
2013-06-21 20:29 . 2013-06-21 20:29 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\Samsung
2013-06-21 20:25 . 2013-05-02 04:23 130248 ----a-w- c:\windows\system32\drivers\ssadserd.sys
2013-06-21 20:25 . 2013-05-02 04:23 17864 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys
2013-06-21 20:25 . 2013-05-02 04:23 15560 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys
2013-06-21 20:25 . 2013-05-02 04:23 15560 ----a-w- c:\windows\system32\drivers\ssadcm.sys
2013-06-21 20:25 . 2013-05-02 04:23 153672 ----a-w- c:\windows\system32\drivers\ssadmdm.sys
2013-06-21 20:25 . 2013-05-02 04:23 15304 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys
2013-06-21 20:25 . 2013-05-02 04:23 15304 ----a-w- c:\windows\system32\drivers\ssadwh.sys
2013-06-21 20:25 . 2013-05-02 04:23 136904 ----a-w- c:\windows\system32\drivers\ssadbus.sys
2013-06-21 20:22 . 2013-06-21 20:22 -------- d-----w- c:\program files\MyFree Codec
2013-06-21 20:04 . 2013-05-22 18:33 4659712 ----a-w- c:\windows\system32\Redemption.dll
2013-06-21 20:03 . 2013-05-22 18:43 821824 ----a-w- c:\windows\system32\dgderapi.dll
2013-06-21 20:03 . 2013-05-22 18:43 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2013-06-21 20:03 . 2013-05-22 18:43 20032 ----a-w- c:\windows\system32\drivers\dgderdrv.sys
2013-06-21 20:01 . 2013-06-21 20:24 -------- d-----w- c:\program files\Samsung
2013-06-21 20:01 . 2013-06-21 20:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Samsung
2013-06-21 19:50 . 2013-06-21 19:50 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\Downloaded Installations
2013-06-19 21:11 . 2013-06-19 21:11 -------- d-----w- c:\program files\MSXML 4.0
2013-06-19 21:11 . 2013-06-19 21:11 73728 ----a-r- c:\documents and settings\Georg Hanke\Data aplikací\Microsoft\Installer\{7130468A-F53F-4698-8C09-A339EA3B05E6}\NewShortcut47_74B9CE5DF1F4447F982DCA29A461B529.exe
2013-06-19 20:33 . 2013-06-19 20:35 -------- d-----w- c:\program files\DIFX
2013-06-19 20:32 . 2012-01-09 15:28 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2013-06-19 20:32 . 2012-01-09 15:28 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2013-06-19 20:32 . 2012-01-09 15:28 23168 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2013-06-19 20:32 . 2012-01-09 15:28 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll
2013-06-19 20:32 . 2012-01-09 15:28 605696 ----a-w- c:\windows\system32\nmwcdcocls.dll
2013-06-19 20:32 . 2012-01-09 15:28 18176 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2013-06-19 20:32 . 2012-01-09 15:28 123904 ----a-w- c:\windows\system32\ccdcmbwu.dll
2013-06-19 20:32 . 2012-01-09 15:28 75264 ----a-w- c:\windows\system32\nmwcdcls.dll
2013-06-19 20:32 . 2013-06-19 21:11 -------- d-----w- c:\program files\Nokia
2013-06-19 20:30 . 2013-06-19 21:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Installations
2013-06-12 19:49 . 2013-06-13 19:36 -------- d-----w- c:\program files\trend micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-21 12:02 . 2013-06-04 11:56 57344 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 12:02 . 2013-06-04 11:55 7663616 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:02 . 2013-06-04 11:55 6320128 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:02 . 2013-06-04 11:55 2783008 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:02 . 2013-06-04 11:55 2002720 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:02 . 2013-06-04 11:55 17551360 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:02 . 2007-06-28 16:43 4014592 ----a-w- c:\windows\system32\nv4_disp.dll
2013-06-21 12:02 . 2007-06-28 16:43 2548736 ----a-w- c:\windows\system32\nvapi.dll
2013-06-21 12:02 . 2007-06-28 16:43 20197376 ----a-w- c:\windows\system32\nvoglnt.dll
2013-06-21 12:02 . 2007-06-28 16:43 10973504 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2013-06-21 09:56 . 2007-06-28 16:43 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2013-06-21 09:56 . 2007-06-28 16:43 126976 ----a-w- c:\windows\system32\nvrszht.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrspt.dll
2013-06-21 09:56 . 2007-06-28 16:43 270336 ----a-w- c:\windows\system32\nvrsru.dll
2013-06-21 09:56 . 2007-06-28 16:43 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrstr.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrssl.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrssk.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrssv.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrsit.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsja.dll
2013-06-21 09:56 . 2007-06-28 16:43 266240 ----a-w- c:\windows\system32\nvrsko.dll
2013-06-21 09:56 . 2007-06-28 16:43 262144 ----a-w- c:\windows\system32\nvrshu.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrspl.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrsno.dll
2013-06-21 09:56 . 2007-06-28 16:43 335872 ----a-w- c:\windows\system32\nvrshe.dll
2013-06-21 09:56 . 2007-06-28 16:43 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrses.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2013-06-21 09:56 . 2007-06-28 16:43 335872 ----a-w- c:\windows\system32\nvrsar.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrsel.dll
2013-06-21 09:56 . 2007-06-28 16:43 278528 ----a-w- c:\windows\system32\nvrsde.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrsda.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrseng.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrscs.dll
2013-06-21 09:54 . 2007-06-28 16:43 54272 ----a-w- c:\windows\system32\nvwddi.dll
2013-06-21 09:54 . 2007-06-28 16:43 156960 ----a-w- c:\windows\system32\nvsvc32.exe
2013-06-21 09:54 . 2007-06-28 16:43 15677728 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 09:54 . 2007-06-28 16:43 223008 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 09:54 . 2007-06-28 16:43 144160 ----a-w- c:\windows\system32\nvcolor.exe
2013-05-28 20:37 . 2013-03-30 16:47 5453896 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2013-05-22 18:43 . 2013-05-22 18:43 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2013-05-22 18:43 . 2013-05-22 18:43 30568 ----a-w- c:\windows\MusiccityDownload.exe
2013-05-22 18:43 . 2013-05-22 18:43 330240 ----a-w- c:\windows\MASetupCaller.dll
2013-05-22 18:43 . 2013-05-22 18:43 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2013-05-22 18:43 . 2013-05-22 18:43 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 569344 ----a-w- c:\windows\system32\muzdecode.ax
2013-05-22 18:43 . 2013-05-22 18:43 491520 ----a-w- c:\windows\system32\muzapp.dll
2013-05-22 18:43 . 2013-05-22 18:43 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2013-05-22 18:43 . 2013-05-22 18:43 45320 ----a-w- c:\windows\system32\MAMACExtract.dll
2013-05-22 18:43 . 2013-05-22 18:43 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2013-05-22 18:43 . 2013-05-22 18:43 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2013-05-22 18:43 . 2013-05-22 18:43 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2013-05-22 18:43 . 2013-05-22 18:43 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2013-05-22 18:43 . 2013-05-22 18:43 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2013-05-22 18:43 . 2013-05-22 18:43 245760 ----a-w- c:\windows\system32\MSCLib.dll
2013-05-22 18:43 . 2013-05-22 18:43 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2013-05-22 18:43 . 2013-05-22 18:43 200704 ----a-w- c:\windows\system32\muzwmts.dll
2013-05-22 18:43 . 2013-05-22 18:43 172032 ----a-w- c:\windows\system32\muzapp.exe
2013-05-22 18:43 . 2013-05-22 18:43 155648 ----a-w- c:\windows\system32\MSFLib.dll
2013-05-22 18:43 . 2013-05-22 18:43 143360 ----a-w- c:\windows\system32\3DAudio.ax
2013-05-22 18:43 . 2013-05-22 18:43 135168 ----a-w- c:\windows\system32\muzaf1.dll
2013-05-22 18:43 . 2013-05-22 18:43 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2013-05-22 18:43 . 2013-05-22 18:43 122880 ----a-w- c:\windows\system32\muzeffect.ax
2013-05-22 18:43 . 2013-05-22 18:43 118784 ----a-w- c:\windows\system32\MaDRM.dll
2013-05-22 18:43 . 2013-05-22 18:43 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2013-05-12 21:37 . 2013-06-04 11:55 893728 ----a-w- c:\windows\system32\nvdispgenco3232018.dll
2013-05-12 21:37 . 2013-06-04 11:55 1024288 ----a-w- c:\windows\system32\nvdispco3232018.dll
2013-05-02 15:28 . 2013-03-30 16:37 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-19 16:50 . 2013-04-19 11:39 87608 ----a-w- c:\documents and settings\Georg Hanke\Data aplikací\inst.exe
2013-04-19 16:50 . 2013-04-19 11:39 47360 ----a-w- c:\documents and settings\Georg Hanke\Data aplikací\pcouffin.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-10-19 06:35 . A825F4181AEC077D8DCA1053DC015265 . 1542656 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-10-19 . 12A799AD9415AE9C8ABCC5F75E9CF034 . 557056 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[-] 2008-10-19 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
.
[-] 2008-10-19 . DD7E25E20AEBD672DAE7E1D911C2D824 . 1589760 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-14 . C2DCB09A1EA98F248DD9A5DE195B3DF3 . 277504 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2008-10-19 . 0AB43CE7EFFAD6B4914AE3C1B489AAA1 . 66560 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2008-11-05 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{0D609ABE-0EF3-DC49-A34E-37502DB9F6EF}]
2013-07-12 09:52 118784 ----a-w- c:\documents and settings\All Users\Data aplikací\saaffee- syaove\51dfd1e64a2a9.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoPaired]
@="{A203F945-39E9-4286-AFA2-F3ADFCD5FAAA}"
[HKEY_CLASSES_ROOT\CLSID\{A203F945-39E9-4286-AFA2-F3ADFCD5FAAA}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoPriority]
@="{6F1BB626-1107-4b82-B322-54C5E64461B8}"
[HKEY_CLASSES_ROOT\CLSID\{6F1BB626-1107-4b82-B322-54C5E64461B8}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoProblem]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2B}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2B}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{66669544-5639-4922-99C8-CE7A86651364}"
[HKEY_CLASSES_ROOT\CLSID\{66669544-5639-4922-99C8-CE7A86651364}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-03 19603048]
"CrystalDiskInfo"="c:\program files\CrystalDiskInfo\DiskInfoS.exe" [2013-04-24 5998080]
"Postimage"="c:\program files\Postimage\postimage.exe" [2013-04-04 11884032]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2012-06-26 1516632]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-05-23 1561968]
"T-Mobile Communication Centre"="c:\program files\T-Mobile\Web'n'walk Manager\Manager.exe" [2012-08-22 1368768]
"icq"="c:\documents and settings\Georg Hanke\Data aplikací\ICQM\icq.exe" [2013-07-06 28698984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvIcon"="c:\program files\Vista Components\Vista Drive Icon\DrvIcon.exe" [2007-07-04 45056]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]
"NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2012-02-28 190768]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-05-23 311152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2013-06-21 15677728]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2013-06-21 223008]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-06-21 2586912]
"Live Update 5"="c:\program files\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]
"Super-Charger"="c:\program files\MSI\Super-Charger\Super-Charger.exe" [2013-03-08 506864]
"RTHDCPL"="RTHDCPL.EXE" [2013-04-02 20143176]
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 12:56 64512 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Postimage]
2013-04-04 19:46 11884032 ----a-w- c:\program files\Postimage\postimage.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Java\\jre7\\bin\\java.exe"=
"c:\\Documents and Settings\\Georg Hanke\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.7\\ICQ.exe"=
"c:\\Documents and Settings\\Georg Hanke\\Data aplikací\\ICQM\\icq.exe"=
.
R1 MpKsl55b8ccf6;MpKsl55b8ccf6;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{C37CF5E5-015C-4802-B03C-85726820B620}\MpKsl55b8ccf6.sys [12.7.2013 20:10 29904]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [22.8.2012 16:59 123320]
R2 MSI_SuperCharger;MSI_SuperCharger;c:\program files\MSI\Super-Charger\ChargeService.exe [4.7.2013 16:25 161264]
R3 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files\MSI\Super-Charger\NTIOLib.sys [4.7.2013 16:25 14392]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\MSI\Live Update 5\NTIOLib.sys [4.7.2013 16:09 7680]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [3.6.2013 16:21 162408]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\GEORGH~1\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\GEORGH~1\LOCALS~1\Temp\ALSysIO.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4.7.2013 16:27 1691480]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [27.6.2013 20:16 23456]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys --> c:\windows\system32\DRIVERS\ew_hwusbdev.sys [?]
S3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys --> c:\windows\system32\DRIVERS\ew_jucdcacm.sys [?]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys --> c:\windows\system32\DRIVERS\ew_jubusenum.sys [?]
S3 OnlineStorageService;OnlineStorageService;c:\program files\Trend Micro SafeSync\hrfscore.exe [4.7.2013 16:21 3947320]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [21.6.2013 22:25 136904]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [21.6.2013 22:25 17864]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [21.6.2013 22:25 153672]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [21.6.2013 22:25 130248]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - GUSVC
*NewlyCreated* - MPKSL55B8CCF6
*NewlyCreated* - NTIOLIB_1_0_3
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-11 14:37 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.71\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2009-03-08 02:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-19 17:18]
.
2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-19 17:18]
.
2013-07-12 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 10:11]
.
2013-07-12 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 10:11]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntr ... 2&tsp=4926
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 193.179.143.3 193.179.143.5
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-12 20:30
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
CrystalDiskInfo = "c:\program files\CrystalDiskInfo\DiskInfoS.exe" /Startup?\
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(816)
c:\windows\system32\setupapi.dll
.
Celkový čas: 2013-07-12 20:32:53
ComboFix-quarantined-files.txt 2013-07-12 18:32
.
Před spuštěním: Volných bajtů: 16 435 195 904
Po spuštění: Volných bajtů: 16 714 018 816
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 266520624BE37E60D0EE20C99EAC4812
413FC2A0C716421B3158746D63736515

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\documents and settings\All Users\Data aplikací\saaffee- syaove

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{0D609ABE-0EF3-DC49-A34E-37502DB9F6EF}]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[Georg.H]

ComboFix 13-07-12.01 - Georg Hanke 12.07.2013 21:13:14.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.76 [GMT 2:00]
Spuštěný z: c:\documents and settings\Georg Hanke\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Georg Hanke\Plocha\CFScript.txt..txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-12 do 2013-07-12 )))))))))))))))))))))))))))))))
.
.
2013-07-12 18:33 . 2013-06-12 04:18 7068072 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{EBA53F4B-86C1-4303-857B-3944903CD47E}\mpengine.dll
2013-07-12 18:10 . 2013-07-12 18:10 -------- d-----w- c:\documents and settings\All Users\Oblíbené položky
2013-07-12 10:04 . 2013-07-12 10:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TEMP
2013-07-12 09:54 . 2013-07-12 09:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\StarApp
2013-07-12 09:53 . 2013-07-12 10:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SearchNewTab
2013-07-12 09:52 . 2013-07-12 18:46 -------- d-----w- c:\documents and settings\All Users\Data aplikací\saaffee- syaove
2013-07-12 09:52 . 2013-07-12 10:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2013-07-10 15:01 . 2013-06-12 04:18 7068072 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-05 22:49 . 2013-07-05 22:49 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\MSI
2013-07-05 22:40 . 2013-07-05 22:40 -------- d-----w- c:\program files\ICQ7.7
2013-07-05 22:36 . 2013-07-06 08:17 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\ICQM
2013-07-05 22:36 . 2013-07-06 08:13 -------- d-----w- c:\program files\ICQM
2013-07-05 22:25 . 2013-07-06 08:25 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\ICQ-Profile
2013-07-05 19:01 . 2006-12-20 19:05 520192 ------w- c:\windows\system32\ati2sgag.exe
2013-07-05 19:01 . 2006-12-17 02:41 307200 ----a-r- c:\windows\system32\atiiiexx.dll
2013-07-05 19:00 . 2013-07-05 19:01 -------- d-----w- c:\program files\ATI Technologies
2013-07-05 18:59 . 2006-12-20 19:05 77824 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2013-07-05 18:59 . 2006-12-20 19:05 32768 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2013-07-05 18:59 . 2006-12-20 19:05 221184 ------w- c:\program files\Common Files\InstallShield\IScript\IScript.dll
2013-07-05 18:59 . 2006-12-20 19:05 221184 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2013-07-05 18:59 . 2006-12-20 19:05 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2013-07-05 08:53 . 2013-07-05 08:53 -------- d-----w- c:\program files\T-Mobile
2013-07-04 14:59 . 2013-07-04 14:59 -------- d-----w- c:\program files\Setup Files
2013-07-04 14:39 . 2013-07-04 14:39 -------- d-----w- c:\program files\Intel
2013-07-04 14:39 . 2010-06-17 10:02 53248 ----a-w- c:\windows\system32\CSVer.dll
2013-07-04 14:39 . 2013-07-04 14:39 -------- d-----w- C:\Intel
2013-07-04 14:37 . 2010-09-23 13:46 102416 ----a-w- c:\windows\system32\RTNUninst32.dll
2013-07-04 14:34 . 2009-03-03 18:18 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2013-07-04 14:27 . 2010-11-03 16:15 359016 ----a-w- c:\windows\vncutil.exe
2013-07-04 14:27 . 2013-05-24 15:40 84552 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll
2013-07-04 14:27 . 2011-11-22 14:28 11368 ----a-w- c:\windows\system32\RtkCoLDRXP.dll
2013-07-04 14:27 . 2010-11-03 16:14 129640 ----a-w- c:\windows\RtkAudioService.exe
2013-07-04 14:27 . 2012-06-22 13:48 25816 ----a-w- c:\windows\system32\drivers\RTAIODAT.DAT
2013-07-04 14:27 . 2009-11-18 05:17 1395800 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2013-07-04 14:27 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2013-07-04 14:25 . 2013-07-04 14:25 -------- d-----w- C:\SuperChargerProfile
2013-07-04 14:21 . 2013-07-04 14:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Trend Micro
2013-07-04 14:21 . 2013-07-04 14:21 -------- d-----w- c:\program files\Trend Micro SafeSync
2013-07-04 14:10 . 2012-08-22 08:19 11832 ----a-w- c:\windows\acpimof.dll
2013-07-04 14:09 . 2013-07-04 14:25 -------- d-----w- c:\program files\MSI
2013-07-04 13:56 . 2013-07-04 13:56 -------- d-----w- c:\program files\Lavalys
2013-07-02 15:14 . 2013-07-02 15:14 -------- d-----w- c:\program files\AGEIA Technologies
2013-07-02 15:13 . 2013-06-21 09:56 253952 ----a-w- c:\windows\system32\nvrsth.dll
2013-07-02 15:11 . 2013-06-21 12:02 893728 ----a-w- c:\windows\system32\nvdispgenco3232049.dll
2013-07-02 15:11 . 2013-06-21 12:02 1024288 ----a-w- c:\windows\system32\nvdispco3232049.dll
2013-07-02 14:55 . 2013-07-02 14:55 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\NVIDIA
2013-06-27 18:30 . 2013-06-27 18:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DriverGenius
2013-06-27 18:16 . 2013-06-27 18:16 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-06-27 18:16 . 2013-06-27 18:16 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\eSupport.com
2013-06-27 18:12 . 2013-06-27 18:12 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\Babylon
2013-06-27 18:12 . 2013-06-27 18:12 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Babylon
2013-06-21 20:29 . 2013-06-21 20:29 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\Samsung
2013-06-21 20:29 . 2013-06-21 20:29 -------- d-----w- c:\documents and settings\Georg Hanke\Data aplikací\Samsung
2013-06-21 20:25 . 2013-05-02 04:23 130248 ----a-w- c:\windows\system32\drivers\ssadserd.sys
2013-06-21 20:25 . 2013-05-02 04:23 17864 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys
2013-06-21 20:25 . 2013-05-02 04:23 15560 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys
2013-06-21 20:25 . 2013-05-02 04:23 15560 ----a-w- c:\windows\system32\drivers\ssadcm.sys
2013-06-21 20:25 . 2013-05-02 04:23 153672 ----a-w- c:\windows\system32\drivers\ssadmdm.sys
2013-06-21 20:25 . 2013-05-02 04:23 15304 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys
2013-06-21 20:25 . 2013-05-02 04:23 15304 ----a-w- c:\windows\system32\drivers\ssadwh.sys
2013-06-21 20:25 . 2013-05-02 04:23 136904 ----a-w- c:\windows\system32\drivers\ssadbus.sys
2013-06-21 20:22 . 2013-06-21 20:22 -------- d-----w- c:\program files\MyFree Codec
2013-06-21 20:04 . 2013-05-22 18:33 4659712 ----a-w- c:\windows\system32\Redemption.dll
2013-06-21 20:03 . 2013-05-22 18:43 821824 ----a-w- c:\windows\system32\dgderapi.dll
2013-06-21 20:03 . 2013-05-22 18:43 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2013-06-21 20:03 . 2013-05-22 18:43 20032 ----a-w- c:\windows\system32\drivers\dgderdrv.sys
2013-06-21 20:01 . 2013-06-21 20:24 -------- d-----w- c:\program files\Samsung
2013-06-21 20:01 . 2013-06-21 20:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Samsung
2013-06-21 19:50 . 2013-06-21 19:50 -------- d-----w- c:\documents and settings\Georg Hanke\Local Settings\Data aplikací\Downloaded Installations
2013-06-19 21:11 . 2013-06-19 21:11 -------- d-----w- c:\program files\MSXML 4.0
2013-06-19 21:11 . 2013-06-19 21:11 73728 ----a-r- c:\documents and settings\Georg Hanke\Data aplikací\Microsoft\Installer\{7130468A-F53F-4698-8C09-A339EA3B05E6}\NewShortcut47_74B9CE5DF1F4447F982DCA29A461B529.exe
2013-06-19 20:33 . 2013-06-19 20:35 -------- d-----w- c:\program files\DIFX
2013-06-19 20:32 . 2012-01-09 15:28 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2013-06-19 20:32 . 2012-01-09 15:28 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2013-06-19 20:32 . 2012-01-09 15:28 23168 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2013-06-19 20:32 . 2012-01-09 15:28 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll
2013-06-19 20:32 . 2012-01-09 15:28 605696 ----a-w- c:\windows\system32\nmwcdcocls.dll
2013-06-19 20:32 . 2012-01-09 15:28 18176 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2013-06-19 20:32 . 2012-01-09 15:28 123904 ----a-w- c:\windows\system32\ccdcmbwu.dll
2013-06-19 20:32 . 2012-01-09 15:28 75264 ----a-w- c:\windows\system32\nmwcdcls.dll
2013-06-19 20:32 . 2013-06-19 21:11 -------- d-----w- c:\program files\Nokia
2013-06-19 20:30 . 2013-06-19 21:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Installations
2013-06-12 19:49 . 2013-06-13 19:36 -------- d-----w- c:\program files\trend micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-21 12:02 . 2013-06-04 11:56 57344 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 12:02 . 2013-06-04 11:55 7663616 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:02 . 2013-06-04 11:55 6320128 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:02 . 2013-06-04 11:55 2783008 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:02 . 2013-06-04 11:55 2002720 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:02 . 2013-06-04 11:55 17551360 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:02 . 2007-06-28 16:43 4014592 ----a-w- c:\windows\system32\nv4_disp.dll
2013-06-21 12:02 . 2007-06-28 16:43 2548736 ----a-w- c:\windows\system32\nvapi.dll
2013-06-21 12:02 . 2007-06-28 16:43 20197376 ----a-w- c:\windows\system32\nvoglnt.dll
2013-06-21 12:02 . 2007-06-28 16:43 10973504 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2013-06-21 09:56 . 2007-06-28 16:43 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2013-06-21 09:56 . 2007-06-28 16:43 126976 ----a-w- c:\windows\system32\nvrszht.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrspt.dll
2013-06-21 09:56 . 2007-06-28 16:43 270336 ----a-w- c:\windows\system32\nvrsru.dll
2013-06-21 09:56 . 2007-06-28 16:43 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrstr.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrssl.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrssk.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrssv.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrsit.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsja.dll
2013-06-21 09:56 . 2007-06-28 16:43 266240 ----a-w- c:\windows\system32\nvrsko.dll
2013-06-21 09:56 . 2007-06-28 16:43 262144 ----a-w- c:\windows\system32\nvrshu.dll
2013-06-21 09:56 . 2007-06-28 16:43 258048 ----a-w- c:\windows\system32\nvrspl.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrsno.dll
2013-06-21 09:56 . 2007-06-28 16:43 335872 ----a-w- c:\windows\system32\nvrshe.dll
2013-06-21 09:56 . 2007-06-28 16:43 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrses.dll
2013-06-21 09:56 . 2007-06-28 16:43 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2013-06-21 09:56 . 2007-06-28 16:43 335872 ----a-w- c:\windows\system32\nvrsar.dll
2013-06-21 09:56 . 2007-06-28 16:43 282624 ----a-w- c:\windows\system32\nvrsel.dll
2013-06-21 09:56 . 2007-06-28 16:43 278528 ----a-w- c:\windows\system32\nvrsde.dll
2013-06-21 09:56 . 2007-06-28 16:43 253952 ----a-w- c:\windows\system32\nvrsda.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrseng.dll
2013-06-21 09:56 . 2007-06-28 16:43 249856 ----a-w- c:\windows\system32\nvrscs.dll
2013-06-21 09:54 . 2007-06-28 16:43 54272 ----a-w- c:\windows\system32\nvwddi.dll
2013-06-21 09:54 . 2007-06-28 16:43 156960 ----a-w- c:\windows\system32\nvsvc32.exe
2013-06-21 09:54 . 2007-06-28 16:43 15677728 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 09:54 . 2007-06-28 16:43 223008 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 09:54 . 2007-06-28 16:43 144160 ----a-w- c:\windows\system32\nvcolor.exe
2013-05-28 20:37 . 2013-03-30 16:47 5453896 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2013-05-22 18:43 . 2013-05-22 18:43 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2013-05-22 18:43 . 2013-05-22 18:43 30568 ----a-w- c:\windows\MusiccityDownload.exe
2013-05-22 18:43 . 2013-05-22 18:43 330240 ----a-w- c:\windows\MASetupCaller.dll
2013-05-22 18:43 . 2013-05-22 18:43 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2013-05-22 18:43 . 2013-05-22 18:43 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2013-05-22 18:43 . 2013-05-22 18:43 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2013-05-22 18:43 . 2013-05-22 18:43 569344 ----a-w- c:\windows\system32\muzdecode.ax
2013-05-22 18:43 . 2013-05-22 18:43 491520 ----a-w- c:\windows\system32\muzapp.dll
2013-05-22 18:43 . 2013-05-22 18:43 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2013-05-22 18:43 . 2013-05-22 18:43 45320 ----a-w- c:\windows\system32\MAMACExtract.dll
2013-05-22 18:43 . 2013-05-22 18:43 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2013-05-22 18:43 . 2013-05-22 18:43 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2013-05-22 18:43 . 2013-05-22 18:43 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2013-05-22 18:43 . 2013-05-22 18:43 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2013-05-22 18:43 . 2013-05-22 18:43 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2013-05-22 18:43 . 2013-05-22 18:43 245760 ----a-w- c:\windows\system32\MSCLib.dll
2013-05-22 18:43 . 2013-05-22 18:43 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2013-05-22 18:43 . 2013-05-22 18:43 200704 ----a-w- c:\windows\system32\muzwmts.dll
2013-05-22 18:43 . 2013-05-22 18:43 172032 ----a-w- c:\windows\system32\muzapp.exe
2013-05-22 18:43 . 2013-05-22 18:43 155648 ----a-w- c:\windows\system32\MSFLib.dll
2013-05-22 18:43 . 2013-05-22 18:43 143360 ----a-w- c:\windows\system32\3DAudio.ax
2013-05-22 18:43 . 2013-05-22 18:43 135168 ----a-w- c:\windows\system32\muzaf1.dll
2013-05-22 18:43 . 2013-05-22 18:43 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2013-05-22 18:43 . 2013-05-22 18:43 122880 ----a-w- c:\windows\system32\muzeffect.ax
2013-05-22 18:43 . 2013-05-22 18:43 118784 ----a-w- c:\windows\system32\MaDRM.dll
2013-05-22 18:43 . 2013-05-22 18:43 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2013-05-12 21:37 . 2013-06-04 11:55 893728 ----a-w- c:\windows\system32\nvdispgenco3232018.dll
2013-05-12 21:37 . 2013-06-04 11:55 1024288 ----a-w- c:\windows\system32\nvdispco3232018.dll
2013-05-02 15:28 . 2013-03-30 16:37 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-19 16:50 . 2013-04-19 11:39 87608 ----a-w- c:\documents and settings\Georg Hanke\Data aplikací\inst.exe
2013-04-19 16:50 . 2013-04-19 11:39 47360 ----a-w- c:\documents and settings\Georg Hanke\Data aplikací\pcouffin.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-10-19 06:35 . A825F4181AEC077D8DCA1053DC015265 . 1542656 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-10-19 . 12A799AD9415AE9C8ABCC5F75E9CF034 . 557056 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[-] 2008-10-19 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
.
[-] 2008-10-19 . DD7E25E20AEBD672DAE7E1D911C2D824 . 1589760 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-14 . C2DCB09A1EA98F248DD9A5DE195B3DF3 . 277504 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2008-10-19 . 0AB43CE7EFFAD6B4914AE3C1B489AAA1 . 66560 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2008-11-05 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoPaired]
@="{A203F945-39E9-4286-AFA2-F3ADFCD5FAAA}"
[HKEY_CLASSES_ROOT\CLSID\{A203F945-39E9-4286-AFA2-F3ADFCD5FAAA}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoPriority]
@="{6F1BB626-1107-4b82-B322-54C5E64461B8}"
[HKEY_CLASSES_ROOT\CLSID\{6F1BB626-1107-4b82-B322-54C5E64461B8}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoProblem]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2B}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2B}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSynced]
@="{7479C9AF-DA81-4944-92E5-23E49390BB2A}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB2A}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoSyncing]
@="{7479C9AF-DA81-4944-92E5-23E49390BB29}"
[HKEY_CLASSES_ROOT\CLSID\{7479C9AF-DA81-4944-92E5-23E49390BB29}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00HumyoUnavailable]
@="{66669544-5639-4922-99C8-CE7A86651364}"
[HKEY_CLASSES_ROOT\CLSID\{66669544-5639-4922-99C8-CE7A86651364}]
2012-07-12 11:22 1186616 ----a-w- c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-03 19603048]
"CrystalDiskInfo"="c:\program files\CrystalDiskInfo\DiskInfoS.exe" [2013-04-24 5998080]
"Postimage"="c:\program files\Postimage\postimage.exe" [2013-04-04 11884032]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2012-06-26 1516632]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-05-23 1561968]
"T-Mobile Communication Centre"="c:\program files\T-Mobile\Web'n'walk Manager\Manager.exe" [2012-08-22 1368768]
"icq"="c:\documents and settings\Georg Hanke\Data aplikací\ICQM\icq.exe" [2013-07-06 28698984]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-10-19 66560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvIcon"="c:\program files\Vista Components\Vista Drive Icon\DrvIcon.exe" [2007-07-04 45056]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]
"NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2012-02-28 190768]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-05-23 311152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2013-06-21 15677728]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2013-06-21 223008]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-06-21 2586912]
"Live Update 5"="c:\program files\MSI\Live Update 5\BootStartLiveupdate.exe" [2012-01-30 315392]
"Super-Charger"="c:\program files\MSI\Super-Charger\Super-Charger.exe" [2013-03-08 506864]
"RTHDCPL"="RTHDCPL.EXE" [2013-04-02 20143176]
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 12:56 64512 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Postimage]
2013-04-04 19:46 11884032 ----a-w- c:\program files\Postimage\postimage.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Java\\jre7\\bin\\java.exe"=
"c:\\Documents and Settings\\Georg Hanke\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.7\\ICQ.exe"=
"c:\\Documents and Settings\\Georg Hanke\\Data aplikací\\ICQM\\icq.exe"=
.
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [22.8.2012 16:59 123320]
R2 MSI_SuperCharger;MSI_SuperCharger;c:\program files\MSI\Super-Charger\ChargeService.exe [4.7.2013 16:25 161264]
R3 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files\MSI\Super-Charger\NTIOLib.sys [4.7.2013 16:25 14392]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\MSI\Live Update 5\NTIOLib.sys [4.7.2013 16:09 7680]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [3.6.2013 16:21 162408]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\GEORGH~1\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\GEORGH~1\LOCALS~1\Temp\ALSysIO.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4.7.2013 16:27 1691480]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [27.6.2013 20:16 23456]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys --> c:\windows\system32\DRIVERS\ew_hwusbdev.sys [?]
S3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys --> c:\windows\system32\DRIVERS\ew_jucdcacm.sys [?]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys --> c:\windows\system32\DRIVERS\ew_jubusenum.sys [?]
S3 OnlineStorageService;OnlineStorageService;c:\program files\Trend Micro SafeSync\hrfscore.exe [4.7.2013 16:21 3947320]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [21.6.2013 22:25 136904]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [21.6.2013 22:25 17864]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [21.6.2013 22:25 153672]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [21.6.2013 22:25 130248]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - NTIOLIB_1_0_4
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-11 14:37 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.71\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2009-03-08 02:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-19 17:18]
.
2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-19 17:18]
.
2013-07-12 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 10:11]
.
2013-07-12 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 10:11]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntr ... 2&tsp=4926
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 193.179.143.3 193.179.143.5
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-12 21:23
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
CrystalDiskInfo = "c:\program files\CrystalDiskInfo\DiskInfoS.exe" /Startup?\
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(820)
c:\windows\system32\setupapi.dll
.
- - - - - - - > 'explorer.exe'(3376)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\COMRes.dll
c:\program files\Trend Micro SafeSync\HrfsShellExtension.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\cscui.dll
c:\windows\system32\CSCDLL.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\system32\COMDLG32.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\arservice.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\HPZipm12.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\MSI\Live Update 5\LU5.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Celkový čas: 2013-07-12 21:27:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-12 19:27
ComboFix2.txt 2013-07-12 18:32
.
Před spuštěním: Volných bajtů: 16 710 721 536
Po spuštění: Volných bajtů: 16 714 506 240
.
- - End Of File - - 7D840497258EEA4E44A38791B162DECE
413FC2A0C716421B3158746D63736515

[Rudy]

Log je již OK. Nastala nějaká změna?

[Georg.H]

jo ,je vidět že to je krapet svižnější

na ten ex. disk už můžu vrátit věci?
stále ho mám prázdny

[Rudy]

Myslím, že ano.

[Georg.H]

ok
a mockrát díky

[Rudy]

Rádo se stalo!