prosim o preventivku,...dakujem

[chrobacik]

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-08-23 to 2013-09-23 )))))))))))))))))))))))))))))))
.
.
2013-09-23 15:51 . 2013-09-23 15:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-23 14:03 . 2013-09-23 14:03 -------- d-----w- c:\program files (x86)\Intel
2013-09-23 14:03 . 2013-09-23 14:03 -------- d-----w- C:\Intel
2013-09-23 14:03 . 2013-09-23 14:03 -------- d-----w- c:\windows\LastGood
2013-09-23 09:11 . 2013-09-23 09:12 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2013-09-23 09:11 . 2013-09-23 09:11 -------- d-----w- C:\Recovery
2013-09-23 09:08 . 2013-09-23 09:11 -------- d-----w- C:\totalcmd
2013-09-23 09:04 . 2013-09-23 09:04 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-09-23 09:03 . 2013-09-23 09:04 -------- d-----r- c:\program files (x86)\Skype
2013-09-23 09:03 . 2013-09-23 09:04 -------- d-----w- c:\programdata\Skype
2013-09-23 08:34 . 2013-09-23 08:34 -------- d-----w- c:\program files (x86)\Microsoft Works
2013-09-23 08:34 . 2013-09-23 08:34 -------- d-----w- c:\program files (x86)\MSBuild
2013-09-23 08:34 . 2013-09-23 08:34 -------- d-----w- c:\windows\PCHEALTH
2013-09-23 08:32 . 2013-09-23 08:32 -------- d-----w- c:\program files\Microsoft Office
2013-09-23 08:31 . 2013-09-23 08:35 -------- d-----w- c:\programdata\Microsoft Help
2013-09-23 08:31 . 2013-09-23 08:31 -------- d-----r- C:\MSOCache
2013-09-23 08:29 . 2013-09-23 08:29 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2013-09-23 08:24 . 2013-09-23 08:24 -------- d-----w- c:\programdata\IObit
2013-09-23 08:24 . 2013-09-23 08:24 -------- d-----w- c:\program files (x86)\IObit
2013-09-23 08:16 . 2013-09-23 08:17 -------- d-----w- c:\programdata\PRICache
2013-09-23 08:16 . 2013-09-23 15:26 -------- d-----w- c:\users\Doma
2013-09-23 08:11 . 2013-09-23 10:11 -------- d-----w- c:\windows\Panther
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-23 14:03 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 vmicheartbeat;Hyper-V Heartbeat Service;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 StrartMenuService;StrartMenu8 Service;c:\program files (x86)\IObit\Start Menu 8\StartMenuServices.exe;c:\program files (x86)\IObit\Start Menu 8\StartMenuServices.exe [x]
S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C63x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C63x64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 172.17.110.6 172.17.110.7
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\i0hxsnwm.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Completion time: 2013-09-23 18:01:13
ComboFix-quarantined-files.txt 2013-09-23 16:01
ComboFix2.txt 2013-09-23 15:23
.

[vyosek]

Zdravim

Ke ComboFixu, ktery jste pouzil, tak na zaklade licence a pravidel fora ptam, umite s nim pracovat (spusteni, rozlusteni logu, napsani skriptu)?

Licencni podminky ComboFixu hovori jasne "Nikdy by nemel byt pouzit v prostredi bez dozoru zkusene osoby"


Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal