Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

TrojanDownloader:Win32/Unruy.C

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
viktor63
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 30 říj 2008 16:11
Kontaktovat uživatele:
Kontaktovat uživatele viktor63

TrojanDownloader:Win32/Unruy.C

#1 Příspěvek od viktor63 »

Logfile of random's system information tool 1.06 (written by random/random)
Run by MasernaUSlunce at 2010-04-27 20:32:47
Microsoft Windows 7 Ultimate Service Pack 3
System drive C: has 139 GB (91%) free of 153 GB
Total RAM: 2038 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:32:50, on 27.4.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\program files\microsoft security essentials\msseces .exe
C:\program files\luxand\blink!\luxandblinktray .exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\hkcmd .exe
C:\Windows\system32\igfxsrvc.exe
C:\windows\system32\igfxpers .exe
C:\windows\system32\igfxtray .exe
C:\program files\nokia\nokia ovi suite\nokiaovisuite .exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\MasernaUSlunce\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\MasernaUSlunce.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Luxand Blink!] C:\Program Files\Luxand\Blink!\LuxandBlinkTray.exe /s
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe_Reader] c:\program files\internet explorer\wmpscfgs.exe
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Bio-Protection fingerprint solution\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Bio-Protection fingerprint solution\PwdBank.exe
O13 - Gopher Prefix:
O20 - AppInit_DLLs: nmklo
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Bio-Protection fingerprint solution\WinNotify.dll
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 3920 bytes

======Scheduled tasks folder======

C:\Windows\tasks\At1.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSSE"=c:\Program Files\Microsoft Security Essentials\msseces.exe [2010-04-26 36864]
"Luxand Blink!"=C:\Program Files\Luxand\Blink!\LuxandBlinkTray.exe [2010-04-27 36864]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-04-27 36864]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-04-27 36864]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-04-27 36864]
"Adobe_Reader"=c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 36864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"NokiaOviSuite2"=C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-04-27 36864]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZPdtWzdVitaKey MC3000]
C:\Program Files\Acer\Bio-Protection fingerprint solution\PdtWzd.exe [2010-04-26 3864064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="nmklo"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AWinNotifyVitaKey MC3000]
C:\Program Files\Acer\Bio-Protection fingerprint solution\WinNotify.dll [2010-04-26 2860032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\Acer\Bio-Protection fingerprint solution\PwdFilter

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68cca1a8-513d-11df-a444-806e6f6e6963}]
shell\AutoRun\command - D:\setup.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-04-27 20:30:28 ----D---- C:\rsit
2010-04-27 02:09:07 ----D---- C:\Windows\Panther
2010-04-27 02:08:40 ----D---- C:\Windows\system32\OEM
2010-04-26 21:02:41 ----A---- C:\Windows\system32\uxtheme.dll.backup
2010-04-26 21:02:38 ----A---- C:\Windows\system32\themeui.dll.backup
2010-04-26 21:02:36 ----A---- C:\Windows\system32\themeservice.dll.backup
2010-04-26 20:55:01 ----SHD---- C:\Config.Msi
2010-04-26 20:54:38 ----D---- C:\Program Files\Trend Micro
2010-04-26 20:46:31 ----D---- C:\Program Files\Adobe
2010-04-26 20:45:08 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\TuneUp Software
2010-04-26 20:44:28 ----D---- C:\ProgramData\TuneUp Software
2010-04-26 20:44:23 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-26 20:43:59 ----D---- C:\Program Files\7-Zip
2010-04-26 20:41:18 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Thunderbird
2010-04-26 20:40:59 ----D---- C:\Program Files\Mozilla Thunderbird
2010-04-26 20:17:20 ----A---- C:\Windows\system32\msv1_0.dll
2010-04-26 20:10:40 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Nokia Ovi Suite
2010-04-26 20:10:27 ----A---- C:\Windows\system32\MRT.exe
2010-04-26 20:07:35 ----D---- C:\Windows\system32\x64
2010-04-26 20:07:35 ----A---- C:\Windows\system32\igxpun.exe
2010-04-26 20:05:57 ----D---- C:\Program Files\CONEXANT
2010-04-26 20:05:32 ----D---- C:\Program Files\Microsoft Silverlight
2010-04-26 19:54:23 ----D---- C:\ProgramData\Nokia
2010-04-26 19:46:57 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Nokia
2010-04-26 19:44:51 ----D---- C:\ProgramData\PC Suite
2010-04-26 19:44:50 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\PC Suite
2010-04-26 19:42:02 ----D---- C:\Program Files\Common Files\Nokia
2010-04-26 19:41:38 ----D---- C:\Program Files\DIFX
2010-04-26 19:41:34 ----DC---- C:\Windows\system32\DRVSTORE
2010-04-26 19:41:26 ----D---- C:\Program Files\PC Connectivity Solution
2010-04-26 19:40:54 ----A---- C:\Windows\system32\nmwcdcls.dll
2010-04-26 19:39:38 ----D---- C:\ProgramData\OviInstallerCache
2010-04-26 19:39:38 ----D---- C:\Program Files\Nokia
2010-04-26 18:59:40 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Macromedia
2010-04-26 18:59:40 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Adobe
2010-04-26 18:59:31 ----D---- C:\Windows\system32\Macromed
2010-04-26 18:17:49 ----A---- C:\Windows\system32\VMC3KAPI.dll
2010-04-26 18:17:49 ----A---- C:\Windows\system32\VCryptAPI.dll
2010-04-26 18:17:40 ----A---- C:\Windows\system32\ShlCmd.exe
2010-04-26 18:17:39 ----A---- C:\Windows\system32\biologon.dll
2010-04-26 18:17:15 ----A---- C:\Windows\system32\AtNav.dll
2010-04-26 18:17:14 ----D---- C:\Program Files\Acer
2010-04-26 18:17:14 ----A---- C:\Windows\system32\PBAGUI.dll
2010-04-26 18:17:14 ----A---- C:\Windows\system32\DemoAPI.dll
2010-04-26 18:17:14 ----A---- C:\Windows\system32\ATSC70PBA.dll
2010-04-26 18:17:01 ----D---- C:\Program Files\Fingerprint Sensor
2010-04-26 17:55:10 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Luxand
2010-04-26 17:54:22 ----A---- C:\Windows\system32\LuxandCredentialProvider.dll
2010-04-26 17:54:22 ----A---- C:\Windows\system32\LuxandBlinkLib12.dll
2010-04-26 17:54:22 ----A---- C:\Windows\system32\LuxandBlinkLib11.dll
2010-04-26 17:54:22 ----A---- C:\Windows\system32\LuxandBlinkLib1.dll
2010-04-26 17:54:21 ----D---- C:\Program Files\Luxand
2010-04-26 17:54:21 ----A---- C:\Windows\system32\LuxandBlink.dll
2010-04-26 17:54:00 ----D---- C:\Program Files\InstallShield Installation Information
2010-04-26 17:53:27 ----D---- C:\Windows\tiinst
2010-04-26 17:40:57 ----N---- C:\Windows\system32\MpSigStub.exe
2010-04-26 17:37:51 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Mozilla
2010-04-26 17:37:45 ----D---- C:\Program Files\Mozilla Firefox
2010-04-26 17:36:41 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-04-26 17:36:03 ----A---- C:\Windows\system32\wmp.dll
2010-04-26 17:36:02 ----A---- C:\Windows\system32\CertEnroll.dll
2010-04-26 17:36:01 ----A---- C:\Windows\system32\wmploc.DLL
2010-04-26 17:36:01 ----A---- C:\Windows\system32\winresume.exe
2010-04-26 17:36:01 ----A---- C:\Windows\system32\winload.exe
2010-04-26 17:35:59 ----A---- C:\Windows\system32\mshtml.dll
2010-04-26 17:35:58 ----A---- C:\Windows\system32\ieframe.dll
2010-04-26 17:35:57 ----A---- C:\Windows\system32\wininet.dll
2010-04-26 17:35:57 ----A---- C:\Windows\system32\urlmon.dll
2010-04-26 17:35:57 ----A---- C:\Windows\system32\mstime.dll
2010-04-26 17:35:57 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-04-26 17:35:57 ----A---- C:\Windows\system32\iedkcs32.dll
2010-04-26 17:35:56 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-04-26 17:35:56 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-04-26 17:35:55 ----A---- C:\Windows\system32\vbscript.dll
2010-04-26 17:35:53 ----A---- C:\Windows\system32\tzres.dll
2010-04-26 17:35:51 ----A---- C:\Windows\system32\cabview.dll
2010-04-26 17:35:50 ----A---- C:\Windows\system32\winlogon.exe
2010-04-26 17:35:50 ----A---- C:\Windows\system32\msasn1.dll
2010-04-26 17:35:50 ----A---- C:\Windows\explorer.exe
2010-04-26 17:35:48 ----A---- C:\Windows\system32\psisdecd.dll
2010-04-26 17:35:48 ----A---- C:\Windows\system32\msdri.dll
2010-04-26 17:35:48 ----A---- C:\Windows\system32\CPFilters.dll
2010-04-26 17:35:46 ----A---- C:\Windows\system32\quartz.dll
2010-04-26 17:35:46 ----A---- C:\Windows\system32\mciavi32.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\tsbyuv.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\t2embed.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\msyuv.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\msvidc32.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\msrle32.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\iyuv_32.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\fontsub.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\avifil32.dll
2010-04-26 17:35:45 ----A---- C:\Windows\system32\atmfd.dll
2010-04-26 17:35:44 ----A---- C:\Windows\system32\wintrust.dll
2010-04-26 17:35:44 ----A---- C:\Windows\system32\jscript.dll
2010-04-26 16:35:34 ----D---- C:\Program Files\Microsoft Security Essentials
2010-04-26 16:35:30 ----SHD---- C:\Windows\Installer
2010-04-26 16:30:33 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Identities
2010-04-26 16:30:08 ----SD---- C:\Users\MasernaUSlunce\AppData\Roaming\Microsoft
2010-04-26 16:30:08 ----D---- C:\Users\MasernaUSlunce\AppData\Roaming\Media Center Programs
2010-04-26 16:27:00 ----SHD---- C:\Recovery
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Šablony
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Plocha
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Oblíbené položky
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Nabídka Start
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Dokumenty
2010-04-26 16:27:00 ----SHD---- C:\ProgramData\Data aplikací
2010-04-26 16:13:20 ----D---- C:\Windows\SoftwareDistribution
2010-04-26 16:10:23 ----D---- C:\Windows\Prefetch
2010-04-26 16:10:13 ----SHD---- C:\System Volume Information

======List of files/folders modified in the last 1 months======

2010-04-27 20:32:44 ----D---- C:\Windows\Temp
2010-04-27 20:32:30 ----D---- C:\Windows\System32
2010-04-27 20:32:30 ----D---- C:\Windows\inf
2010-04-27 20:31:53 ----D---- C:\Windows\system32\config
2010-04-27 20:30:18 ----D---- C:\Windows\Tasks
2010-04-27 20:30:18 ----D---- C:\Windows\system32\Tasks
2010-04-27 20:29:45 ----D---- C:\Program Files\Internet Explorer
2010-04-27 20:29:44 ----A---- C:\Windows\system32\igfxpers.exe
2010-04-27 20:29:43 ----A---- C:\Windows\system32\hkcmd.exe
2010-04-27 20:29:42 ----A---- C:\Windows\system32\igfxtray.exe
2010-04-27 20:28:37 ----RD---- C:\Program Files
2010-04-26 21:12:44 ----D---- C:\Windows\Microsoft.NET
2010-04-26 21:11:34 ----RSD---- C:\Windows\assembly
2010-04-26 21:02:41 ----A---- C:\Windows\system32\uxtheme.dll
2010-04-26 21:02:38 ----A---- C:\Windows\system32\themeui.dll
2010-04-26 21:02:36 ----A---- C:\Windows\system32\themeservice.dll
2010-04-26 20:49:10 ----D---- C:\Windows\system32\drivers
2010-04-26 20:49:10 ----D---- C:\Windows
2010-04-26 20:45:30 ----D---- C:\Windows\winsxs
2010-04-26 20:44:28 ----HD---- C:\ProgramData
2010-04-26 20:30:41 ----D---- C:\Windows\system32\catroot
2010-04-26 20:30:24 ----D---- C:\Windows\system32\cs-CZ
2010-04-26 20:30:23 ----D---- C:\Windows\system32\Boot
2010-04-26 20:30:23 ----D---- C:\Windows\AppPatch
2010-04-26 20:30:23 ----D---- C:\Program Files\Windows Media Player
2010-04-26 20:30:22 ----D---- C:\Windows\ehome
2010-04-26 20:30:21 ----D---- C:\Windows\system32\sk-SK
2010-04-26 20:30:21 ----D---- C:\Windows\system32\en-US
2010-04-26 20:16:39 ----D---- C:\Windows\system32\DriverStore
2010-04-26 20:10:28 ----D---- C:\Windows\debug
2010-04-26 20:10:18 ----D---- C:\Windows\system32\catroot2
2010-04-26 19:42:02 ----D---- C:\Program Files\Common Files
2010-04-26 18:25:42 ----D---- C:\Windows\system32\wdi
2010-04-26 18:19:57 ----D---- C:\Windows\system32\en
2010-04-26 18:19:57 ----D---- C:\Windows\system32\cs
2010-04-26 18:19:57 ----D---- C:\Windows\PolicyDefinitions
2010-04-26 18:19:57 ----D---- C:\Program Files\Microsoft Games
2010-04-26 18:19:54 ----D---- C:\Program Files\DVD Maker
2010-04-26 17:54:27 ----SD---- C:\ProgramData\Microsoft
2010-04-26 17:40:30 ----D---- C:\Windows\system32\restore
2010-04-26 16:34:15 ----D---- C:\Windows\system32\wbem
2010-04-26 16:32:56 ----D---- C:\Windows\Logs
2010-04-26 16:30:30 ----SHD---- C:\$Recycle.Bin
2010-04-26 16:30:07 ----RD---- C:\Users
2010-04-26 16:28:41 ----D---- C:\Windows\Setup
2010-04-26 16:27:34 ----D---- C:\Windows\rescache
2010-04-26 16:27:00 ----D---- C:\Program Files\Windows NT
2010-04-26 16:25:30 ----D---- C:\Windows\system32\CodeIntegrity
2010-04-26 16:14:11 ----D---- C:\Windows\system32\sysprep
2010-04-26 16:11:08 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys [2009-07-14 35328]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys [2009-07-14 78336]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 32256]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2009-12-02 149040]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys [2009-07-14 16896]
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys [2009-07-14 6656]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 7168]
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys [2009-07-14 74240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys [2009-07-14 63488]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 9728]
R2 Int15;Int 15; \??\C:\Windows\System32\drivers\int15.sys [2007-01-26 69632]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys [2009-07-14 48128]
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys [2009-07-14 86528]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys [2009-07-14 586752]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys [2009-07-14 60928]
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys [2009-07-14 34816]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 8192]
R3 1394ohci;Hostitelský řadič pro rozhraní OHCI standardu 1394; C:\Windows\system32\DRIVERS\1394ohci.sys [2009-07-14 163328]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-07-08 2506232]
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys [2009-07-14 69632]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2009-07-14 14080]
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\DRIVERS\CompositeBus.sys [2009-07-14 31232]
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys [2009-10-02 728648]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-07-14 304128]
R3 HDAudBus;Ovladač sběrnice Microsoft UAA pro zvuk High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys [2009-07-14 108544]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-10-18 986624]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-10-18 206848]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 intelppm;Ovladač procesoru Intel; C:\Windows\system32\DRIVERS\intelppm.sys [2009-07-14 53760]
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft; C:\Windows\system32\DRIVERS\monitor.sys [2009-07-14 23552]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2009-12-02 42368]
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys [2009-07-14 60416]
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys [2010-02-27 221696]
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys [2010-02-27 95744]
R3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys [2009-07-14 267264]
R3 NSCIRDA;NSC Infrared Device Driver; C:\Windows\system32\DRIVERS\nscirda.sys [2008-01-19 30720]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 49152]
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys [2009-07-14 75264]
R3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 18944]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys [2009-07-14 306688]
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [2009-12-08 113664]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2010-04-26 290816]
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys [2009-07-14 108544]
R3 umbus;Ovladač sběrnice UMBus Enumerator; C:\Windows\system32\DRIVERS\umbus.sys [2009-07-14 39936]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\Windows\system32\DRIVERS\usbccgp.sys [2009-07-14 75264]
R3 usbehci;Ovladač miniportu vylepšeného hostitelského řadiče Microsoft USB 2.0; C:\Windows\system32\DRIVERS\usbehci.sys [2009-07-14 41472]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\Windows\system32\DRIVERS\usbhub.sys [2009-07-14 258560]
R3 usbuhci;Ovladač miniportu univerzálního hostitelského řadiče Microsoft USB; C:\Windows\system32\DRIVERS\usbuhci.sys [2009-07-14 24064]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2009-07-14 146176]
R3 vwifibus;Ovladač sběrnice Virtual WiFi; C:\Windows\system32\DRIVERS\vwifibus.sys [2009-07-14 19968]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-10-18 659968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2009-07-14 11264]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys [2009-07-14 9728]
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [2009-07-14 422976]
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [2009-07-14 297552]
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [2009-07-14 146512]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys [2009-07-14 14912]
S3 AmdK8;AMD K8 Processor Driver; C:\Windows\system32\DRIVERS\amdk8.sys [2009-07-14 55296]
S3 AmdPPM;AMD Processor Driver; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 52736]
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [2009-07-14 79952]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 159312]
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2009-07-14 50176]
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys [2009-07-14 76368]
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [2009-07-14 86608]
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbdx.sys [2009-07-14 430080]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys [2009-07-14 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys [2009-07-14 5248]
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys [2009-07-14 272128]
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys [2009-07-14 62336]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys [2009-07-14 12160]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys [2009-07-14 11904]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BTHMODEM;Ovladač pro komunikaci pomocí modemu Bluetooth; C:\Windows\system32\DRIVERS\bthmodem.sys [2009-07-14 56320]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys [2009-07-14 37888]
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbdx.sys [2009-07-14 3100160]
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [2009-07-14 453712]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys [2009-07-14 7168]
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys [2009-07-14 142336]
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys [2009-07-14 28160]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 46160]
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys [2009-07-14 57936]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-07-14 26624]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 21504]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys [2009-07-14 91136]
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys [2009-07-14 37888]
S3 HidUsb;Microsoft HID Class Driver; C:\Windows\system32\DRIVERS\hidusb.sys [2009-07-14 24064]
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [2009-07-14 67152]
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [2009-07-14 332352]
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [2009-07-14 41040]
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys [2009-07-14 65536]
S3 isapnp;isapnp; C:\Windows\system32\DRIVERS\isapnp.sys [2009-07-14 46656]
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys [2009-07-14 186960]
S3 kbdhid;Keyboard HID Driver; C:\Windows\system32\DRIVERS\kbdhid.sys [2009-07-14 28160]
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [2009-07-14 95824]
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [2009-07-14 89168]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 54864]
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [2009-07-14 96848]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys [2009-07-14 30800]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 235584]
S3 mouhid;Mouse HID Driver; C:\Windows\system32\DRIVERS\mouhid.sys [2009-07-14 26112]
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys [2009-07-14 130624]
S3 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys [2009-07-14 27712]
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys [2009-07-14 115792]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 4096]
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys [2009-07-14 162896]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 6144]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 12288]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 27136]
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [2009-07-14 44624]
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys [2009-07-14 105024]
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [2009-07-14 117312]
S3 nvstor;nvstor; C:\Windows\system32\DRIVERS\nvstor.sys [2009-07-14 142416]
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys [2009-07-14 62464]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [2009-07-14 1383488]
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [2009-07-14 106064]
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys [2009-07-14 31744]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys [2009-07-14 85568]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2009-07-14 26624]
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys [2009-07-14 19968]
S3 sffdisk;Ovladač třídy úložiště SFF; C:\Windows\system32\DRIVERS\sffdisk.sys [2009-07-14 11264]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys [2009-07-14 12288]
S3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys [2009-07-14 12800]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [2009-07-14 40016]
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [2009-07-14 77888]
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys [2009-07-14 71168]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-14 207360]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-14 980992]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-14 661504]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 21072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys [2009-07-14 1285712]
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys [2009-07-14 30208]
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys [2009-07-14 55888]
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys [2009-07-14 57424]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 8192]
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys [2009-07-14 86016]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbohci.sys [2009-07-14 20480]
S3 usbprint;Microsoft USB PRINTER Class; C:\Windows\system32\DRIVERS\usbprint.sys [2009-07-14 19968]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\Windows\system32\DRIVERS\USBSTOR.SYS [2009-07-14 74752]
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys [2009-07-14 26112]
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys [2009-07-14 159824]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [2009-07-14 141904]
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys [2009-07-14 21632]
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys [2009-07-14 19024]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys [2009-07-14 22096]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys [2009-07-14 16384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DPS;@%systemroot%\system32\dps.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2009-07-14 22528]
R2 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2009-12-09 17904]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2009-07-14 3179520]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-04 386560]
R3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe [2009-07-14 22528]
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
R3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 204800]
R3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-07-14 1121280]
R3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 557056]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 94720]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2009-07-14 522752]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42856]
S3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 878416]
S3 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe [2009-07-14 12800]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe [2009-07-14 35840]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2009-07-14 22528]
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe [2009-07-14 452608]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-07-14 1202688]
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinDefend;@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 NetTcpPortSharing;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 128848]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: TrojanDownloader:Win32/Unruy.C

#2 Příspěvek od Unlimited_Killer »

Pěkně zavšivené PC. :arcisit:

1) ComboFix
  • Stáhněte a uložte na Plochu ComboFix.
  • Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
  • Spusťte ho s administrátorským oprávněním.
  • Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'.
  • Budete také dotázáni na instalaci konzole pro zotavení, taktéž klikněte na 'Ano'.
  • Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat.
  • Váš PC bude pravděpodobně restartován, tak se toho nelekněte.
  • Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
  • Po skončení skenu (či následném restartu) na Vás 'vypadne' log, který vkopírujete ve formě textu sem.
  • Pokud žádný log 'nevypadne', naleznete jej v umístění C:\ComboFix.txt
inactive
Nahoru
viktor63
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 30 říj 2008 16:11
Kontaktovat uživatele:
Kontaktovat uživatele viktor63

Re: TrojanDownloader:Win32/Unruy.C

#3 Příspěvek od viktor63 »

ComboFix 10-04-26.05 - MasernaUSlunce 27.04.2010 21:06:46.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2038.1099 [GMT 2:00]
Spuštěný z: c:\users\MasernaUSlunce\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\js.mui
c:\program files\Internet Explorer\wmpscfgs .exe
c:\program files\Internet Explorer\wmpscfgs.exe
c:\windows\system32\cooper.mine
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxpers .exe
c:\windows\system32\igfxtray .exe
c:\windows\system32\winstartup.log

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-27 do 2010-04-27 )))))))))))))))))))))))))))))))
.

2010-04-27 19:25 . 2010-04-27 19:25 -------- d-----w- C:\Device
2010-04-27 19:21 . 2010-04-27 19:26 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\temp
2010-04-27 19:21 . 2010-04-27 19:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-27 18:30 . 2010-04-27 18:32 -------- d-----w- C:\rsit
2010-04-27 00:09 . 2010-04-26 14:28 -------- d-----w- c:\windows\Panther
2010-04-27 00:08 . 2010-04-27 00:08 -------- d-----w- c:\windows\system32\OEM
2010-04-26 18:54 . 2010-04-26 18:54 -------- d-----w- c:\program files\Trend Micro
2010-04-26 18:45 . 2010-04-26 18:45 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\TuneUp Software
2010-04-26 18:44 . 2010-04-26 18:55 -------- d-----w- c:\programdata\TuneUp Software
2010-04-26 18:44 . 2010-04-26 18:44 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-26 18:43 . 2010-04-26 18:44 -------- d-----w- c:\program files\7-Zip
2010-04-26 18:41 . 2010-04-26 18:41 0 ----a-w- c:\windows\nsreg.dat
2010-04-26 18:41 . 2010-04-26 18:41 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Thunderbird
2010-04-26 18:41 . 2010-04-26 18:41 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Thunderbird
2010-04-26 18:40 . 2010-04-26 18:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-04-26 18:29 . 2010-04-26 18:29 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\ElevatedDiagnostics
2010-04-26 18:17 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-04-26 18:10 . 2010-04-26 18:10 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Nokia Ovi Suite
2010-04-26 18:07 . 2010-04-26 18:07 -------- d-----w- c:\windows\system32\x64
2010-04-26 18:07 . 2009-09-23 17:30 1002008 ----a-w- c:\windows\system32\igxpun.exe
2010-04-26 18:05 . 2010-04-26 18:05 -------- d-----w- c:\program files\CONEXANT
2010-04-26 18:05 . 2010-04-26 18:05 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-26 17:54 . 2010-04-26 17:54 -------- d-----w- c:\programdata\Nokia
2010-04-26 17:46 . 2010-04-26 18:10 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Nokia
2010-04-26 17:44 . 2010-04-26 17:54 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Nokia
2010-04-26 17:44 . 2010-04-26 17:51 -------- d-----w- c:\programdata\PC Suite
2010-04-26 17:44 . 2010-04-26 17:54 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\PC Suite
2010-04-26 17:44 . 2010-04-27 18:29 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\NokiaAccount
2010-04-26 17:42 . 2010-04-26 18:15 -------- d-----w- c:\program files\Common Files\Nokia
2010-04-26 17:39 . 2010-04-26 17:39 -------- d-----w- c:\programdata\OviInstallerCache
2010-04-26 16:59 . 2010-04-26 16:59 -------- d-----w- c:\windows\system32\Macromed
2010-04-26 16:17 . 2010-04-26 16:17 114688 ----a-w- c:\windows\system32\VMC3KAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 114688 ----a-w- c:\windows\system32\VCryptAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 19456 ----a-w- c:\windows\system32\ShlCmd.exe
2010-04-26 16:17 . 2010-04-26 16:17 5632 ----a-w- c:\windows\system32\biologon.dll
2010-04-26 16:17 . 2010-04-26 16:17 73728 ----a-w- c:\windows\system32\AtNav.dll
2010-04-26 16:17 . 2010-04-26 16:17 708096 ----a-w- c:\windows\system32\DemoAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 208896 ----a-w- c:\windows\system32\ATSC70PBA.dll
2010-04-26 16:17 . 2010-04-26 16:17 189952 ----a-w- c:\windows\system32\PBAGUI.dll
2010-04-26 16:17 . 2010-04-26 16:17 -------- d-----w- c:\program files\Acer
2010-04-26 16:17 . 2010-04-26 16:17 57344 ----a-r- c:\users\MasernaUSlunce\AppData\Roaming\Microsoft\Installer\{64BDD01B-70CA-4844-9D2F-38C56FB31E03}\ARPPRODUCTICON.exe
2010-04-26 16:17 . 2010-04-26 16:17 -------- d-----w- c:\program files\Fingerprint Sensor
2010-04-26 15:55 . 2010-04-26 15:55 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Luxand
2010-04-26 15:54 . 2010-02-09 23:07 4705080 ----a-w- c:\windows\system32\LuxandBlinkLib11.dll
2010-04-26 15:54 . 2010-02-09 23:07 4705080 ----a-w- c:\windows\system32\LuxandBlinkLib1.dll
2010-04-26 15:54 . 2010-02-09 23:06 94008 ----a-w- c:\windows\system32\LuxandBlinkLib12.dll
2010-04-26 15:54 . 2010-02-09 23:06 431416 ----a-w- c:\windows\system32\LuxandCredentialProvider.dll
2010-04-26 15:54 . 2010-04-26 15:54 -------- d-----w- c:\program files\Luxand
2010-04-26 15:54 . 2010-02-09 23:06 628536 ----a-w- c:\windows\system32\LuxandBlink.dll
2010-04-26 15:54 . 2010-04-26 15:54 -------- d-----w- c:\program files\InstallShield Installation Information
2010-04-26 15:53 . 2010-04-26 15:53 -------- d-----w- c:\windows\tiinst
2010-04-26 15:52 . 2010-04-26 15:52 290816 ----a-w- c:\windows\system32\drivers\tifm21.sys
2010-04-26 15:45 . 2009-11-25 20:03 61952 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\AeroBuddy@ReduxTeam\components\dwmxpcom.dll
2010-04-26 15:42 . 2009-11-25 20:03 61952 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll
2010-04-26 15:40 . 2010-02-24 08:16 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-04-26 15:39 . 2009-02-16 21:12 53248 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\coc@ble.pl\components\dwmxpcom.dll
2010-04-26 15:37 . 2010-04-26 15:37 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Mozilla
2010-04-26 15:36 . 2009-10-02 04:06 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-04-26 15:36 . 2009-09-03 07:04 1320960 ----a-w- c:\windows\system32\CertEnroll.dll
2010-04-26 15:36 . 2009-08-29 06:54 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-04-26 15:36 . 2009-08-19 07:20 442920 ----a-w- c:\windows\system32\winresume.exe
2010-04-26 15:36 . 2009-08-19 07:20 507568 ----a-w- c:\windows\system32\winload.exe
2010-04-26 14:36 . 2010-04-26 14:36 57560 ----a-w- c:\users\MasernaUSlunce\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-26 14:35 . 2010-04-26 20:27 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-04-26 14:35 . 2010-04-26 18:55 -------- d-sh--w- c:\windows\Installer
2010-04-26 14:34 . 2010-04-27 18:32 -------- d-----w- c:\windows\system32\wbem\Performance
2010-04-26 14:33 . 2010-02-27 07:32 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-26 14:33 . 2010-02-27 07:32 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-26 14:33 . 2010-02-27 07:32 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\users\Default\Soubory cookie

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-27 19:27 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxpers.exe
2010-04-27 19:27 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\hkcmd.exe
2010-04-27 19:27 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxtray.exe
2010-04-27 18:32 . 2009-07-26 17:53 622660 ----a-w- c:\windows\system32\perfh005.dat
2010-04-27 18:32 . 2009-07-26 17:53 118810 ----a-w- c:\windows\system32\perfc005.dat
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxpers .exe
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\hkcmd .exe
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxtray .exe
2010-04-26 19:02 . 2009-07-13 23:40 249856 ----a-w- c:\windows\system32\uxtheme.dll
2010-04-26 19:02 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\system32\themeui.dll
2010-04-26 19:02 . 2009-07-13 23:39 37376 ----a-w- c:\windows\system32\themeservice.dll
2010-04-26 17:51 . 2010-04-26 17:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-04-26 17:41 . 2010-04-26 17:39 -------- d-----w- c:\program files\Nokia
2010-04-26 17:41 . 2010-04-26 17:41 -------- d-----w- c:\program files\DIFX
2010-04-26 17:41 . 2010-04-26 17:41 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-26 17:39 . 2010-04-26 17:39 12212040 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-04-26 17:39 . 2010-04-26 17:39 13930312 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-04-26 17:39 . 2010-04-26 17:39 77824 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-04-26 17:39 . 2010-04-26 17:39 61440 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-04-26 17:39 . 2010-04-26 17:39 58880 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-04-26 17:39 . 2010-04-26 17:39 50000 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\pcswpc.exe
2010-04-26 17:38 . 2010-04-26 17:39 98366952 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Nokia_Ovi_Suite_webinstaller_ALL.exe
2010-04-26 16:19 . 2009-07-14 04:52 -------- d-----w- c:\program files\Microsoft Games
2010-04-26 16:19 . 2009-07-14 04:52 -------- d-----w- c:\program files\DVD Maker
2010-04-26 15:54 . 2010-04-26 15:54 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Plocha
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Oblíbené položky
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Šablony
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Nabídka Start
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Dokumenty
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Data aplikací
2010-03-08 21:33 . 2010-04-26 15:35 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-02-27 12:07 . 2010-04-26 15:35 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-27 12:07 . 2010-04-26 15:35 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-23 07:56 . 2010-04-26 15:35 977920 ----a-w- c:\windows\system32\wininet.dll
2010-02-02 07:45 . 2010-04-26 15:35 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

Kód: Vybrat vše

<pre>
c:\program files\Luxand\Blink!\luxandblinktray .exe
c:\program files\Microsoft Security Essentials\msseces .exe
c:\program files\Nokia\Nokia Ovi Suite\nokiaovisuite .exe
c:\windows\System32\hkcmd .exe
c:\windows\System32\igfxpers .exe
c:\windows\System32\igfxtray .exe
</pre>
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-04-27 36864]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-04-26 36864]
"Luxand Blink!"="c:\program files\Luxand\Blink!\LuxandBlinkTray.exe" [2010-04-27 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-27 36864]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-27 36864]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-27 36864]
"Adobe_Reader"="c:\program files\internet explorer\wmpscfgs.exe" [2010-04-27 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2010-04-26 16:17 2860032 ----a-w- c:\program files\Acer\Bio-Protection fingerprint solution\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZPdtWzdVitaKey MC3000]
2010-04-26 16:17 3864064 ----a-w- c:\program files\Acer\Bio-Protection fingerprint solution\PdtWzd.exe

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2009-12-02 42368]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

.
Obsah adresáře 'Naplánované úlohy'

2010-04-27 c:\windows\Tasks\At1.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At10.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At11.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At12.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At13.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At14.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At15.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At16.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At17.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At18.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At19.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At2.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At20.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At21.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At22.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At23.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At24.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At3.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At4.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At5.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At6.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At7.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At8.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]

2010-04-27 c:\windows\Tasks\At9.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-27 19:28]
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\AeroBuddy@ReduxTeam\components\dwmxpcom.dll
FF - component: c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\Acer\Bio-Protection fingerprint solution\CompPtcVUI.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\microsoft security essentials\msseces .exe
c:\program files\luxand\blink!\luxandblinktray .exe
c:\program files\nokia\nokia ovi suite\nokiaovisuite .exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Nokia\NoA\nokiaaserver.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\WUDFHost.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-04-27 21:31:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-27 19:31

Před spuštěním: Volných bajtů: 145 775 222 784
Po spuštění: Volných bajtů: 145 320 357 888

- - End Of File - - F4D9FD1EA71B918BEFA62078B782800E




Měl bych dotaz co je lepší MSE nebo AVIRA ?
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: TrojanDownloader:Win32/Unruy.C

#4 Příspěvek od Unlimited_Killer »

Jdeme na to. ↓

1) Skript do ComboFix-u
  • Otevřete si Poznámkový blok [Start → Spustit → notepad → Enter].
  • Do něj vkopírujte následující text:

    Kód: Vybrat vše

    KillAll::

RenV::
c:\program files\Luxand\Blink!\luxandblinktray .exe
c:\program files\Microsoft Security Essentials\msseces .exe
c:\program files\Nokia\Nokia Ovi Suite\nokiaovisuite .exe
c:\windows\System32\hkcmd .exe
c:\windows\System32\igfxpers .exe
c:\windows\System32\igfxtray .exe

Collect::
c:\program files\internet explorer\wmpscfgs.exe

Folder::
c:\program files\internet explorer

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe_Reader"=-

AtJob::

Reboot::
  • Uložte tento soubor na Plochu pod jménem CFScript (koncovka .txt).
  • Přetáhněte tento soubor nad ComboFix a pusťte ho.
  • I tento soubor, i ComboFix musí být na Ploše!
    Obrázek
  • ComboFix se spustí a vykoná příkazy ze skriptu.
  • Počítač bude pravděpodobně restartován.
  • Po restartu na Vás vyskočí okno s logem, který mi vkopírujete sem ve formě textu.
2) VirusTotal
  • Otestujte na VirusTotal soubory:

    Kód: Vybrat vše

    c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
c:\program files\Microsoft Security Essentials\msseces.exe
c:\program files\Luxand\Blink!\LuxandBlinkTray.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxpers.exe
  • Jednoduše tam vkopírujete cesty, co jsem napsal do code.
  • Jestliže Vám to napíše, že soubor byl již testován, nechte ho otestovat znovu.
  • Poté sem vložíte linky (odkazy) na jednotlivé testy.
3) Malwarebytes' Anti-Malware
  • Stáhněte MbAM a postupujte podle popisu.
  • Zatím nic nemažte, MbAM má občas falešné detekce.
  • Poté mi sem vložte log ve formě textu.
inactive
Nahoru
viktor63
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 30 říj 2008 16:11
Kontaktovat uživatele:
Kontaktovat uživatele viktor63

Re: TrojanDownloader:Win32/Unruy.C

#5 Příspěvek od viktor63 »

ComboFix 10-04-29.01 - MasernaUSlunce 29.04.2010 20:04:10.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2038.1169 [GMT 2:00]
Spuštěný z: c:\users\MasernaUSlunce\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MasernaUSlunce\Desktop\CFScript.txt

file zipped: c:\program files\internet explorer\wmpscfgs.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\js.mui
c:\program files\Internet Explorer\wmpscfgs .exe
c:\program files\internet explorer\wmpscfgs.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-28 do 2010-04-29 )))))))))))))))))))))))))))))))
.

2010-04-29 18:11 . 2010-04-29 18:13 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\temp
2010-04-29 18:11 . 2010-04-29 18:11 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-04-29 18:11 . 2010-04-29 18:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-29 18:02 . 2010-04-29 18:02 -------- d-----w- C:\32788R22FWJFW
2010-04-27 19:25 . 2010-04-27 19:25 -------- d-----w- C:\Device
2010-04-27 18:30 . 2010-04-27 18:32 -------- d-----w- C:\rsit
2010-04-27 00:09 . 2010-04-26 14:28 -------- d-----w- c:\windows\Panther
2010-04-27 00:08 . 2010-04-27 00:08 -------- d-----w- c:\windows\system32\OEM
2010-04-26 18:54 . 2010-04-26 18:54 -------- d-----w- c:\program files\Trend Micro
2010-04-26 18:45 . 2010-04-26 18:45 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\TuneUp Software
2010-04-26 18:44 . 2010-04-26 18:55 -------- d-----w- c:\programdata\TuneUp Software
2010-04-26 18:44 . 2010-04-26 18:44 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-26 18:43 . 2010-04-26 18:44 -------- d-----w- c:\program files\7-Zip
2010-04-26 18:41 . 2010-04-26 18:41 0 ----a-w- c:\windows\nsreg.dat
2010-04-26 18:41 . 2010-04-26 18:41 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Thunderbird
2010-04-26 18:41 . 2010-04-26 18:41 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Thunderbird
2010-04-26 18:40 . 2010-04-26 18:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-04-26 18:29 . 2010-04-26 18:29 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\ElevatedDiagnostics
2010-04-26 18:17 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-04-26 18:10 . 2010-04-26 18:10 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Nokia Ovi Suite
2010-04-26 18:07 . 2010-04-26 18:07 -------- d-----w- c:\windows\system32\x64
2010-04-26 18:07 . 2009-09-23 17:30 1002008 ----a-w- c:\windows\system32\igxpun.exe
2010-04-26 18:05 . 2010-04-26 18:05 -------- d-----w- c:\program files\CONEXANT
2010-04-26 18:05 . 2010-04-26 18:05 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-26 17:54 . 2010-04-26 17:54 -------- d-----w- c:\programdata\Nokia
2010-04-26 17:46 . 2010-04-26 18:10 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Nokia
2010-04-26 17:44 . 2010-04-26 17:54 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Nokia
2010-04-26 17:44 . 2010-04-26 17:51 -------- d-----w- c:\programdata\PC Suite
2010-04-26 17:44 . 2010-04-26 17:54 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\PC Suite
2010-04-26 17:44 . 2010-04-29 17:55 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\NokiaAccount
2010-04-26 17:42 . 2010-04-26 18:15 -------- d-----w- c:\program files\Common Files\Nokia
2010-04-26 17:39 . 2010-04-26 17:39 -------- d-----w- c:\programdata\OviInstallerCache
2010-04-26 16:59 . 2010-04-26 16:59 -------- d-----w- c:\windows\system32\Macromed
2010-04-26 16:17 . 2010-04-26 16:17 114688 ----a-w- c:\windows\system32\VMC3KAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 114688 ----a-w- c:\windows\system32\VCryptAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 19456 ----a-w- c:\windows\system32\ShlCmd.exe
2010-04-26 16:17 . 2010-04-26 16:17 5632 ----a-w- c:\windows\system32\biologon.dll
2010-04-26 16:17 . 2010-04-26 16:17 73728 ----a-w- c:\windows\system32\AtNav.dll
2010-04-26 16:17 . 2010-04-26 16:17 708096 ----a-w- c:\windows\system32\DemoAPI.dll
2010-04-26 16:17 . 2010-04-26 16:17 208896 ----a-w- c:\windows\system32\ATSC70PBA.dll
2010-04-26 16:17 . 2010-04-26 16:17 189952 ----a-w- c:\windows\system32\PBAGUI.dll
2010-04-26 16:17 . 2010-04-26 16:17 -------- d-----w- c:\program files\Acer
2010-04-26 16:17 . 2010-04-26 16:17 57344 ----a-r- c:\users\MasernaUSlunce\AppData\Roaming\Microsoft\Installer\{64BDD01B-70CA-4844-9D2F-38C56FB31E03}\ARPPRODUCTICON.exe
2010-04-26 16:17 . 2010-04-26 16:17 -------- d-----w- c:\program files\Fingerprint Sensor
2010-04-26 15:55 . 2010-04-26 15:55 -------- d-----w- c:\users\MasernaUSlunce\AppData\Roaming\Luxand
2010-04-26 15:54 . 2010-02-09 23:07 4705080 ----a-w- c:\windows\system32\LuxandBlinkLib11.dll
2010-04-26 15:54 . 2010-02-09 23:07 4705080 ----a-w- c:\windows\system32\LuxandBlinkLib1.dll
2010-04-26 15:54 . 2010-02-09 23:06 94008 ----a-w- c:\windows\system32\LuxandBlinkLib12.dll
2010-04-26 15:54 . 2010-02-09 23:06 431416 ----a-w- c:\windows\system32\LuxandCredentialProvider.dll
2010-04-26 15:54 . 2010-04-26 15:54 -------- d-----w- c:\program files\Luxand
2010-04-26 15:54 . 2010-02-09 23:06 628536 ----a-w- c:\windows\system32\LuxandBlink.dll
2010-04-26 15:54 . 2010-04-26 15:54 -------- d-----w- c:\program files\InstallShield Installation Information
2010-04-26 15:53 . 2010-04-26 15:53 -------- d-----w- c:\windows\tiinst
2010-04-26 15:52 . 2010-04-26 15:52 290816 ----a-w- c:\windows\system32\drivers\tifm21.sys
2010-04-26 15:45 . 2009-11-25 20:03 61952 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\AeroBuddy@ReduxTeam\components\dwmxpcom.dll
2010-04-26 15:42 . 2009-11-25 20:03 61952 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll
2010-04-26 15:40 . 2010-02-24 08:16 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-04-26 15:39 . 2009-02-16 21:12 53248 ----a-w- c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\coc@ble.pl\components\dwmxpcom.dll
2010-04-26 15:37 . 2010-04-26 15:37 -------- d-----w- c:\users\MasernaUSlunce\AppData\Local\Mozilla
2010-04-26 15:36 . 2009-10-02 04:06 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-04-26 15:36 . 2009-09-03 07:04 1320960 ----a-w- c:\windows\system32\CertEnroll.dll
2010-04-26 15:36 . 2009-08-29 06:54 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-04-26 15:36 . 2009-08-19 07:20 442920 ----a-w- c:\windows\system32\winresume.exe
2010-04-26 15:36 . 2009-08-19 07:20 507568 ----a-w- c:\windows\system32\winload.exe
2010-04-26 14:36 . 2010-04-26 14:36 57560 ----a-w- c:\users\MasernaUSlunce\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-26 14:35 . 2010-04-29 18:04 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-04-26 14:35 . 2010-04-26 18:55 -------- d-sh--w- c:\windows\Installer
2010-04-26 14:34 . 2010-04-29 18:00 -------- d-----w- c:\windows\system32\wbem\Performance
2010-04-26 14:33 . 2010-02-27 07:32 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-26 14:33 . 2010-02-27 07:32 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-26 14:33 . 2010-02-27 07:32 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\users\Default\Soubory cookie

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-29 18:14 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxpers.exe
2010-04-29 18:14 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\hkcmd.exe
2010-04-29 18:00 . 2009-07-26 17:53 622660 ----a-w- c:\windows\system32\perfh005.dat
2010-04-29 18:00 . 2009-07-26 17:53 118810 ----a-w- c:\windows\system32\perfc005.dat
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxpers .exe
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\hkcmd .exe
2010-04-27 18:29 . 2009-09-23 17:30 36864 ----a-w- c:\windows\system32\igfxtray.exe
2010-04-26 19:02 . 2009-07-13 23:40 249856 ----a-w- c:\windows\system32\uxtheme.dll
2010-04-26 19:02 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\system32\themeui.dll
2010-04-26 19:02 . 2009-07-13 23:39 37376 ----a-w- c:\windows\system32\themeservice.dll
2010-04-26 17:51 . 2010-04-26 17:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-04-26 17:41 . 2010-04-26 17:39 -------- d-----w- c:\program files\Nokia
2010-04-26 17:41 . 2010-04-26 17:41 -------- d-----w- c:\program files\DIFX
2010-04-26 17:41 . 2010-04-26 17:41 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-26 17:39 . 2010-04-26 17:39 12212040 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-04-26 17:39 . 2010-04-26 17:39 13930312 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-04-26 17:39 . 2010-04-26 17:39 77824 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-04-26 17:39 . 2010-04-26 17:39 61440 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-04-26 17:39 . 2010-04-26 17:39 58880 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-04-26 17:39 . 2010-04-26 17:39 50000 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\pcswpc.exe
2010-04-26 17:38 . 2010-04-26 17:39 98366952 ----a-w- c:\programdata\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Nokia_Ovi_Suite_webinstaller_ALL.exe
2010-04-26 16:19 . 2009-07-14 04:52 -------- d-----w- c:\program files\Microsoft Games
2010-04-26 16:19 . 2009-07-14 04:52 -------- d-----w- c:\program files\DVD Maker
2010-04-26 15:54 . 2010-04-26 15:54 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Plocha
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Oblíbené položky
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Šablony
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Nabídka Start
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Dokumenty
2010-04-26 14:27 . 2010-04-26 14:27 -------- d-sh--we c:\programdata\Data aplikací
2010-03-08 21:33 . 2010-04-26 15:35 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-02-27 12:07 . 2010-04-26 15:35 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-27 12:07 . 2010-04-26 15:35 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-23 07:56 . 2010-04-26 15:35 977920 ----a-w- c:\windows\system32\wininet.dll
2010-02-02 07:45 . 2010-04-26 15:35 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

Kód: Vybrat vše

<pre>
c:\program files\Luxand\Blink!\luxandblinktray .exe
c:\program files\Microsoft Security Essentials\msseces .exe
c:\program files\Nokia\Nokia Ovi Suite\nokiaovisuite .exe
c:\windows\System32\hkcmd .exe
c:\windows\System32\igfxpers .exe
</pre>
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-04-29 36864]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-04-29 36864]
"Luxand Blink!"="c:\program files\Luxand\Blink!\LuxandBlinkTray.exe" [2010-04-29 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-27 36864]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-29 36864]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-29 36864]
"Adobe_Reader"="c:\program files\internet explorer\wmpscfgs.exe" [2010-04-29 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2010-04-26 16:17 2860032 ----a-w- c:\program files\Acer\Bio-Protection fingerprint solution\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZPdtWzdVitaKey MC3000]
2010-04-26 16:17 3864064 ----a-w- c:\program files\Acer\Bio-Protection fingerprint solution\PdtWzd.exe

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2009-12-02 42368]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

.
Obsah adresáře 'Naplánované úlohy'

2010-04-29 c:\windows\Tasks\At1.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At10.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At11.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At12.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At13.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At14.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At15.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At16.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At17.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At18.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At19.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At2.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At20.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At21.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At22.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At23.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At24.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At3.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At4.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At5.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At6.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At7.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At8.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]

2010-04-29 c:\windows\Tasks\At9.job
- c:\program files\internet explorer\wmpscfgs.exe [2010-04-29 18:14]
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\AeroBuddy@ReduxTeam\components\dwmxpcom.dll
FF - component: c:\users\MasernaUSlunce\AppData\Roaming\Mozilla\Firefox\Profiles\ghkdcfz8.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\Acer\Bio-Protection fingerprint solution\CompPtcVUI.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Nokia\NoA\nokiaaserver.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-04-29 20:17:01 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-29 18:17
ComboFix2.txt 2010-04-27 19:31

Před spuštěním: Volných bajtů: 145 234 055 168
Po spuštění: Volných bajtů: 145 083 199 488

- - End Of File - - 809B9B5FEA7DCC89A29B15A86E5CB0AC
Nahr nˇ probŘhlo ŁspŘçnŘ

-------------------------------------------------------------------------------------------------------

http://www.virustotal.com/cs/analisis/6 ... 1272565267

http://www.virustotal.com/cs/analisis/6 ... 1272565343

http://www.virustotal.com/cs/analisis/6 ... 1272565411

http://www.virustotal.com/cs/analisis/6 ... 1272565580

http://www.virustotal.com/cs/analisis/6 ... 1272565674

http://www.virustotal.com/cs/analisis/6 ... 1272565780
Nahoru
viktor63
Návštěvník
Návštěvník
Příspěvky: 4
Registrován: 30 říj 2008 16:11
Kontaktovat uživatele:
Kontaktovat uživatele viktor63

Re: TrojanDownloader:Win32/Unruy.C

#6 Příspěvek od viktor63 »

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Verze databáze: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.4.2010 20:38:09
mbam-log-2010-04-29 (20-38-09).txt

Typ skenu: Rychlý sken
Skenované objekty: 107410
Uplynulý čas: 4 minuta(y), 16 sekunda(y)

Infikované procesy v paměti: 4
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 4
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 9

Infikované procesy v paměti:
C:\Program Files\Microsoft Security Essentials\msseces.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\Luxand\Blink!\luxandblinktray.exe (Trojan.Downloader) -> No action taken.
C:\Windows\System32\igfxtray.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\Nokia\Nokia Ovi Suite\nokiaovisuite.exe (Trojan.Downloader) -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msse (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxtray (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hotkeyscmds (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\persistence (Trojan.Downloader) -> No action taken.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\Microsoft Security Essentials\msseces.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\Luxand\Blink!\luxandblinktray.exe (Trojan.Downloader) -> No action taken.
C:\Windows\System32\igfxtray.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\Nokia\Nokia Ovi Suite\nokiaovisuite.exe (Trojan.Downloader) -> No action taken.
C:\Windows\System32\hkcmd.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> No action taken.
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Downloader) -> No action taken.
C:\Windows\System32\hkcmd .exe (Trojan.Downloader) -> No action taken.
C:\Windows\System32\igfxpers .exe (Trojan.Downloader) -> No action taken.
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: TrojanDownloader:Win32/Unruy.C

#7 Příspěvek od Unlimited_Killer »

Tohle bude na delší lokte. :D

1) Aplikace
  • Bohužel budete muset přeinstalovat několik aplikací (teď ne, až řeknu).
    • Konkrétně Blink!, Microsoft Security Essentials, Nokia Ovi Suite a ovladače grafiky Intel.
  • Zatím je tedy neodinstalovávejte, vymažu jen jejich soubory - jsou totiž modifikovány (patchnuty) virem.
  • Jelikož musím smazat i modifikované soubory grafických driverů, pravděpodobně plocha naběhne v předpotopním rozlišení.
2) Skript do ComboFix-u
  • Otevřete si Poznámkový blok [Start → Spustit → notepad → Enter].
  • Do něj vkopírujte následující text:

    Kód: Vybrat vše

    KillAll::

AtJob::

RenV::
c:\program files\Luxand\Blink!\luxandblinktray .exe
c:\program files\Microsoft Security Essentials\msseces .exe
c:\program files\Nokia\Nokia Ovi Suite\nokiaovisuite .exe
c:\windows\System32\hkcmd .exe
c:\windows\System32\igfxpers .exe

File::
c:\program files\Luxand\Blink!\luxandblinktray.exe
c:\program files\Microsoft Security Essentials\msseces.exe
c:\program files\Nokia\Nokia Ovi Suite\nokiaovisuite.exe
c:\windows\System32\hkcmd.exe
c:\windows\System32\igfxpers.exe
c:\program files\internet explorer\wmpscfgs.exe
C:\Program Files\Internet Explorer\js.mui

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaOviSuite2"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"=-
"Luxand Blink!"=-
"IgfxTray"=-
"HotKeysCmds"=-
"Persistence"=-
"Adobe_Reader"=-
"MSSE"=-

Reboot::
  • Uložte tento soubor na Plochu pod jménem CFScript (koncovka .txt).
  • Přetáhněte tento soubor nad ComboFix a pusťte ho.
  • I tento soubor, i ComboFix musí být na Ploše!
    Obrázek
  • ComboFix se spustí a vykoná příkazy ze skriptu.
  • Počítač bude pravděpodobně restartován.
  • Po restartu na Vás vyskočí okno s logem, který mi vkopírujete sem ve formě textu.
inactive
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“