Zdravím,
tak ComboFix proběhl... výsledek níže..., jen cmd nelze spustit, protože je to nejspíš exe soubor. Pokud víte umístění tak bych ho přejmenoval na .com a pak půjde spustit.
Díky.
Použité ovládací přepínače :: c:\users\MARKY\Desktop\CFscript.txt
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-15 do 2010-09-15 )))))))))))))))))))))))))))))))
.
2010-09-15 12:34 . 2010-09-15 12:34 -------- d-----w- c:\users\MARKY\AppData\Local\temp
2010-09-15 12:34 . 2010-09-15 12:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-09-15 12:34 . 2010-09-15 12:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-15 05:49 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-14 22:18 . 2010-09-15 06:02 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-09-14 22:14 . 2010-09-14 22:14 7350968 ----a-w- C:\mssefullinstall-x86fre-cs-cz-vista-win7.com
2010-09-14 21:53 . 2010-09-14 21:53 -------- d-----w- c:\users\MARKY\AppData\Roaming\Uniblue
2010-09-14 21:53 . 2010-09-14 21:53 -------- d-----w- c:\program files\Uniblue
2010-09-14 11:09 . 2010-09-14 11:09 -------- d-----w- C:\_OTL
2010-09-14 05:20 . 2010-09-14 05:20 -------- d-----w- c:\programdata\Kaspersky Lab
2010-09-13 21:14 . 2010-09-13 21:14 -------- d-----w- C:\rsit
2010-09-13 21:14 . 2010-09-13 21:14 -------- d-----w- c:\program files\trend micro
2010-09-13 20:22 . 2010-09-13 20:22 -------- d--h--w- c:\windows\PIF
2010-09-13 20:19 . 2010-09-13 20:19 -------- d-----w- C:\trojan logs
2010-09-13 18:59 . 2010-09-13 18:59 -------- d-----w- c:\users\MARKY\AppData\Roaming\Malwarebytes
2010-09-13 18:59 . 2010-09-13 18:59 -------- d-----w- c:\programdata\Malwarebytes
2010-09-13 18:59 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-13 18:59 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-13 18:59 . 2010-09-13 18:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-31 15:07 . 2010-09-09 14:24 2516 --sha-w- c:\programdata\Protexis\KGyGaAvL.sys
2010-08-31 15:07 . 2010-08-31 15:07 -------- d-----w- c:\programdata\Protexis
2010-08-31 15:03 . 2010-08-31 15:03 -------- d-----w- c:\program files\Microsoft SDKs
2010-08-31 15:03 . 2010-08-31 15:03 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2010-08-28 06:32 . 2010-08-28 06:32 -------- d-----w- C:\tmpDownload
2010-08-28 06:32 . 2010-08-28 06:35 -------- d-----w- C:\YouTubeGet
2010-08-27 15:59 . 2010-08-27 15:59 -------- d-----w- c:\users\MARKY\AppData\Local\Canon Easy-PhotoPrint EX
2010-08-26 13:40 . 2010-04-07 07:10 571904 ----a-w- c:\windows\system32\oleaut32.dll
2010-08-25 21:27 . 2010-08-25 21:27 -------- d-----w- c:\programdata\LightScribe
2010-08-25 21:26 . 2010-09-01 17:50 -------- d-----w- c:\users\MARKY\AppData\Roaming\Nero
2010-08-25 20:51 . 2010-08-25 21:00 -------- d-----w- c:\program files\Nero
2010-08-25 20:51 . 2010-08-25 21:05 -------- d-----w- c:\program files\Common Files\Nero
2010-08-25 20:51 . 2010-08-25 20:56 -------- d-----w- c:\programdata\Nero
2010-08-25 20:51 . 2010-08-25 20:51 -------- d-----w- c:\program files\Common Files\LightScribe
2010-08-22 11:40 . 2010-08-22 11:40 -------- d-----w- c:\program files\PlayReady
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-15 05:52 . 2010-02-26 23:21 -------- d-----w- c:\programdata\Microsoft Help
2010-09-14 22:06 . 2010-02-26 22:58 -------- d-----w- c:\program files\CCleaner
2010-09-14 20:51 . 2010-04-05 18:50 -------- d-----w- c:\program files\FastStone Capture
2010-09-14 20:42 . 2010-03-01 17:26 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-09-14 07:38 . 2010-05-29 08:58 -------- d-----w- c:\program files\123 DVD Converter
2010-09-14 05:21 . 2009-07-14 08:44 634546 ----a-w- c:\windows\system32\perfh005.dat
2010-09-14 05:21 . 2009-07-14 08:44 123104 ----a-w- c:\windows\system32\perfc005.dat
2010-09-13 15:47 . 2010-02-26 17:55 -------- d-----w- c:\program files\ESET
2010-09-12 05:00 . 2010-02-26 19:55 -------- d-----w- c:\users\MARKY\AppData\Roaming\uTorrent
2010-09-11 21:30 . 2010-02-26 23:04 3088 --sha-w- c:\programdata\KGyGaAvL.sys
2010-09-11 21:30 . 2010-02-26 23:04 3088 --sha-w- c:\programdata\KGyGaAvL.sys
2010-09-09 18:41 . 2010-08-09 18:31 -------- d-----w- c:\program files\Common Files\Steam
2010-09-09 18:41 . 2010-08-09 18:31 -------- d-----w- c:\program files\Steam
2010-09-07 20:39 . 2010-02-26 19:55 -------- d-----w- c:\program files\uTorrent
2010-09-06 05:07 . 2010-07-17 09:37 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-31 16:10 . 2010-06-06 16:03 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-08-31 15:07 . 2010-02-26 21:37 141016 ----a-w- c:\users\MARKY\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-31 15:07 . 2010-02-26 23:04 -------- d-----w- c:\users\MARKY\AppData\Roaming\Corel
2010-08-31 15:02 . 2010-02-26 23:03 -------- d-----w- c:\programdata\Corel
2010-08-31 14:58 . 2010-02-26 23:02 -------- d-----w- c:\program files\Corel
2010-08-31 08:04 . 2010-02-28 10:47 -------- d-----w- c:\users\MARKY\AppData\Roaming\Vso
2010-08-30 17:01 . 2010-03-01 17:26 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-08-29 00:03 . 2010-05-29 11:07 -------- d-----w- c:\programdata\vsosdk
2010-08-28 05:26 . 2010-02-26 23:22 -------- d-----w- c:\program files\Microsoft.NET
2010-08-27 06:42 . 2010-02-26 21:06 -------- d-----w- c:\users\MARKY\AppData\Roaming\Skype
2010-08-27 06:33 . 2010-02-26 21:07 -------- d-----w- c:\users\MARKY\AppData\Roaming\skypePM
2010-08-14 10:37 . 2010-03-11 21:25 -------- d-----w- c:\users\MARKY\AppData\Roaming\Canon
2010-08-14 07:17 . 2010-08-14 07:17 -------- d-----w- c:\program files\PhotoZoom Pro 3
2010-08-08 11:04 . 2010-04-16 16:13 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-08-05 06:56 . 2010-03-16 19:23 -------- d-----w- c:\programdata\PC Suite
2010-08-05 06:43 . 2010-08-05 06:43 -------- d-----w- c:\program files\Všeználek to ví
2010-08-05 06:43 . 2010-08-05 06:43 253952 ------w- c:\windows\Setup1.exe
2010-08-05 06:43 . 2010-08-05 06:43 73728 ----a-w- c:\windows\ST6UNST.EXE
2010-07-29 06:30 . 2010-08-12 20:50 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 20:50 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-18 14:28 . 2010-03-16 19:23 -------- d-----w- c:\users\MARKY\AppData\Roaming\PC Suite
2010-06-30 06:25 . 2010-08-12 20:50 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-22 02:47 . 2010-08-12 20:50 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-12 20:50 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-12 20:50 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-12 20:50 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-12 20:50 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-12 20:50 37376 ----a-w- c:\windows\system32\rtutils.dll
2010-06-19 04:07 . 2010-08-12 20:50 2326016 ----a-w- c:\windows\system32\win32k.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2010-08-30 67448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"IaNvSrv"="c:\program files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2009-10-06 33304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-02-08 8505888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\MARKY\AppData\Local\Google\Update\GoogleUpdate.exe" /c
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-02-26 691696]
S0 iaNvStor;Intel(R) Turbo Memory Controller;c:\windows\system32\DRIVERS\iaNvStor.sys [2009-08-21 232472]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet - adaptér;c:\windows\system32\DRIVERS\l160x86.sys [2009-07-13 47104]
S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-12-03 625224]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-06-19 12032]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-06-19 10496]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-06-19 12928]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
S3 netw5v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-09-15 6000640]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
2010-09-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-243422384-3159141069-1851493392-1001Core.job
- c:\users\MARKY\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-19 19:30]
2010-09-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-243422384-3159141069-1851493392-1001UA.job
- c:\users\MARKY\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-19 19:30]
2010-09-14 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2010-09-14 06:25]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-MSSE - c:\program files\Microsoft Security Essentials\msseces.exe
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-243422384-3159141069-1851493392-1001\Software\SecuROM\License information*]
"datasecu"=hex:9d,8d,01,e2,24,b8,5b,fd,25,37,9e,6d,22,a0,a5,a1,e1,91,36,20,31,
d0,08,09,84,85,29,24,5d,65,09,d6,d2,f1,8a,ba,18,0b,7f,40,dc,67,db,41,ad,bc,\
"rkeysecu"=hex:4f,6c,7d,3e,8b,a0,5e,5e,23,38,b6,38,32,71,1e,0d
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-09-15 14:36:36
ComboFix-quarantined-files.txt 2010-09-15 12:36
ComboFix2.txt 2010-09-14 19:30
ComboFix3.txt 2010-09-14 14:57
Před spuštěním: Volných bajtů: 51 165 855 744
Po spuštění: Volných bajtů: 51 117 342 720
- - End Of File - - 30FD74CE02DCA9C665FEA6F7D1FEBE59