Dobrý den kamarádku ted nedavno zacal zlobit pocitac, tak sem si rekl ze ji pomuzu. Zamrzali ji filmy, z FB se ji posilal zpravy se spamem a velmi ji padal Firefox. Log z Rsitu byl proveden az po spusteni Combofixu....
ComboFix 11-01-04.06 - WORKSTATION 05.01.2011 15:37:21.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4095.2832 [GMT 1:00]
Spuštěný z: c:\users\WORKSTATION\Downloads\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\nvsvc32.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-05 do 2011-01-05 )))))))))))))))))))))))))))))))
.
2011-01-05 14:39 . 2011-01-05 14:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-05 14:31 . 2010-12-31 20:06 38848 ----a-w- c:\windows\avastSS.scr
2011-01-05 14:31 . 2010-12-31 20:06 188216 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\programdata\Alwil Software
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\program files\Alwil Software
2011-01-04 20:54 . 2010-03-15 10:31 165376 ----a-w- c:\windows\SysWow64\unrar.dll
2011-01-04 20:54 . 2010-12-27 08:00 80896 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2011-01-04 20:54 . 2010-12-07 18:40 183808 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2011-01-04 20:54 . 2010-12-07 18:22 810496 ----a-w- c:\windows\SysWow64\xvidcore.dll
2011-01-04 20:54 . 2010-11-03 19:08 237568 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2011-01-04 20:54 . 2010-01-17 16:18 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm
2011-01-04 20:54 . 2006-10-18 19:05 232448 ----a-w- c:\windows\SysWow64\mp3fhg.acm
2011-01-04 20:28 . 2011-01-04 20:50 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer
2011-01-04 20:28 . 2011-01-04 20:28 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer Pro
2011-01-04 09:04 . 2010-11-16 11:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{06AB5962-5148-409F-B200-AD898F55C022}\mpengine.dll
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\program files (x86)\ICQ6Toolbar
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\programdata\ICQ
2010-12-29 13:13 . 2011-01-05 14:38 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\ICQ
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\users\WORKSTATION\AppData\Local\AOL
2010-12-24 15:59 . 2010-12-24 15:59 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Electronic Arts
2010-12-24 11:50 . 2010-12-24 11:50 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Mozilla
2010-12-24 11:40 . 2010-12-24 11:40 -------- d-----w- c:\windows\SysWow64\Wat
2010-12-23 17:29 . 2009-09-10 05:52 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll
2010-12-23 17:26 . 2009-11-25 11:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2010-12-23 17:26 . 2009-11-25 11:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2010-12-23 17:26 . 2009-11-25 11:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2010-12-23 17:26 . 2009-11-25 11:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2010-12-23 17:26 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2010-12-23 15:52 . 2010-05-05 06:46 363520 ----a-w- c:\windows\SysWow64\StructuredQuery.dll
2010-12-23 15:51 . 2010-10-16 04:36 314368 ----a-w- c:\windows\SysWow64\webio.dll
2010-12-23 15:48 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll
2010-12-23 15:48 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-02 04:34 . 2010-12-23 15:53 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
2010-10-10 18:01 . 2010-06-08 15:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2010-10-10 18:01 . 2010-06-08 15:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="d:\icq\ICQ7.2\ICQ.exe" [2010-10-27 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-11 98304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-23 1255736]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-11 202752]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-12-31 62032]
S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2009-12-11 6228480]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2009-12-11 160256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
--- Ostatní služby/ovladače v paměti ---
*NewlyCreated* - ASWFSBLK
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWTDI
.
--------- x86-64 -----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - d:\slovník\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - d:\slovník\Verdict Free\etnxp.dll
FF - ProfilePath - c:\users\WORKSTATION\AppData\Roaming\Mozilla\Firefox\Profiles\dmrcdmv5.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.seznam.cz/?sourceid=FF_5&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Seznam lištička: {ea614400-e918-4741-9a97-7a972ff7c30b} - c:\program files (x86)\Mozilla Firefox\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-01-05 15:41:40
ComboFix-quarantined-files.txt 2011-01-05 14:41
Před spuštěním: Volných bajtů: 19 282 681 856
Po spuštění: Volných bajtů: 20 477 874 176
- - End Of File - - A2EB529623015B177B32A068C02D79C8
RSIT
Logfile of random's system information tool 1.08 (written by random/random)
Run by WORKSTATION at 2011-01-05 15:47:30
Microsoft Windows 7 Ultimate
System drive C: has 20 GB (39%) free of 50 GB
Total RAM: 4095 MB (73% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:47:46, on 5.1.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal
Running processes:
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
D:\ICQ\ICQ7.2\ICQ.exe
C:\Users\WORKSTATION\Documents\ICQ\396068041\ReceivedFiles\319192995 Valda\RSIT.exe
C:\Program Files (x86)\trend micro\WORKSTATION.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [ICQ] "D:\ICQ\ICQ7.2\ICQ.exe" silent loginmode=4
O9 - Extra button: Přeložit - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - D:\Slovník\Verdict Free\etnxp.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - D:\Slovník\Verdict Free\etnxp.dll
O9 - Extra 'Tools' menuitem: Internetový překladač... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - D:\Slovník\Verdict Free\etnxp.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ\ICQ7.2\ICQ.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 5094 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2010-06-02 1018616]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-12-11 98304]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=D:\ICQ\ICQ7.2\ICQ.exe [2011-01-05 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWow64\webcheck.dll [2009-07-14 229376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\WORKSTATION\Downloads\facebook-pic00005267.exe"="c:\windows\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 months======
2011-01-05 15:47:30 ----D---- C:\rsit
2011-01-05 15:47:30 ----D---- C:\Program Files (x86)\trend micro
2011-01-05 15:41:41 ----A---- C:\ComboFix.txt
2011-01-05 15:36:51 ----A---- C:\Windows\zip.exe
2011-01-05 15:36:51 ----A---- C:\Windows\SWSC.exe
2011-01-05 15:36:51 ----A---- C:\Windows\SWREG.exe
2011-01-05 15:36:51 ----A---- C:\Windows\sed.exe
2011-01-05 15:36:51 ----A---- C:\Windows\PEV.exe
2011-01-05 15:36:51 ----A---- C:\Windows\NIRCMD.exe
2011-01-05 15:36:51 ----A---- C:\Windows\MBR.exe
2011-01-05 15:36:51 ----A---- C:\Windows\grep.exe
2011-01-05 15:36:47 ----D---- C:\Windows\ERDNT
2011-01-05 15:36:09 ----D---- C:\Qoobox
2011-01-05 15:35:53 ----A---- C:\Windows\SWXCACLS.exe
2011-01-05 15:34:34 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-01-05 15:31:53 ----A---- C:\Windows\SysWOW64\aswBoot.exe
2011-01-05 15:31:52 ----D---- C:\ProgramData\Alwil Software
2011-01-04 21:54:36 ----A---- C:\Windows\SysWOW64\unrar.dll
2011-01-04 21:54:36 ----A---- C:\Windows\avisplitter.ini
2011-01-04 21:54:35 ----A---- C:\Windows\SysWOW64\yv12vfw.dll
2011-01-04 21:54:35 ----A---- C:\Windows\SysWOW64\xvidvfw.dll
2011-01-04 21:54:35 ----A---- C:\Windows\SysWOW64\xvidcore.dll
2011-01-04 21:54:35 ----A---- C:\Windows\SysWOW64\ff_vfw.dll.manifest
2011-01-04 21:54:35 ----A---- C:\Windows\SysWOW64\ff_vfw.dll
2011-01-04 21:28:28 ----D---- C:\Users\WORKSTATION\AppData\Roaming\BSplayer Pro
2011-01-04 21:28:28 ----D---- C:\Users\WORKSTATION\AppData\Roaming\BSplayer
2010-12-29 14:13:40 ----D---- C:\Program Files (x86)\ICQ6Toolbar
2010-12-29 14:13:39 ----D---- C:\ProgramData\ICQ
2010-12-29 14:13:35 ----D---- C:\Users\WORKSTATION\AppData\Roaming\ICQ
2010-12-24 12:50:05 ----D---- C:\Users\WORKSTATION\AppData\Roaming\Mozilla
2010-12-24 12:40:58 ----D---- C:\Windows\SysWOW64\Wat
2010-12-23 18:29:56 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2010-12-23 18:26:00 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2010-12-23 18:26:00 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2010-12-23 18:26:00 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2010-12-23 18:26:00 ----A---- C:\Windows\SysWOW64\mscoree.dll
2010-12-23 18:26:00 ----A---- C:\Windows\SysWOW64\dfshim.dll
2010-12-23 16:53:15 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2010-12-23 16:53:14 ----A---- C:\Windows\SysWOW64\tzres.dll
2010-12-23 16:53:10 ----A---- C:\Windows\SysWOW64\ntdll.dll
2010-12-23 16:53:07 ----A---- C:\Windows\SysWOW64\vbscript.dll
2010-12-23 16:53:05 ----A---- C:\Windows\SysWOW64\t2embed.dll
2010-12-23 16:53:03 ----A---- C:\Windows\SysWOW64\ole32.dll
2010-12-23 16:53:00 ----A---- C:\Windows\SysWOW64\taskschd.dll
2010-12-23 16:53:00 ----A---- C:\Windows\SysWOW64\taskeng.exe
2010-12-23 16:53:00 ----A---- C:\Windows\SysWOW64\taskcomp.dll
2010-12-23 16:53:00 ----A---- C:\Windows\SysWOW64\schtasks.exe
2010-12-23 16:52:57 ----A---- C:\Windows\SysWOW64\StructuredQuery.dll
2010-12-23 16:52:55 ----A---- C:\Windows\SysWOW64\atmlib.dll
2010-12-23 16:52:55 ----A---- C:\Windows\SysWOW64\atmfd.dll
2010-12-23 16:52:53 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\secproc_ssp_isv.dll
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\secproc_ssp.dll
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\secproc_isv.dll
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\secproc.dll
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\RMActivate_ssp.exe
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\RMActivate_isv.exe
2010-12-23 16:52:45 ----A---- C:\Windows\SysWOW64\RMActivate.exe
2010-12-23 16:52:36 ----A---- C:\Windows\SysWOW64\shell32.dll
2010-12-23 16:52:33 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2010-12-23 16:52:33 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2010-12-23 16:52:32 ----A---- C:\Windows\SysWOW64\psisdecd.dll
2010-12-23 16:52:26 ----A---- C:\Windows\SysWOW64\fontsub.dll
2010-12-23 16:52:19 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2010-12-23 16:52:19 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2010-12-23 16:52:17 ----A---- C:\Windows\SysWOW64\schannel.dll
2010-12-23 16:52:13 ----A---- C:\Windows\SysWOW64\comctl32.dll
2010-12-23 16:52:12 ----A---- C:\Windows\SysWOW64\oleaut32.dll
2010-12-23 16:52:11 ----A---- C:\Windows\SysWOW64\explorer.exe
2010-12-23 16:52:11 ----A---- C:\Windows\explorer.exe
2010-12-23 16:52:07 ----A---- C:\Windows\SysWOW64\wow32.dll
2010-12-23 16:52:07 ----A---- C:\Windows\SysWOW64\user.exe
2010-12-23 16:52:07 ----A---- C:\Windows\SysWOW64\setup16.exe
2010-12-23 16:52:07 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2010-12-23 16:52:07 ----A---- C:\Windows\SysWOW64\instnm.exe
2010-12-23 16:52:06 ----A---- C:\Windows\SysWOW64\rtutils.dll
2010-12-23 16:51:59 ----A---- C:\Windows\SysWOW64\webio.dll
2010-12-23 16:51:58 ----A---- C:\Windows\SysWOW64\iccvid.dll
2010-12-23 16:51:47 ----A---- C:\Windows\SysWOW64\wmpmde.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\quartz.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\msyuv.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\msrle32.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2010-12-23 16:51:46 ----A---- C:\Windows\SysWOW64\avifil32.dll
2010-12-23 16:51:37 ----A---- C:\Windows\SysWOW64\msxml3.dll
2010-12-23 16:51:34 ----A---- C:\Windows\SysWOW64\jscript.dll
2010-12-23 16:51:31 ----A---- C:\Windows\SysWOW64\sspicli.dll
2010-12-23 16:51:31 ----A---- C:\Windows\SysWOW64\secur32.dll
2010-12-23 16:51:26 ----A---- C:\Windows\SysWOW64\mfc40u.dll
2010-12-23 16:51:26 ----A---- C:\Windows\SysWOW64\mfc40.dll
2010-12-23 16:51:23 ----A---- C:\Windows\SysWOW64\msasn1.dll
2010-12-23 16:51:22 ----A---- C:\Windows\SysWOW64\wmp.dll
2010-12-23 16:51:21 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2010-12-23 16:51:18 ----A---- C:\Windows\SysWOW64\sscore.dll
2010-12-23 16:50:31 ----A---- C:\Windows\SysWOW64\mshtml.dll
2010-12-23 16:50:31 ----A---- C:\Windows\SysWOW64\iertutil.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\wininet.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\urlmon.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\mstime.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\msfeeds.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\licmgr10.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\iepeers.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\ieframe.dll
2010-12-23 16:50:30 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2010-12-23 16:50:29 ----A---- C:\Windows\SysWOW64\mshtmled.dll
2010-12-23 16:50:29 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2010-12-23 16:50:29 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2010-12-23 16:50:29 ----A---- C:\Windows\SysWOW64\ieui.dll
2010-12-23 16:48:30 ----A---- C:\Windows\SysWOW64\wintrust.dll
2010-12-23 16:48:28 ----A---- C:\Windows\SysWOW64\cabview.dll
======List of files/folders modified in the last 1 months======
2011-01-05 15:47:33 ----D---- C:\Windows\Temp
2011-01-05 15:47:30 ----RD---- C:\Program Files (x86)
2011-01-05 15:40:14 ----D---- C:\Windows
2011-01-05 15:40:14 ----A---- C:\Windows\system.ini
2011-01-05 15:38:48 ----D---- C:\Windows\SysWOW64\drivers
2011-01-05 15:38:48 ----D---- C:\Windows\SysWOW64
2011-01-05 15:38:48 ----D---- C:\Windows\System32
2011-01-05 15:38:48 ----D---- C:\Windows\AppPatch
2011-01-05 15:38:47 ----D---- C:\Program Files (x86)\Common Files
2011-01-05 15:33:32 ----D---- C:\Windows\Prefetch
2011-01-05 15:32:20 ----SHD---- C:\Windows\Installer
2011-01-05 15:32:16 ----D---- C:\Windows\winsxs
2011-01-05 15:31:52 ----SHD---- C:\System Volume Information
2011-01-05 15:31:52 ----RD---- C:\Program Files
2011-01-05 15:31:52 ----D---- C:\ProgramData
2011-01-05 15:15:13 ----D---- C:\Windows\inf
2010-12-29 14:13:39 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-12-25 12:36:05 ----D---- C:\ProgramData\Electronic Arts
2010-12-25 10:09:44 ----D---- C:\Windows\rescache
2010-12-24 19:40:18 ----D---- C:\Windows\Minidump
2010-12-24 16:59:24 ----D---- C:\Program Files (x86)\Electronic Arts
2010-12-24 16:48:51 ----D---- C:\Windows\Microsoft.NET
2010-12-24 16:48:47 ----RSD---- C:\Windows\assembly
2010-12-24 12:41:06 ----D---- C:\Windows\SysWOW64\cs-CZ
2010-12-24 12:41:05 ----D---- C:\Program Files (x86)\Internet Explorer
2010-12-24 12:41:03 ----D---- C:\Windows\ehome
2010-12-24 12:41:03 ----D---- C:\Program Files (x86)\Windows Mail
2010-12-24 12:40:56 ----D---- C:\Program Files (x86)\Windows Media Player
2010-12-24 12:40:55 ----D---- C:\Windows\SysWOW64\migration
2010-12-23 18:21:45 ----D---- C:\Windows\SoftwareDistribution
2010-12-23 16:47:39 ----D---- C:\Windows\Logs
2010-12-23 12:02:46 ----SD---- C:\ProgramData\Microsoft
2010-12-18 15:30:29 ----D---- C:\Windows\debug
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 aswRdr;aswRdr; C:\Windows\SysWOW64\drivers\aswRdr.sys []
R1 aswSP;aswSP; C:\Windows\SysWOW64\drivers\aswSP.sys []
R1 aswTdi;avast! Network Shield Support; C:\Windows\SysWOW64\drivers\aswTdi.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R2 aswFsBlk;aswFsBlk; C:\Windows\SysWOW64\drivers\aswFsBlk.sys []
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys []
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys []
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys []
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys []
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys []
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys []
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe []
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-12-31 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Zprávy z facebooku
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: Zprávy z facebooku
Zdravim a pekny den preji 
Kdyz tak rad pouzivate ComboFix a pomahat, tak proc si jeho log nevylustite 
Svevolne pouziti CFka je zakazano, navic vizte nebezepeci nize
Nebezpeci CFka
Pokud nemate, tak presunte Combofix na plochu
Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
Kdyz tak rad pouzivate ComboFix a pomahat, tak proc si jeho log nevylustite Svevolne pouziti CFka je zakazano, navic vizte nebezepeci nize Nebezpeci CFka
- Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
- Maze stopy po haveti, takze v logu z RSIT neni nic videt
- Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
- CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
- CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal
Pokud nemate, tak presunte Combofix na plochu
- Spustte poznamkovy blok (Start-spustit-notepad)
- Zkopirujte skript nize
Kód: Vybrat vše
Folder:: c:\program files (x86)\ICQ6Toolbar Registry:: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Users\WORKSTATION\Downloads\facebook-pic00005267.exe"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{855F3B16-6D32-4FE6-8A56-BBB695989046}"=- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{855F3B16-6D32-4fe6-8A56-BBB695989046}"=- Driver:: ICQ Service DDS:: uStart Page = hxxp://start.icq.com/ Firefox:: FF - ProfilePath - c:\users\WORKSTATION\AppData\Roaming\Mozilla\Firefox\Profiles\dmrcdmv5.default\ FF - prefs.js: keyword.URL - hxxp://search.seznam.cz/?sourceid=FF_5&q= RegLock:: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] File:: C:\Users\WORKSTATION\Downloads\facebook-pic00005267.exe- Ulozte vytvoreny TXT jako CFScript.txt
- Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
- Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen
od 1. února 2011.
Člen
od 1. února 2011.Re: Zprávy z facebooku
Omlouvam se, kamaradka me poslala pouze ty logy, uz sem ji poucil... Diky moc ale za pomoc. Tu je log
ComboFix 11-01-04.06 - WORKSTATION 05.01.2011 18:07:00.2.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4095.2866 [GMT 1:00]
Spuštěný z: c:\users\WORKSTATION\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\WORKSTATION\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FILE ::
"c:\users\WORKSTATION\Downloads\facebook-pic00005267.exe"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files (x86)\ICQ6Toolbar
c:\program files (x86)\ICQ6Toolbar\config.xml
c:\program files (x86)\ICQ6Toolbar\Icons.bmp
c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe
c:\program files (x86)\ICQ6Toolbar\icq6Toolbar.ico
c:\program files (x86)\ICQ6Toolbar\ICQToolBar.dll
c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files (x86)\ICQ6Toolbar\logo_small.gif
c:\program files (x86)\ICQ6Toolbar\ServiceStarter.exe
c:\program files (x86)\ICQ6Toolbar\short.wav
c:\program files (x86)\ICQ6Toolbar\Version.txt
c:\users\WORKSTATION\Downloads\facebook-pic00005267.exe
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_ICQ Service
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-05 do 2011-01-05 )))))))))))))))))))))))))))))))
.
2011-01-05 17:09 . 2011-01-05 17:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-05 14:47 . 2011-01-05 14:47 -------- d-----w- C:\rsit
2011-01-05 14:47 . 2011-01-05 14:47 -------- d-----w- c:\program files (x86)\trend micro
2011-01-05 14:31 . 2010-12-31 20:06 38848 ----a-w- c:\windows\avastSS.scr
2011-01-05 14:31 . 2010-12-31 20:06 188216 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\programdata\Alwil Software
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\program files\Alwil Software
2011-01-04 20:54 . 2010-03-15 10:31 165376 ----a-w- c:\windows\SysWow64\unrar.dll
2011-01-04 20:54 . 2010-12-27 08:00 80896 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2011-01-04 20:54 . 2010-12-07 18:40 183808 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2011-01-04 20:54 . 2010-12-07 18:22 810496 ----a-w- c:\windows\SysWow64\xvidcore.dll
2011-01-04 20:54 . 2010-11-03 19:08 237568 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2011-01-04 20:54 . 2010-01-17 16:18 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm
2011-01-04 20:54 . 2006-10-18 19:05 232448 ----a-w- c:\windows\SysWow64\mp3fhg.acm
2011-01-04 20:28 . 2011-01-04 20:50 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer
2011-01-04 20:28 . 2011-01-04 20:28 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer Pro
2011-01-04 09:04 . 2010-11-16 11:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{06AB5962-5148-409F-B200-AD898F55C022}\mpengine.dll
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\programdata\ICQ
2010-12-29 13:13 . 2011-01-05 17:10 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\ICQ
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\users\WORKSTATION\AppData\Local\AOL
2010-12-24 15:59 . 2010-12-24 15:59 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Electronic Arts
2010-12-24 11:50 . 2010-12-24 11:50 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Mozilla
2010-12-24 11:40 . 2010-12-24 11:40 -------- d-----w- c:\windows\SysWow64\Wat
2010-12-23 17:29 . 2009-09-10 05:52 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll
2010-12-23 17:26 . 2009-11-25 11:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2010-12-23 17:26 . 2009-11-25 11:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2010-12-23 17:26 . 2009-11-25 11:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2010-12-23 17:26 . 2009-11-25 11:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2010-12-23 17:26 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2010-12-23 15:52 . 2010-05-05 06:46 363520 ----a-w- c:\windows\SysWow64\StructuredQuery.dll
2010-12-23 15:51 . 2010-10-16 04:36 314368 ----a-w- c:\windows\SysWow64\webio.dll
2010-12-23 15:48 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll
2010-12-23 15:48 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-02 04:34 . 2010-12-23 15:53 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
2010-10-10 18:01 . 2010-06-08 15:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2010-10-10 18:01 . 2010-06-08 15:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-01-05_14.40.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-01-05 14:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-01-05 14:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-01-05 14:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-01-05 17:10 . 2011-01-05 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-01-05 14:11 . 2011-01-05 14:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-01-05 17:10 . 2011-01-05 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-01-05 14:11 . 2011-01-05 14:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-01-05 14:15 606992 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-01-05 16:52 606992 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-01-05 14:15 622422 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-01-05 16:52 622422 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-01-05 16:52 103370 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-01-05 14:15 103370 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-01-05 14:15 118604 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-01-05 16:52 118604 c:\windows\system32\perfc005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="d:\icq\ICQ7.2\ICQ.exe" [2011-01-05 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-11 98304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-23 1255736]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-11 202752]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-12-31 62032]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2009-12-11 6228480]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2009-12-11 160256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
.
--------- x86-64 -----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF17243.cfxxe" [X]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - d:\slovník\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - d:\slovník\Verdict Free\etnxp.dll
FF - ProfilePath - c:\users\WORKSTATION\AppData\Roaming\Mozilla\Firefox\Profiles\dmrcdmv5.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Seznam lištička: {ea614400-e918-4741-9a97-7a972ff7c30b} - c:\program files (x86)\Mozilla Firefox\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-ICQToolbar - c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
.
**************************************************************************
.
Celkový čas: 2011-01-05 18:12:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-05 17:12
ComboFix2.txt 2011-01-05 14:41
Před spuštěním: Volných bajtů: 20 389 072 896
Po spuštění: Volných bajtů: 19 890 040 832
- - End Of File - - FF0936A52479C7BA6D3B8BCB82E1AF8C
ComboFix 11-01-04.06 - WORKSTATION 05.01.2011 18:07:00.2.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4095.2866 [GMT 1:00]
Spuštěný z: c:\users\WORKSTATION\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\WORKSTATION\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FILE ::
"c:\users\WORKSTATION\Downloads\facebook-pic00005267.exe"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files (x86)\ICQ6Toolbar
c:\program files (x86)\ICQ6Toolbar\config.xml
c:\program files (x86)\ICQ6Toolbar\Icons.bmp
c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe
c:\program files (x86)\ICQ6Toolbar\icq6Toolbar.ico
c:\program files (x86)\ICQ6Toolbar\ICQToolBar.dll
c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files (x86)\ICQ6Toolbar\logo_small.gif
c:\program files (x86)\ICQ6Toolbar\ServiceStarter.exe
c:\program files (x86)\ICQ6Toolbar\short.wav
c:\program files (x86)\ICQ6Toolbar\Version.txt
c:\users\WORKSTATION\Downloads\facebook-pic00005267.exe
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_ICQ Service
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-05 do 2011-01-05 )))))))))))))))))))))))))))))))
.
2011-01-05 17:09 . 2011-01-05 17:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-05 14:47 . 2011-01-05 14:47 -------- d-----w- C:\rsit
2011-01-05 14:47 . 2011-01-05 14:47 -------- d-----w- c:\program files (x86)\trend micro
2011-01-05 14:31 . 2010-12-31 20:06 38848 ----a-w- c:\windows\avastSS.scr
2011-01-05 14:31 . 2010-12-31 20:06 188216 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\programdata\Alwil Software
2011-01-05 14:31 . 2011-01-05 14:31 -------- d-----w- c:\program files\Alwil Software
2011-01-04 20:54 . 2010-03-15 10:31 165376 ----a-w- c:\windows\SysWow64\unrar.dll
2011-01-04 20:54 . 2010-12-27 08:00 80896 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2011-01-04 20:54 . 2010-12-07 18:40 183808 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2011-01-04 20:54 . 2010-12-07 18:22 810496 ----a-w- c:\windows\SysWow64\xvidcore.dll
2011-01-04 20:54 . 2010-11-03 19:08 237568 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2011-01-04 20:54 . 2010-01-17 16:18 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm
2011-01-04 20:54 . 2006-10-18 19:05 232448 ----a-w- c:\windows\SysWow64\mp3fhg.acm
2011-01-04 20:28 . 2011-01-04 20:50 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer
2011-01-04 20:28 . 2011-01-04 20:28 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\BSplayer Pro
2011-01-04 09:04 . 2010-11-16 11:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{06AB5962-5148-409F-B200-AD898F55C022}\mpengine.dll
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\programdata\ICQ
2010-12-29 13:13 . 2011-01-05 17:10 -------- d-----w- c:\users\WORKSTATION\AppData\Roaming\ICQ
2010-12-29 13:13 . 2010-12-29 13:13 -------- d-----w- c:\users\WORKSTATION\AppData\Local\AOL
2010-12-24 15:59 . 2010-12-24 15:59 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Electronic Arts
2010-12-24 11:50 . 2010-12-24 11:50 -------- d-----w- c:\users\WORKSTATION\AppData\Local\Mozilla
2010-12-24 11:40 . 2010-12-24 11:40 -------- d-----w- c:\windows\SysWow64\Wat
2010-12-23 17:29 . 2009-09-10 05:52 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll
2010-12-23 17:26 . 2009-11-25 11:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2010-12-23 17:26 . 2009-11-25 11:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2010-12-23 17:26 . 2009-11-25 11:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2010-12-23 17:26 . 2009-11-25 11:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2010-12-23 17:26 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2010-12-23 15:52 . 2010-05-05 06:46 363520 ----a-w- c:\windows\SysWow64\StructuredQuery.dll
2010-12-23 15:51 . 2010-10-16 04:36 314368 ----a-w- c:\windows\SysWow64\webio.dll
2010-12-23 15:48 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll
2010-12-23 15:48 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-02 04:34 . 2010-12-23 15:53 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
2010-10-10 18:01 . 2010-06-08 15:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2010-10-10 18:01 . 2010-06-08 15:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-01-05_14.40.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-01-05 14:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-01-05 14:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-01-05 14:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-01-05 17:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-01-05 17:10 . 2011-01-05 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-01-05 14:11 . 2011-01-05 14:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-01-05 17:10 . 2011-01-05 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-01-05 14:11 . 2011-01-05 14:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-01-05 14:15 606992 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-01-05 16:52 606992 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-01-05 14:15 622422 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-01-05 16:52 622422 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-01-05 16:52 103370 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-01-05 14:15 103370 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-01-05 14:15 118604 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-01-05 16:52 118604 c:\windows\system32\perfc005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="d:\icq\ICQ7.2\ICQ.exe" [2011-01-05 133432]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-11 98304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-23 1255736]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-11 202752]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-12-31 62032]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2009-12-11 6228480]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2009-12-11 160256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
.
--------- x86-64 -----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF17243.cfxxe" [X]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - d:\slovník\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - d:\slovník\Verdict Free\etnxp.dll
FF - ProfilePath - c:\users\WORKSTATION\AppData\Roaming\Mozilla\Firefox\Profiles\dmrcdmv5.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Seznam lištička: {ea614400-e918-4741-9a97-7a972ff7c30b} - c:\program files (x86)\Mozilla Firefox\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-ICQToolbar - c:\program files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
.
**************************************************************************
.
Celkový čas: 2011-01-05 18:12:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-05 17:12
ComboFix2.txt 2011-01-05 14:41
Před spuštěním: Volných bajtů: 20 389 072 896
Po spuštění: Volných bajtů: 19 890 040 832
- - End Of File - - FF0936A52479C7BA6D3B8BCB82E1AF8C
Re: Zprávy z facebooku
Jak se chova PC, stale si sam povida po FB
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Zprávy z facebooku
FB je jiz normalni nikdo si ji nestezuje ze by rozesilala neco, pracuje vse jak ma byt.... Diky moc
Re: Zprávy z facebooku
Jeste tedy uklidime 
Odinstalujte Combofix
T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe
OTC http://oldtimer.geekstogo.com/OTC.exe
TFC http://oldtimer.geekstogo.com/TFC.exe
Stahnete Ccleaner (viz muj podpis)
Panel čistič
A pokud tedy nejsou problemy nebo dotazy, je to z me strany vse 
Nemate zac, rad jsem pomohl Zase nekdy 
Odinstalujte Combofix
- Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
- Napiste ComboFix /Uninstall
- Stisknete Enter
- Tohle smaze Combofix a jeho slozky
T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe
- Stahnete a spustte
- Pro potvrzeni volby mackejte A, Enter
- Po pouziti utilitu smazte
- Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
OTC http://oldtimer.geekstogo.com/OTC.exe
- Stahnete a spustte
- Kliknete na CleanUp a potvrdte YES
- Program uklidi a restartuje PC
TFC http://oldtimer.geekstogo.com/TFC.exe
- Stahnete a spustte
- Kliknete na Start a potvrdte OK
- Program uklidi a restartuje pc
- Po pouziti utilitu smazte
Stahnete Ccleaner (viz muj podpis)Panel čistič
- Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
- dejte Hledej problémy
- nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
- postup opakujte dokud nebude bez problemu - vetsinou cca 3x
- Zde muzete odinstalovat nepotrebne programy
A pokud tedy nejsou problemy nebo dotazy, je to z me strany vse Nemate zac, rad jsem pomohl
Zase nekdy "Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.
Přispějete na provoz fóra?