Prosím o Preventivku

[anakin8]

Žádnou chybu jsem nezanamenal přesto prosím o preventivní kontrolu Log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by AnAkI at 2011-06-25 22:50:05
Microsoft Windows 7 Home Premium
System drive C: has 1 GB (6%) free of 20 GB
Total RAM: 2046 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:50:23, on 25.6.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\vsnp2uvc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\Programy\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Users\AnAkI\Desktop\Sfbot\sfBot.exe
C:\Program Files\Skype\Phone\Skype.exe
D:\Winrar\WinRAR.exe
C:\Program Files\Auto Clicker\AutoClicker.exe
D:\Prohlízece\Mozilla Firefox\firefox.exe
D:\Prohlízece\Mozilla Firefox\firefox.exe
D:\Prohlízece\Mozilla Firefox\plugin-container.exe
D:\Hry\GTA San Andreas\samp.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\SearchFilterHost.exe
D:\RSIT.exe
C:\Program Files\trend micro\AnAkI.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home?AF=17981
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll
O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
O4 - HKLM\..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programy\Quick Time\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [vcs4diamond] C:\Users\AnAkI\Desktop\AV Vcs 4.0 DIAMOND\Vcs4Core.exe
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [HKLM] C:\Windows\Windows Update\iexplorer.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\Windows\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [HKCU] C:\Windows\Windows Update\iexplorer.exe
O4 - HKCU\..\Run: [KiesHelper] D:\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesTrayAgent] D:\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MurGee.com Auto Clicker] C:\Program Files\Auto Clicker\AutoClicker.exe :silent
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\Windows Update\iexplorer.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\Windows Update\iexplorer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: MorphVOX.lnk = ?
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Apache2.2 - Apache Software Foundation - D:\xampp\apache\bin\httpd.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: mysql - Unknown owner - D:\xampp\mysql\bin\mysqld.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @C:\Windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe,-100 (WPFFontCache_v0400) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe (file missing)

--
End of file - 7528 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]
Dealio Toolbar - C:\Program Files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll [2011-05-06 734048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-04-15 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - Dealio Toolbar - C:\Program Files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll [2011-05-06 734048]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"snp2uvc"=C:\Windows\vsnp2uvc.exe [2007-03-12 569344]
"tsnp2uvc"=C:\Windows\tsnp2uvc.exe []
"LogitechCommunicationsManager"=C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [2007-03-06 488984]
"QuickTime Task"=D:\Programy\Quick Time\QTTask.exe [2010-11-29 421888]
"vcs4diamond"=C:\Users\AnAkI\Desktop\AV Vcs 4.0 DIAMOND\Vcs4Core.exe [2005-12-15 283648]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408]
"HKLM"=C:\Windows\Windows Update\iexplorer.exe [2006-06-10 389120]
"WinampAgent"=D:\Program Files\Winamp\winampa.exe [2011-03-22 74752]
"PAC7302_Monitor"=C:\Windows\PixArt\PAC7302\Monitor.exe []
"LogMeIn Hamachi Ui"=D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
""= []
"SearchSettings"=C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe [2011-05-06 532320]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies"=C:\Windows\Windows Update\iexplorer.exe [2006-06-10 389120]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=D:\Programy\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"HKCU"=C:\Windows\Windows Update\iexplorer.exe [2006-06-10 389120]
"KiesHelper"=D:\Kies\KiesHelper.exe [2011-01-29 888120]
"KiesTrayAgent"=D:\Kies\KiesTrayAgent.exe [2011-01-29 3372856]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-06-15 15141768]
"MurGee.com Auto Clicker"=C:\Program Files\Auto Clicker\AutoClicker.exe [2011-05-04 40960]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies"=C:\Windows\Windows Update\iexplorer.exe [2006-06-10 389120]

C:\Users\AnAkI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe
MorphVOX.lnk - C:\Program Files\Screaming Bee\MorphVOX Pro\MorphVOX.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\AnAkI\AppData\Local\Temp\cryptedbycrypter.exe"="C:\Users\AnAkI\AppData\Local\Temp\cryptedbycrypter.exe:*:Enabled:Windows Messanger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-06-25 22:50:07 ----D---- C:\Program Files\trend micro
2011-06-25 22:50:05 ----D---- C:\rsit
2011-06-25 18:00:41 ----D---- C:\Program Files\Auto Clicker
2011-06-25 17:04:12 ----D---- C:\Program Files\WinPcap
2011-06-24 14:02:57 ----D---- C:\Program Files\Common Files\Java
2011-06-24 13:43:09 ----A---- C:\Windows\system32\javaws.exe
2011-06-24 13:43:09 ----A---- C:\Windows\system32\javaw.exe
2011-06-24 13:43:09 ----A---- C:\Windows\system32\java.exe
2011-06-23 21:25:17 ----A---- C:\Windows\system32\npptNT2.sys
2011-06-23 21:24:58 ----D---- C:\Program Files\Common Files\INCA Shared
2011-06-23 20:51:11 ----D---- C:\ProgramData\GarenaMessenger
2011-06-23 19:45:27 ----D---- C:\Program Files\Dealio Toolbar
2011-06-23 19:45:27 ----D---- C:\Program Files\Application Updater
2011-06-23 19:40:39 ----AH---- C:\Windows\system32\hamachi.sys
2011-06-23 17:05:43 ----SHD---- C:\Config.Msi
2011-06-23 17:05:16 ----A---- C:\Windows\system32\mshtmled.dll
2011-06-23 17:05:15 ----A---- C:\Windows\system32\jscript9.dll
2011-06-23 17:05:15 ----A---- C:\Windows\system32\jscript.dll
2011-06-23 17:05:15 ----A---- C:\Windows\system32\ieui.dll
2011-06-23 17:05:15 ----A---- C:\Windows\system32\iertutil.dll
2011-06-23 17:05:13 ----A---- C:\Windows\system32\mshtml.dll
2011-06-23 17:05:13 ----A---- C:\Windows\system32\ieframe.dll
2011-06-23 17:05:12 ----A---- C:\Windows\system32\urlmon.dll
2011-06-23 16:55:17 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-06-23 16:55:17 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-06-23 16:55:17 ----A---- C:\Windows\system32\drivers\srv.sys
2011-06-23 16:55:14 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-06-23 16:55:13 ----A---- C:\Windows\system32\drivers\afd.sys
2011-06-23 16:55:12 ----A---- C:\Windows\system32\drivers\dfsc.sys
2011-06-23 16:55:04 ----A---- C:\Windows\system32\oleaut32.dll
2011-06-23 16:54:56 ----A---- C:\Windows\system32\inetcomm.dll
2011-06-23 16:54:36 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-06-23 16:54:36 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-06-23 16:54:36 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-06-12 21:57:45 ----D---- C:\Program Files\Samsung
2011-05-29 19:35:39 ----A---- C:\Windows\system32\wininet.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-05-29 19:35:39 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-05-29 19:35:39 ----A---- C:\Windows\system32\msrating.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\msls31.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\mshtmler.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\msfeedssync.exe
2011-05-29 19:35:39 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\jsproxy.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\iesysprep.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\ieakeng.dll
2011-05-29 19:35:39 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\wextract.exe
2011-05-29 19:35:38 ----A---- C:\Windows\system32\webcheck.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\vbscript.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\url.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\pngfilt.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\occache.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\mshta.exe
2011-05-29 19:35:38 ----A---- C:\Windows\system32\msfeeds.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\licmgr10.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\inseng.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\iexpress.exe
2011-05-29 19:35:38 ----A---- C:\Windows\system32\ieUnatt.exe
2011-05-29 19:35:38 ----A---- C:\Windows\system32\iesetup.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\iernonce.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\iedkcs32.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\ieapfltr.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\ieakui.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\ieaksie.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\ie4uinit.exe
2011-05-29 19:35:38 ----A---- C:\Windows\system32\icardie.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\dxtrans.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\dxtmsft.dll
2011-05-29 19:35:38 ----A---- C:\Windows\system32\admparse.dll
2011-05-29 19:35:37 ----A---- C:\Windows\system32\imgutil.dll
2011-05-29 19:35:37 ----A---- C:\Windows\system32\iepeers.dll
2011-05-26 20:13:41 ----D---- C:\Windows\cs
2011-05-26 20:11:43 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2011-05-26 20:11:04 ----D---- C:\Windows\PCHEALTH
2011-05-26 20:10:32 ----D---- C:\Program Files\Windows Live
2011-05-26 20:09:23 ----A---- C:\Windows\system32\UIRibbonRes.dll
2011-05-26 20:09:23 ----A---- C:\Windows\system32\UIRibbon.dll
2011-05-26 20:08:42 ----D---- C:\Program Files\YouTube Downloader

======List of files/folders modified in the last 1 months======

2011-06-25 22:50:22 ----D---- C:\Windows\Prefetch
2011-06-25 22:50:07 ----RD---- C:\Program Files
2011-06-25 22:49:42 ----D---- C:\Windows\Temp
2011-06-25 22:45:56 ----D---- C:\Users\AnAkI\AppData\Roaming\Skype
2011-06-25 21:15:46 ----D---- C:\Windows\System32
2011-06-25 21:01:39 ----D---- C:\Windows\tracing
2011-06-25 19:18:50 ----D---- C:\Windows\system32\drivers
2011-06-25 17:03:31 ----D---- C:\Windows
2011-06-25 11:39:04 ----D---- C:\Windows\system32\config
2011-06-25 11:28:47 ----D---- C:\Users\AnAkI\AppData\Roaming\Hamachi
2011-06-25 05:56:37 ----SHD---- C:\System Volume Information
2011-06-25 04:37:57 ----RSD---- C:\Windows\assembly
2011-06-25 04:37:57 ----D---- C:\Windows\Microsoft.NET
2011-06-25 03:29:42 ----D---- C:\Windows\system32\DriverStore
2011-06-25 03:28:16 ----D---- C:\Windows\winsxs
2011-06-25 03:09:10 ----SHD---- C:\Windows\Installer
2011-06-25 03:06:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-06-25 03:06:48 ----D---- C:\Windows\inf
2011-06-24 19:44:10 ----D---- C:\Windows\system32\catroot
2011-06-24 19:42:31 ----D---- C:\Windows\system32\NDF
2011-06-24 14:15:22 ----D---- C:\Windows\system32\Tasks
2011-06-24 14:15:18 ----RD---- C:\Program Files\Skype
2011-06-24 14:15:13 ----D---- C:\ProgramData\Skype
2011-06-24 14:14:58 ----D---- C:\Program Files\Common Files
2011-06-24 14:14:40 ----D---- C:\Users\AnAkI\AppData\Roaming\skypePM
2011-06-24 13:42:44 ----D---- C:\Program Files\Java
2011-06-23 22:55:32 ----A---- C:\Windows\system32\MRT.exe
2011-06-23 22:54:07 ----D---- C:\Program Files\Microsoft Silverlight
2011-06-23 20:51:11 ----HD---- C:\ProgramData
2011-06-23 20:14:45 ----D---- C:\ProgramData\Skype Extras
2011-06-23 19:45:27 ----D---- C:\Program Files\Common Files\Spigot
2011-06-23 19:38:35 ----D---- C:\Program Files\Internet Explorer
2011-06-23 17:05:22 ----D---- C:\Windows\system32\catroot2
2011-06-12 21:59:57 ----D---- C:\Windows\ModemLogs
2011-06-12 21:58:20 ----D---- C:\Users\AnAkI\AppData\Roaming\Samsung
2011-06-12 21:57:44 ----HD---- C:\Program Files\InstallShield Installation Information
2011-06-08 15:26:59 ----D---- C:\Windows\system32\drivers\UMDF
2011-05-30 11:28:51 ----D---- C:\Windows\rescache
2011-05-29 19:40:12 ----D---- C:\Windows\system32\cs-CZ
2011-05-29 19:40:11 ----D---- C:\Windows\system32\migration
2011-05-29 19:40:11 ----D---- C:\Windows\PolicyDefinitions
2011-05-29 19:40:10 ----D---- C:\Windows\system32\en-US
2011-05-29 19:36:30 ----D---- C:\Windows\Logs
2011-05-29 19:36:28 ----D---- C:\Windows\servicing
2011-05-26 20:11:08 ----SD---- C:\ProgramData\Microsoft
2011-05-26 20:11:04 ----D---- C:\Program Files\Common Files\microsoft shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-03-26 218688]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-10-24 165264]
R1 MpKsl244ff8b7;MpKsl244ff8b7; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{634A138A-E787-47D7-A23B-8FCCF59C63C6}\MpKsl244ff8b7.sys [2011-06-25 28752]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2011-04-26 162544]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2011-04-26 44784]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35088]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-07-14 117248]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-14 4194816]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2011-05-15 25280]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
R3 SCREAMINGBDRIVER;Screaming Bee Audio; C:\Windows\system32\drivers\ScreamingBAudio.sys [2006-09-26 21920]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM); C:\Windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter; C:\Windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers; C:\Windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM); C:\Windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2011-04-26 111280]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2011-04-26 122224]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM); C:\Windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]
R3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
S1 MpKsl10cdd7db;MpKsl10cdd7db; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8B851015-91F3-49CD-885A-BFCC7CFF75A8}\MpKsl10cdd7db.sys []
S1 MpKsl10deba58;MpKsl10deba58; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsl10deba58.sys []
S1 MpKsl12bebebc;MpKsl12bebebc; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl12bebebc.sys []
S1 MpKsl18adab24;MpKsl18adab24; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{265DF8D3-5795-4881-80AA-1FFC3DCF5786}\MpKsl18adab24.sys []
S1 MpKsl34216673;MpKsl34216673; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl34216673.sys []
S1 MpKsl38a55995;MpKsl38a55995; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl38a55995.sys []
S1 MpKsl6c7fa04c;MpKsl6c7fa04c; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsl6c7fa04c.sys []
S1 MpKsl6efde636;MpKsl6efde636; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl6efde636.sys []
S1 MpKsl7fa34fd9;MpKsl7fa34fd9; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKsl7fa34fd9.sys []
S1 MpKsl8c811070;MpKsl8c811070; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl8c811070.sys []
S1 MpKslab88d86f;MpKslab88d86f; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKslab88d86f.sys []
S1 MpKslbea2a191;MpKslbea2a191; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKslbea2a191.sys []
S1 MpKsld5c6100c;MpKsld5c6100c; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsld5c6100c.sys []
S1 MpKsldf5811c5;MpKsldf5811c5; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsldf5811c5.sys []
S1 MpKsle1dd25cc;MpKsle1dd25cc; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsle1dd25cc.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 iaStor;iaStor; C:\Windows\system32\DRIVERS\iaStor.sys [2009-06-04 330264]
S3 LVcKap;Logitech AEC Driver; C:\Windows\system32\DRIVERS\LVcKap.sys [2007-03-06 1669664]
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\Windows\system32\DRIVERS\LVMVDrv.sys [2007-03-06 2261792]
S3 PAC7302;PAC7302 VGA USB Camera; C:\Windows\system32\DRIVERS\PAC7302.SYS [2007-06-14 457856]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apache2.2;Apache2.2; D:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
R2 Application Updater;Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [2011-05-06 393112]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; D:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 11736]
R2 mysql;mysql; D:\xampp\mysql\bin\mysqld.exe [2010-12-03 8133120]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 LVSrvLauncher;LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [2007-03-06 105248]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.21006\aspnet_state.exe [2009-10-07 35144]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2011-06-19 4122968]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2010-06-25 117264]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-12-22 104944]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-20 1343400]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe []
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.21006\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.21006\SMSvcHost.exe -NetMsmqActivator []
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.21006\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.21006\SMSvcHost.exe []
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.21006\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.21006\SMSvcHost.exe []

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Haveti tam vsak mate male stadecko

Uvolnete volne misto na disku, alespon na 5 giga, system se jinak dusi

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[anakin8]

Ano hned jenom jak se snažím co se snažím uvolnit místo se mi nedaří

[anakin8]

Combo fix log


ComboFix 11-06-25.05 - AnAkI 26.06.2011 11:12:43.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2046.826 [GMT 2:00]
Spuštěný z: D:\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Dealio Toolbar
c:\program files\Dealio Toolbar\FF\chrome.manifest
c:\program files\Dealio Toolbar\FF\chrome\content\chevron.js
c:\program files\Dealio Toolbar\FF\chrome\content\chevron.xul
c:\program files\Dealio Toolbar\FF\chrome\content\login.js
c:\program files\Dealio Toolbar\FF\chrome\content\login.xul
c:\program files\Dealio Toolbar\FF\chrome\content\parser.js
c:\program files\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js
c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.js
c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.xul
c:\program files\Dealio Toolbar\FF\chrome\content\utils.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgicomm.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgihandling.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgichevron.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgilisteners.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js
c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul
c:\program files\Dealio Toolbar\FF\chrome\content\widgiui.js
c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd
c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd
c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties
c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\amazon.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\apple.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\barnes.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\bestbuy.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\ebay.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\chevron.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\icon_settings.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\macys.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\newegg.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\overstock.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search-button.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search_amazon.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search_dealio.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search_ebay.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\searchbox.css
c:\program files\Dealio Toolbar\FF\chrome\skin\splitter.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\target.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\walmart.gif
c:\program files\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css
c:\program files\Dealio Toolbar\FF\install.rdf
c:\program files\Dealio Toolbar\IE\4.4\config.ini
c:\program files\Dealio Toolbar\IE\4.4\dealioToolbarIE.dll
c:\program files\Dealio Toolbar\Res\amazon.gif
c:\program files\Dealio Toolbar\Res\apple.gif
c:\program files\Dealio Toolbar\Res\barnes.gif
c:\program files\Dealio Toolbar\Res\bestbuy.gif
c:\program files\Dealio Toolbar\Res\dealio_logo.gif
c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
c:\program files\Dealio Toolbar\Res\ebay.gif
c:\program files\Dealio Toolbar\Res\icon_settings.gif
c:\program files\Dealio Toolbar\Res\macys.gif
c:\program files\Dealio Toolbar\Res\newegg.gif
c:\program files\Dealio Toolbar\Res\overstock.gif
c:\program files\Dealio Toolbar\Res\search-button-hover.gif
c:\program files\Dealio Toolbar\Res\search-button.gif
c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
c:\program files\Dealio Toolbar\Res\search-chevron.gif
c:\program files\Dealio Toolbar\Res\search_amazon.gif
c:\program files\Dealio Toolbar\Res\search_dealio.gif
c:\program files\Dealio Toolbar\Res\search_ebay.gif
c:\program files\Dealio Toolbar\Res\search_yahoo.gif
c:\program files\Dealio Toolbar\Res\target.gif
c:\program files\Dealio Toolbar\Res\walmart.gif
c:\program files\Dealio Toolbar\Res\widgets.xml
c:\program files\Dealio Toolbar\WidgiHelper.exe
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA.cfg
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA0.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA1.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA2.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA3.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA4.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA5.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA6.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA7.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA8.che
c:\users\AnAkI\AppData\Local\Microsoft\Windows\Temporary Internet Files\MUZAoDA9.che
c:\users\AnAkI\AppData\Roaming\cglogs.dat
c:\users\AnAkI\AppData\Roaming\data.dat
c:\users\AnAkI\AppData\Roaming\chrtmp
c:\users\AnAkI\MetinFileExtractor.exe
c:\windows\7Loader.TAG
c:\windows\system32\muzapp.exe
c:\windows\Windows Update\iexplorer.exe
c:\windows\wpe pro.INI
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-26 do 2011-06-26 )))))))))))))))))))))))))))))))
.
.
2011-06-26 09:19 . 2011-06-26 09:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-26 07:25 . 2011-06-26 07:25 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl9121b3a3.sys
2011-06-26 07:17 . 2011-06-26 07:18 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl3f9e4fbf.sys
2011-06-26 07:17 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\mpengine.dll
2011-06-25 20:50 . 2011-06-25 20:50 -------- d-----w- c:\program files\trend micro
2011-06-25 20:50 . 2011-06-25 20:50 -------- d-----w- C:\rsit
2011-06-25 16:00 . 2011-06-26 09:04 -------- d-----w- c:\program files\Auto Clicker
2011-06-25 15:04 . 2011-06-25 15:04 -------- d-----w- c:\program files\WinPcap
2011-06-24 12:02 . 2011-06-24 12:02 -------- d-----w- c:\program files\Common Files\Java
2011-06-23 19:25 . 2011-06-19 17:56 4122968 ----a-w- c:\windows\system32\GameMon.des
2011-06-23 19:25 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-06-23 19:25 . 2003-07-20 00:17 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-06-23 19:24 . 2011-06-23 19:24 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-06-23 18:51 . 2011-06-23 19:02 -------- d-----w- c:\programdata\GarenaMessenger
2011-06-23 18:44 . 2011-06-23 18:44 -------- d-----w- c:\users\AnAkI\AppData\Local\Garena
2011-06-23 17:45 . 2011-06-23 17:45 -------- d-----w- c:\program files\Application Updater
2011-06-23 17:40 . 2009-03-18 15:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-06-23 15:05 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-23 15:05 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-23 15:05 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-23 14:55 . 2011-04-29 02:57 311296 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-23 14:55 . 2011-04-29 02:57 309760 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-23 14:55 . 2011-04-29 02:57 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-23 14:55 . 2011-04-25 04:56 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-23 14:55 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-23 14:55 . 2011-04-27 02:33 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-23 14:55 . 2010-12-18 05:31 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-23 14:54 . 2011-05-03 04:50 740864 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-23 14:54 . 2011-05-04 02:43 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-23 14:54 . 2011-05-04 02:43 96256 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-23 14:54 . 2011-05-04 02:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-20 13:26 . 2011-06-20 13:26 -------- d-----w- c:\users\AnAkI\AppData\Local\GHISLER
2011-06-12 19:57 . 2011-06-12 19:57 -------- d-----w- c:\program files\Samsung
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 11:42 . 2011-05-14 18:01 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2011-04-17 07:44 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-15 18:20 . 2011-05-15 18:20 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-05-04 02:52 . 2011-03-27 11:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-26 13:10 . 2011-05-16 12:40 44784 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2011-04-26 13:10 . 2011-04-26 13:10 122224 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-04-26 13:10 . 2011-04-26 13:10 111280 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2011-04-26 13:10 . 2011-05-16 12:40 162544 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-04-26 13:10 . 2011-04-26 13:10 135472 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2011-04-22 19:36 . 2011-05-25 13:11 26496 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-04-16 07:41 . 2011-05-21 18:03 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-04-16 07:41 . 2011-05-21 18:02 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{692F7B18-81DE-4AA7-89A7-5F2211009EBD}\gapaengine.dll
2011-04-09 06:13 . 2011-05-04 13:46 3957632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13 . 2011-05-04 13:46 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-06 17:51 123904 ----a-w- c:\windows\system32\poqexec.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"KiesHelper"="d:\kies\KiesHelper.exe" [2011-01-29 888120]
"KiesTrayAgent"="d:\kies\KiesTrayAgent.exe" [2011-01-29 3372856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-03-12 569344]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"QuickTime Task"="d:\programy\Quick Time\QTTask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"WinampAgent"="d:\program files\Winamp\winampa.exe" [2011-03-22 74752]
"LogMeIn Hamachi Ui"="d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2011-05-06 532320]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\AnAkI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2011-5-15 624416]
MorphVOX.lnk - c:\program files\Screaming Bee\MorphVOX Pro\MorphVOX.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKsl10cdd7db;MpKsl10cdd7db;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B851015-91F3-49CD-885A-BFCC7CFF75A8}\MpKsl10cdd7db.sys [x]
R1 MpKsl10deba58;MpKsl10deba58;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsl10deba58.sys [x]
R1 MpKsl12bebebc;MpKsl12bebebc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl12bebebc.sys [x]
R1 MpKsl18adab24;MpKsl18adab24;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{265DF8D3-5795-4881-80AA-1FFC3DCF5786}\MpKsl18adab24.sys [x]
R1 MpKsl34216673;MpKsl34216673;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl34216673.sys [x]
R1 MpKsl38a55995;MpKsl38a55995;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl38a55995.sys [x]
R1 MpKsl6c7fa04c;MpKsl6c7fa04c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsl6c7fa04c.sys [x]
R1 MpKsl6efde636;MpKsl6efde636;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl6efde636.sys [x]
R1 MpKsl7fa34fd9;MpKsl7fa34fd9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKsl7fa34fd9.sys [x]
R1 MpKsl8c811070;MpKsl8c811070;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl8c811070.sys [x]
R1 MpKslab88d86f;MpKslab88d86f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKslab88d86f.sys [x]
R1 MpKslbea2a191;MpKslbea2a191;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKslbea2a191.sys [x]
R1 MpKsld5c6100c;MpKsld5c6100c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsld5c6100c.sys [x]
R1 MpKsldf5811c5;MpKsldf5811c5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsldf5811c5.sys [x]
R1 MpKsle1dd25cc;MpKsle1dd25cc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsle1dd25cc.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-06-19 4122968]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-19 1343400]
R3 WPFFontCache_v0400;WPFFontCache_v0400;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-03-26 218688]
S1 MpKsl3f9e4fbf;MpKsl3f9e4fbf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl3f9e4fbf.sys [2011-06-26 28752]
S1 MpKsl9121b3a3;MpKsl9121b3a3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl9121b3a3.sys [2011-06-26 28752]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-04-26 162544]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-04-26 44784]
S2 Apache2.2;Apache2.2;d:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2011-05-06 393112]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2006-09-26 21920]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-04-26 111280]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-04-26 122224]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL9121B3A3
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/home?AF=17981
LSP: %SystemRoot%\system32\PrxerDrv.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\AnAkI\AppData\Roaming\Mozilla\Firefox\Profiles\i50brsmt.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=371596&p=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-Skype - c:\program files\Skype\Phone\Skype.exe
HKLM-Run-tsnp2uvc - c:\windows\tsnp2uvc.exe
HKLM-Run-vcs4diamond - c:\users\AnAkI\Desktop\AV Vcs 4.0 DIAMOND\Vcs4Core.exe
HKLM-Run-PAC7302_Monitor - c:\windows\PixArt\PAC7302\Monitor.exe
AddRemove-AV Music Morpher Gold - c:\program files\AV Music Morpher Gold\uninstall.exe
AddRemove-Proxifier_is1 - c:\program files\Proxifier\unins000.exe
AddRemove-{1a413f37-ed88-4fec-9666-5c48dc4b7bb7} - c:\program files\YouTube Downloader\uninstall.exe
AddRemove-01_Simmental - d:\usb drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - d:\usb drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - d:\usb drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - d:\usb drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - d:\usb drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - d:\usb drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - d:\usb drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - d:\usb drivers\16_Shrewsbury\Uninstall.exe
AddRemove-24_flashusbdriver - d:\usb drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - d:\usb drivers\25_escape\Uninstall.exe
AddRemove-µTorrent CZ_is1 - c:\program files\uTorrent\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-105162162-2124763764-1168219856-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-105162162-2124763764-1168219856-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-06-26 11:21:52
ComboFix-quarantined-files.txt 2011-06-26 09:21
.
Před spuštěním: 3 252 838 400
Po spuštění: 3 904 270 336
.
- - End Of File - - D19E0CE982D723AD2FE4D72301E02999

[vyosek]

Ty windows asi moc legalni nejsou ze

[anakin8]

... Ehm .. Asi ne no Jak se to řekne .. Ne ..

[vyosek]

No urcite ne Nelegalnim SW se tu nezabyvame, pokud se to bdue opakovat, bude pomoc odmitnuta

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  DDs::
  uStart Page = hxxp://search.babylon.com/home?AF=17981
  
  Firefox::
  FF - ProfilePath - c:\users\AnAkI\AppData\Roaming\Mozilla\Firefox\Profiles\i50brsmt.default\
  FF - prefs.js: browser.search.selectedEngine - Yahoo
  FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=green ... =371596&p=
  
  RegLock::
  [HKEY_USERS\S-1-5-21-105162162-2124763764-1168219856-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
  [HKEY_USERS\S-1-5-21-105162162-2124763764-1168219856-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  
  Registry::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "WinampAgent"=-
  "SearchSettings"=-
  "SunJavaUpdateSched"=-
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[anakin8]

Win nabehl v poho ale musel sem dat restart protože psal neco o tom ze tento registr je určen ke smazaní u prohližečů mozilla a internet explorer



ComboFix 11-06-25.05 - AnAkI 26.06.2011 13:31:31.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2046.898 [GMT 2:00]
Spuštěný z: c:\users\AnAkI\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\AnAkI\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-26 do 2011-06-26 )))))))))))))))))))))))))))))))
.
.
2011-06-26 11:37 . 2011-06-26 11:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-26 10:28 . 2011-06-26 10:28 0 ----a-w- c:\users\AnAkI\ppm.bat
2011-06-26 10:24 . 2011-06-26 10:26 -------- d-----w- C:\Perl
2011-06-26 10:23 . 2011-06-26 10:23 -------- d-----w- C:\Python25
2011-06-26 09:21 . 2011-06-26 11:38 -------- d-----w- c:\users\AnAkI\AppData\Local\temp
2011-06-26 07:25 . 2011-06-26 07:25 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl9121b3a3.sys
2011-06-26 07:17 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\mpengine.dll
2011-06-25 20:50 . 2011-06-25 20:50 -------- d-----w- c:\program files\trend micro
2011-06-25 20:50 . 2011-06-25 20:50 -------- d-----w- C:\rsit
2011-06-25 16:00 . 2011-06-26 09:04 -------- d-----w- c:\program files\Auto Clicker
2011-06-25 15:04 . 2011-06-25 15:04 -------- d-----w- c:\program files\WinPcap
2011-06-24 12:02 . 2011-06-24 12:02 -------- d-----w- c:\program files\Common Files\Java
2011-06-23 19:25 . 2011-06-19 17:56 4122968 ----a-w- c:\windows\system32\GameMon.des
2011-06-23 19:25 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-06-23 19:25 . 2003-07-20 00:17 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-06-23 19:24 . 2011-06-23 19:24 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-06-23 18:51 . 2011-06-23 19:02 -------- d-----w- c:\programdata\GarenaMessenger
2011-06-23 18:44 . 2011-06-23 18:44 -------- d-----w- c:\users\AnAkI\AppData\Local\Garena
2011-06-23 17:45 . 2011-06-23 17:45 -------- d-----w- c:\program files\Application Updater
2011-06-23 17:40 . 2009-03-18 15:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-06-23 15:05 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-23 15:05 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-23 15:05 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-23 14:55 . 2011-04-29 02:57 311296 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-23 14:55 . 2011-04-29 02:57 309760 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-23 14:55 . 2011-04-29 02:57 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-23 14:55 . 2011-04-25 04:56 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-23 14:55 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-23 14:55 . 2011-04-27 02:33 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-23 14:55 . 2010-12-18 05:31 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-23 14:54 . 2011-05-03 04:50 740864 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-23 14:54 . 2011-05-04 02:43 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-23 14:54 . 2011-05-04 02:43 96256 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-23 14:54 . 2011-05-04 02:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-20 13:26 . 2011-06-20 13:26 -------- d-----w- c:\users\AnAkI\AppData\Local\GHISLER
2011-06-12 19:57 . 2011-06-12 19:57 -------- d-----w- c:\program files\Samsung
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 11:42 . 2011-05-14 18:01 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2011-04-17 07:44 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-15 18:20 . 2011-05-15 18:20 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-05-04 02:52 . 2011-03-27 11:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-26 13:10 . 2011-05-16 12:40 44784 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2011-04-26 13:10 . 2011-04-26 13:10 122224 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-04-26 13:10 . 2011-04-26 13:10 111280 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2011-04-26 13:10 . 2011-05-16 12:40 162544 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-04-26 13:10 . 2011-04-26 13:10 135472 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2011-04-22 19:36 . 2011-05-25 13:11 26496 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-04-16 07:41 . 2011-05-21 18:03 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-04-16 07:41 . 2011-05-21 18:02 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{692F7B18-81DE-4AA7-89A7-5F2211009EBD}\gapaengine.dll
2011-04-09 06:13 . 2011-05-04 13:46 3957632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13 . 2011-05-04 13:46 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-06 17:51 123904 ----a-w- c:\windows\system32\poqexec.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="d:\kies\KiesHelper.exe" [2011-01-29 888120]
"KiesTrayAgent"="d:\kies\KiesTrayAgent.exe" [2011-01-29 3372856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-03-12 569344]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984]
"QuickTime Task"="d:\programy\Quick Time\QTTask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"LogMeIn Hamachi Ui"="d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
.
c:\users\AnAkI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2011-5-15 624416]
MorphVOX.lnk - c:\program files\Screaming Bee\MorphVOX Pro\MorphVOX.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKsl10cdd7db;MpKsl10cdd7db;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B851015-91F3-49CD-885A-BFCC7CFF75A8}\MpKsl10cdd7db.sys [x]
R1 MpKsl10deba58;MpKsl10deba58;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsl10deba58.sys [x]
R1 MpKsl12bebebc;MpKsl12bebebc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl12bebebc.sys [x]
R1 MpKsl18adab24;MpKsl18adab24;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{265DF8D3-5795-4881-80AA-1FFC3DCF5786}\MpKsl18adab24.sys [x]
R1 MpKsl34216673;MpKsl34216673;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl34216673.sys [x]
R1 MpKsl38a55995;MpKsl38a55995;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl38a55995.sys [x]
R1 MpKsl6c7fa04c;MpKsl6c7fa04c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsl6c7fa04c.sys [x]
R1 MpKsl6efde636;MpKsl6efde636;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05FD672D-E2DB-496E-BB10-CBE7D0A50E1F}\MpKsl6efde636.sys [x]
R1 MpKsl7fa34fd9;MpKsl7fa34fd9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKsl7fa34fd9.sys [x]
R1 MpKsl8c811070;MpKsl8c811070;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsl8c811070.sys [x]
R1 MpKslab88d86f;MpKslab88d86f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B15642EF-2514-41AC-A7C9-E9D6BD48B2D5}\MpKslab88d86f.sys [x]
R1 MpKslbea2a191;MpKslbea2a191;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKslbea2a191.sys [x]
R1 MpKsld5c6100c;MpKsld5c6100c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09B52053-951F-4F8F-A8DC-69C8A99563D6}\MpKsld5c6100c.sys [x]
R1 MpKsldf5811c5;MpKsldf5811c5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8EEE299-7749-4DB5-83FF-6223073FE6D3}\MpKsldf5811c5.sys [x]
R1 MpKsle1dd25cc;MpKsle1dd25cc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E7A59DD-185A-466D-A546-E26742BE0C56}\MpKsle1dd25cc.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-06-19 4122968]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]
R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [2010-12-21 100352]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-19 1343400]
R3 WPFFontCache_v0400;WPFFontCache_v0400;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-03-26 218688]
S1 MpKsl9121b3a3;MpKsl9121b3a3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18A73AA3-D392-4052-BA3A-1E197C820CA4}\MpKsl9121b3a3.sys [2011-06-26 28752]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-04-26 162544]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-04-26 44784]
S2 Apache2.2;Apache2.2;d:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2011-05-06 393112]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2006-09-26 21920]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-04-26 111280]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-04-26 122224]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]
.
.
.
------- Doplňkový sken -------
.
LSP: %SystemRoot%\system32\PrxerDrv.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\AnAkI\AppData\Roaming\Mozilla\Firefox\Profiles\i50brsmt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
d:\xampp\mysql\bin\mysqld.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-06-26 13:42:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-26 11:42
ComboFix2.txt 2011-06-26 09:21
.
Před spuštěním: 3 415 203 840
Po spuštění: 1 597 939 712
.
- - End Of File - - 1C0871EAFB86FF04A4A6FAF4E3B5614B

[vyosek]

Uploadnete mi prosim tento soubor c:\users\AnAkI\ppm.bat sem http://vyosek.ic.cz/havet/uploader.php

[anakin8]

Omluvte mne ze jsem tu tak dlouh onebyl je tam uploudnutý

[vyosek]

Soubor rucne smazte, neni v nem nic

Jak se chova PC

[anakin8]

Dobře zrychlil se výkon takže moc děkuji

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse