VIRY.CZ

myslím že jsem to dle instrukcí udělal, oba soubory mám na ploše...zde je 2. pokus

ComboFix 11-09-07.02 - Roman Čáp 09.09.2011 15:26:37.3.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2943.1686 [GMT 2:00]
Spuštěný z: c:\users\Roman Lßp\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman Lßp\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-09 do 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 13:33 . 2011-09-09 13:33 -------- d-----w- c:\users\ROMANP~2\AppData\Local\temp
2011-09-09 13:33 . 2011-09-09 13:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 11:33 . 2011-09-08 11:33 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 123480 ----a-w- c:\windows\system32\OpenAL32.dll
2011-09-08 11:33 . 2011-09-08 11:33 109144 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-09-08 11:32 . 2010-02-02 08:57 2902498 ------w- c:\windows\SysWow64\Sens_oal.dll
2011-09-08 11:30 . 2009-01-16 12:28 497664 ----a-w- c:\windows\SysWow64\CTAPO32.dll
2011-09-08 10:59 . 2010-02-02 08:59 1940992 ------w- c:\windows\system32\Sens_oal.dll
2011-09-08 10:59 . 2011-09-08 10:59 -------- d-----w- c:\program files (x86)\Common Files\Creative Labs Shared
2011-09-08 10:57 . 2010-04-29 12:03 163840 ----a-w- c:\windows\system32\APOMgr64.DLL
2011-09-08 10:57 . 2010-04-29 12:03 128512 ----a-w- c:\windows\SysWow64\APOMngr.DLL
2011-09-08 10:57 . 2008-03-11 08:57 83456 ----a-w- c:\windows\system32\CmdRtr64.DLL
2011-09-08 10:57 . 2008-03-11 08:55 69120 ----a-w- c:\windows\SysWow64\CmdRtr.DLL
2011-09-07 05:35 . 2011-09-07 05:35 -------- d-----w- C:\Davky
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Malwarebytes
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\programdata\Malwarebytes
2011-09-07 05:30 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-09-01 12:57 . 2011-09-01 12:57 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Pinnacle
2011-09-01 07:24 . 2011-09-01 07:24 -------- d-----w- c:\program files (x86)\Common Files\Pinnacle
2011-09-01 07:23 . 2011-09-01 07:23 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate Collection
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Studio 14
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Yahoo!
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Pegasus Imaging
2011-09-01 07:09 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Pinnacle
2011-09-01 07:06 . 2011-09-01 07:06 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2011-08-30 20:38 . 2011-09-01 07:21 -------- d-----w- c:\programdata\Pinnacle
2011-08-23 13:05 . 2011-08-23 13:05 -------- d-----w- c:\program files\iPod
2011-08-23 13:05 . 2011-08-23 13:06 -------- d-----w- c:\program files\iTunes
2011-08-19 11:20 . 2011-08-19 11:20 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Aspyr
2011-08-19 11:19 . 2011-08-19 11:19 -------- d--h--r- c:\users\Roman Čáp\AppData\Roaming\SecuROM
2011-08-19 11:19 . 2011-08-19 11:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-08-19 11:03 . 2011-08-19 11:03 -------- d-----w- c:\program files (x86)\Aspyr
2011-08-19 11:03 . 2007-07-19 16:14 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
2011-08-19 11:03 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
2011-08-19 11:03 . 2007-04-04 16:54 107368 ----a-w- c:\windows\system32\xinput1_3.dll
2011-08-19 11:03 . 2007-04-04 16:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- C:\AppData
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Apple ComputerMobileSyncBackup
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-08-30 12:29 . 2011-08-30 12:32 22852 ----a-w- C:\UpdateXml.zip
2011-07-12 09:34 . 2011-07-12 09:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:34 . 2011-07-12 09:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:34 . 2011-07-12 09:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:34 . 2011-07-12 09:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_12.33.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-09-08 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 13:57 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-06-25 06:44 . 2011-09-08 13:59 36406 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-08 13:59 38072 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-06-25 06:44 . 2011-09-08 13:59 15882 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4275139881-4287817766-420560200-1000_UserData.bin
+ 2009-07-14 05:30 . 2011-09-08 11:30 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-09-08 11:30 . 2008-08-14 12:48 24064 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\skfiltv.sys
+ 2011-09-08 11:30 . 2009-01-16 12:34 57856 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctppld.dll
+ 2011-09-08 11:30 . 2008-08-26 14:30 8704 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\Common\ResDefE.exe
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-08 13:56 . 2011-09-08 13:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-08 13:56 . 2011-09-08 13:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-08-21 08:33 . 2011-09-07 04:53 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-08-21 08:33 . 2011-09-08 13:57 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-06-25 18:25 . 2011-09-09 11:36 531044 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-06-25 13:26 . 2011-09-07 16:24 347686 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2011-09-09 05:47 665570 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 665570 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 681316 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2011-09-09 05:47 126200 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-09-08 11:30 . 2009-01-16 12:28 497664 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\i386\CTAPO32.dll
+ 2011-09-08 11:30 . 2008-09-30 09:25 218112 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctdvinst.dll
+ 2011-09-08 11:30 . 2009-01-16 12:33 568320 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\CTAPO64.dll
+ 2009-07-14 05:01 . 2011-09-08 13:55 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-06 14:25 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
- 2011-08-25 07:17 . 2011-08-25 07:17 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
+ 2010-11-19 11:11 . 2011-09-08 13:55 6322152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4275139881-4287817766-420560200-1000-12288.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 6733824 c:\windows\Installer\45f81.msi
+ 2011-09-08 11:18 . 2011-09-08 11:18 18460672 c:\windows\Installer\45f74.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2011-03-15 2071904]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-18 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 VD_FileDisk;VD_FileDisk; [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-09-08 79360]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WDFORGA9;ORGA 900 WDF Bus Function;c:\windows\system32\DRIVERS\WDFORG9VB.sys [x]
R3 WDFORGSlot;ORGA Slot Function;c:\windows\system32\DRIVERS\WDFORG9UPF.sys [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-05-30 1025352]
S1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\Drivers\avgldx64.sys [x]
S1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\Drivers\avgmfx64.sys [x]
S1 AvgTdiA;AVG Free Network Redirector x64;c:\windows\system32\Drivers\avgtdia.sys [x]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\AVG\AVG9\avgemc.exe [2010-07-21 921952]
S2 avg9wd;AVG Free WatchDog;c:\program files (x86)\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe [2008-04-23 81920]
S2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe [2008-04-23 2015232]
S2 MSSQL$INSHOPSERVER;SQL Server (INSHOPSERVER);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 82464]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 15960096]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 134416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\avgrssta.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: gymuo.cz\zak
Trusted Zone: ica.cz\b
Trusted Zone: mojebanka.cz
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 82.144.143.254 82.144.143.1
FF - ProfilePath - c:\users\Roman Čáp\AppData\Roaming\Mozilla\Firefox\Profiles\9ao808qn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://gb.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://translate.google.cz/?client=firefox-a&rls=org.mozilla:cs:official&hl=cs&tab=wT#
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-09-09 15:36:29
ComboFix-quarantined-files.txt 2011-09-09 13:36
ComboFix2.txt 2011-09-08 14:13
ComboFix3.txt 2011-09-07 13:02
.
Před spuštěním: 7 772 147 712
Po spuštění: 7 711 899 648
.
- - End Of File - - 9A7C3BC52F6D4151CB16BE5DF54E1CAE

To není možné, je to tam pořád, zkus tu akci s tím skriptem provést v Nouzovém režimu.

Zdravím...zde je nouzový pokus...

ComboFix 11-09-07.02 - Roman Čáp 13.09.2011 18:28:01.4.2 - x64 MINIMAL
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2943.1920 [GMT 2:00]
Spuštěný z: c:\users\Roman Lßp\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman Lßp\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-13 do 2011-09-13 )))))))))))))))))))))))))))))))
.
.
2011-09-13 16:30 . 2011-09-13 16:30 -------- d-----w- c:\users\ROMANP~2\AppData\Local\temp
2011-09-13 16:30 . 2011-09-13 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-12 19:20 . 2010-06-05 12:13 237056 ----a-w- c:\windows\SysWow64\ssleay32.dll
2011-09-12 19:20 . 2010-06-05 12:13 237056 ----a-w- c:\windows\SysWow64\libssl32.dll
2011-09-12 19:20 . 2010-06-05 12:12 1145344 ----a-w- c:\windows\SysWow64\libeay32.dll
2011-09-12 19:19 . 2011-09-12 19:20 -------- d-----w- c:\program files (x86)\OpenSSL-Win32
2011-09-08 11:33 . 2011-09-08 11:33 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-09-08 11:33 . 2011-09-08 11:33 123480 ----a-w- c:\windows\system32\OpenAL32.dll
2011-09-08 11:33 . 2011-09-08 11:33 109144 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-09-08 11:32 . 2010-02-02 08:57 2902498 ------w- c:\windows\SysWow64\Sens_oal.dll
2011-09-08 11:30 . 2009-01-16 12:28 497664 ----a-w- c:\windows\SysWow64\CTAPO32.dll
2011-09-08 10:59 . 2010-02-02 08:59 1940992 ------w- c:\windows\system32\Sens_oal.dll
2011-09-08 10:59 . 2011-09-08 10:59 -------- d-----w- c:\program files (x86)\Common Files\Creative Labs Shared
2011-09-08 10:57 . 2010-04-29 12:03 163840 ----a-w- c:\windows\system32\APOMgr64.DLL
2011-09-08 10:57 . 2010-04-29 12:03 128512 ----a-w- c:\windows\SysWow64\APOMngr.DLL
2011-09-08 10:57 . 2008-03-11 08:57 83456 ----a-w- c:\windows\system32\CmdRtr64.DLL
2011-09-08 10:57 . 2008-03-11 08:55 69120 ----a-w- c:\windows\SysWow64\CmdRtr.DLL
2011-09-07 05:35 . 2011-09-07 05:35 -------- d-----w- C:\Davky
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Malwarebytes
2011-09-07 05:30 . 2011-09-07 05:30 -------- d-----w- c:\programdata\Malwarebytes
2011-09-07 05:30 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-09-03 18:22 . 2011-09-06 09:39 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-09-01 12:57 . 2011-09-01 12:57 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Pinnacle
2011-09-01 07:24 . 2011-09-01 07:24 -------- d-----w- c:\program files (x86)\Common Files\Pinnacle
2011-09-01 07:23 . 2011-09-01 07:23 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate Collection
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Studio 14
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Yahoo!
2011-09-01 07:13 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Common Files\Pegasus Imaging
2011-09-01 07:09 . 2011-09-01 07:13 -------- d-----w- c:\program files (x86)\Pinnacle
2011-09-01 07:06 . 2011-09-01 07:06 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2011-08-30 20:38 . 2011-09-01 07:21 -------- d-----w- c:\programdata\Pinnacle
2011-08-23 13:05 . 2011-08-23 13:05 -------- d-----w- c:\program files\iPod
2011-08-23 13:05 . 2011-08-23 13:06 -------- d-----w- c:\program files\iTunes
2011-08-19 11:20 . 2011-08-19 11:20 -------- d-----w- c:\users\Roman Čáp\AppData\Local\Aspyr
2011-08-19 11:19 . 2011-08-19 11:19 -------- d--h--r- c:\users\Roman Čáp\AppData\Roaming\SecuROM
2011-08-19 11:19 . 2011-08-19 11:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-08-19 11:03 . 2011-08-19 11:03 -------- d-----w- c:\program files (x86)\Aspyr
2011-08-19 11:03 . 2007-07-19 16:14 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
2011-08-19 11:03 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
2011-08-19 11:03 . 2007-04-04 16:54 107368 ----a-w- c:\windows\system32\xinput1_3.dll
2011-08-19 11:03 . 2007-04-04 16:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- C:\AppData
2011-08-19 05:52 . 2011-08-19 05:52 -------- d-----w- c:\users\Roman Čáp\AppData\Roaming\Apple ComputerMobileSyncBackup
2011-08-16 05:20 . 2011-08-16 05:20 4892320 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-12 17:01 . 2010-06-25 18:55 35664 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-09-07 16:41 . 2010-06-25 20:03 458752 ----a-w- c:\users\Roman Čáp\AppData\Roaming\pohoda.sys
2011-08-30 12:29 . 2011-08-30 12:32 22852 ----a-w- C:\UpdateXml.zip
2011-07-12 09:34 . 2011-07-12 09:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:34 . 2011-07-12 09:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:34 . 2011-07-12 09:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:34 . 2011-07-12 09:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2011-06-20 07:48 . 2011-04-24 19:03 57344 ----a-r- c:\users\Roman Čáp\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_12.33.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2011-09-13 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-13 16:24 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-07 04:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-13 16:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-06-25 13:26 . 2011-09-11 20:50 63792 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2010-06-25 06:44 . 2011-09-08 13:59 36406 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-10 08:56 38080 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-06-25 06:44 . 2011-09-10 08:56 15898 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4275139881-4287817766-420560200-1000_UserData.bin
+ 2009-07-14 05:30 . 2011-09-08 11:30 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-09-08 11:30 . 2008-08-14 12:48 24064 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\skfiltv.sys
+ 2011-09-08 11:30 . 2009-01-16 12:34 57856 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctppld.dll
+ 2011-09-08 11:30 . 2008-08-26 14:30 8704 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\Common\ResDefE.exe
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-13 16:25 . 2011-09-13 16:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-06 14:32 . 2011-09-07 04:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-13 16:25 . 2011-09-13 16:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-08-21 08:33 . 2011-09-07 04:53 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-08-21 08:33 . 2011-09-13 16:24 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-06-25 18:25 . 2011-09-13 15:17 531132 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2009-07-14 02:36 . 2011-09-09 05:47 665570 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 665570 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 681316 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-09-07 08:46 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-09-09 05:47 126200 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-09-09 05:47 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-09-07 08:46 151146 c:\windows\system32\perfc005.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2011-09-08 11:30 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:30 . 2011-09-01 07:25 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-09-08 11:30 . 2009-01-16 12:28 497664 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\i386\CTAPO32.dll
+ 2011-09-08 11:30 . 2008-09-30 09:25 218112 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\ctdvinst.dll
+ 2011-09-08 11:30 . 2009-01-16 12:33 568320 c:\windows\system32\DriverStore\FileRepository\xfiskv.inf_amd64_neutral_a25d73415b2fe706\WinVista\amd64\CTAPO64.dll
+ 2009-07-14 05:01 . 2011-09-13 16:21 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-06 14:25 513644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
- 2011-08-25 07:17 . 2011-08-25 07:17 371272 c:\windows\Installer\{AA59DDE4-B672-4621-A016-4C248204957A}\SkypeIcon.exe
+ 2010-11-19 11:11 . 2011-09-13 16:21 6546524 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4275139881-4287817766-420560200-1000-12288.dat
+ 2011-09-08 11:18 . 2011-09-08 11:18 6733824 c:\windows\Installer\45f81.msi
+ 2011-09-08 11:18 . 2011-09-08 11:18 18460672 c:\windows\Installer\45f74.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2011-09-12 2076512]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-18 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\Drivers\avgldx64.sys [x]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\Drivers\avgmfx64.sys [x]
R1 AvgTdiA;AVG Free Network Redirector x64;c:\windows\system32\Drivers\avgtdia.sys [x]
R1 VD_FileDisk;VD_FileDisk; [x]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\AVG\AVG9\avgemc.exe [2010-07-21 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe [2008-04-23 81920]
R2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe [2008-04-23 2015232]
R2 MSSQL$INSHOPSERVER;SQL Server (INSHOPSERVER);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
R2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-09-08 79360]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WDFORGA9;ORGA 900 WDF Bus Function;c:\windows\system32\DRIVERS\WDFORG9VB.sys [x]
R3 WDFORGSlot;ORGA Slot Function;c:\windows\system32\DRIVERS\WDFORG9UPF.sys [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-05-30 1025352]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 82464]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 15960096]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 134416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\avgrssta.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: gymuo.cz\zak
Trusted Zone: ica.cz\b
Trusted Zone: mojebanka.cz
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 82.144.143.254 82.144.143.1
FF - ProfilePath - c:\users\Roman Čáp\AppData\Roaming\Mozilla\Firefox\Profiles\9ao808qn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://gb.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://translate.google.cz/?client=firefox-a&rls=org.mozilla:cs:official&hl=cs&tab=wT#
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-09-13 18:34:00
ComboFix-quarantined-files.txt 2011-09-13 16:34
ComboFix2.txt 2011-09-09 13:36
ComboFix3.txt 2011-09-08 14:13
ComboFix4.txt 2011-09-07 13:02
.
Před spuštěním: 6 350 385 152
Po spuštění: 6 268 039 168
.
- - End Of File - - 783B934F7A4099E67CF4BA236F5A8FA8

Nechápu, to už jsi během pár dní několikátý kterému nejde nic smáznout.

Tak jinak, přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:
klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

Nemůže být problém v tom že mám AVG free verzi kde jsem při těch akcích vypnul rezidentní štít ale anti-spyware tam vypnout nejde, nikde jsem to tam nenašel....?

ComboFix se mi nepodařilo odinstalovat přes Spusť hlásí to že to nemůže najít

Ten příkaz na odstranění ComboFixu naprosto přesně ComboFixmezera/Uninstall

Pokud to ani pak nepůjde T-Cleaner by to měl zvládnout.

No AVG samo o sobě je problém tak že je to možné.

Proveď tu akci s tím OTMoveItem a pak uvidíme.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\*.tmp not found.
C:\WINDOWS\System32\ConduitEngine.tmp moved successfully.
File/Folder C:\WINDOWS\*.tmp not found.
c:\programdata\Spybot - Search & Destroy\Recovery folder moved successfully.
c:\programdata\Spybot - Search & Destroy\Logs folder moved successfully.
c:\programdata\Spybot - Search & Destroy folder moved successfully.
c:\program files (x86)\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: uzivatel
->Temp folder emptied: 0 bytes

User: uzivatel
->Temp folder emptied: 7319 bytes
->Temporary Internet Files folder emptied: 7927658 bytes
->Java cache emptied: 18887705 bytes
->FireFox cache emptied: 107114934 bytes
->Apple Safari cache emptied: 11630592 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 12632 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50373 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 139,00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 09172011_092038

Files moved on Reboot...
C:\Users\uzivatel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Pak dej vědět jaký je stav PC.

Děkuju moc za pomoc! Zdá se mi to být OK. Nějakou ochranu, nějaký free SW který by bylo dobý mít nainstalovaný by jsi mi poradil?

Ještě jednou díky!

Jakou máš namysli ochranu ?

Vždyť tam máš AVG.