VIRY.CZ

A jeste Combofix:

ComboFix 12-11-16.02 - Radek 19.11.2012 17:03:41.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2037.1042 [GMT 1:00]
Spuštěný z: c:\users\Radek\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: ZoneAlarm Free Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Radek\AppData\Local\assembly\tmp
c:\users\Radek\AppData\Roaming\inst.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\muzapp.exe
c:\windows\system32\roboot.exe
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-19 do 2012-11-19 )))))))))))))))))))))))))))))))
.
.
2012-11-19 16:14 . 2012-11-19 16:14 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-11-19 16:14 . 2012-11-19 16:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-19 15:33 . 2012-11-19 15:43 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-11-18 19:48 . 2012-11-18 19:48 -------- d-----w- c:\program files\Common Files\PCSuite
2012-11-18 19:44 . 2012-11-18 19:44 -------- d-----w- c:\users\Radek\AppData\Roaming\VeryAndroid
2012-11-18 19:44 . 2012-11-18 19:44 -------- d-----w- c:\users\Radek\PC Tool for VeryAndroid SMS Backup
2012-11-18 19:09 . 2010-01-02 14:02 413719 ----a-w- C:\sqlite3.dll
2012-11-18 19:08 . 2010-08-30 20:03 1339904 ----a-w- C:\Nokia2AndroidSMS.exe
2012-11-17 22:20 . 2012-11-17 22:20 -------- d-----w- c:\programdata\Malwarebytes
2012-11-16 18:35 . 2012-10-17 00:32 6918632 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB101A9E-C777-4CBB-AA63-899EA2631D74}\mpengine.dll
2012-11-15 19:01 . 2012-09-25 16:19 75776 ----a-w- c:\windows\system32\synceng.dll
2012-11-15 19:00 . 2012-10-12 14:29 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-11-11 20:20 . 2012-11-11 20:20 -------- d-----w- c:\program files\MyFree Codec
2012-11-11 20:17 . 2012-11-11 20:17 -------- d-----w- C:\Temp
2012-11-11 20:15 . 2012-11-11 20:15 -------- d-----w- c:\users\Radek\AppData\Local\Samsung
2012-11-11 20:15 . 2012-11-17 17:31 -------- d-----w- c:\users\Radek\AppData\Roaming\Samsung
2012-11-11 20:09 . 2012-09-20 04:35 83168 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2012-11-11 20:09 . 2012-09-20 04:35 181344 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2012-11-11 20:04 . 2012-09-26 19:57 4659712 ----a-w- c:\windows\system32\Redemption.dll
2012-11-11 20:03 . 2012-11-11 20:03 -------- d-----w- c:\program files\MarkAny
2012-11-11 20:03 . 2012-09-26 19:57 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2012-11-11 20:03 . 2012-09-26 19:57 821824 ----a-w- c:\windows\system32\dgderapi.dll
2012-11-11 20:03 . 2012-09-26 19:57 20032 ----a-w- c:\windows\system32\drivers\dgderdrv.sys
2012-11-11 20:01 . 2012-11-11 20:07 -------- d-----w- c:\program files\Samsung
2012-11-11 20:01 . 2012-11-11 20:04 -------- d-----w- c:\programdata\Samsung
2012-11-11 14:58 . 2012-06-27 14:18 19072 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2012-11-11 14:58 . 2012-11-11 14:58 -------- d-----w- c:\program files\PC Connectivity Solution
2012-11-03 20:34 . 2012-11-11 17:25 -------- d-----w- c:\users\Radek\AppData\Roaming\Media Player Classic
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\XviD
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\AviSynth 2.5
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\Gabest
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\AutoGK
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-30 22:51 . 2011-11-20 06:36 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2010-10-29 13:42 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2010-10-29 13:42 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2010-10-29 13:42 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2010-10-29 13:42 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2010-10-29 13:42 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2010-10-30 07:39 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2010-10-29 13:41 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-30 18:01 . 2012-04-12 17:59 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-30 18:01 . 2011-07-29 16:26 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-01 14:12 . 2012-09-09 19:20 2626163 ----a-w- C:\Setting A200-48sat-V218B4p.zip
2012-09-26 19:57 . 2012-09-26 19:57 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2012-09-26 19:57 . 2012-09-26 19:57 330240 ----a-w- c:\windows\MASetupCaller.dll
2012-09-26 19:57 . 2012-09-26 19:57 30568 ----a-w- c:\windows\MusiccityDownload.exe
2012-09-26 19:57 . 2012-09-26 19:57 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2012-09-26 19:57 . 2012-09-26 19:57 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 569344 ----a-w- c:\windows\system32\muzdecode.ax
2012-09-26 19:57 . 2012-09-26 19:57 491520 ----a-w- c:\windows\system32\muzapp.dll
2012-09-26 19:57 . 2012-09-26 19:57 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2012-09-26 19:57 . 2012-09-26 19:57 45320 ----a-w- c:\windows\system32\MAMACExtract.dll
2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2012-09-26 19:57 . 2012-09-26 19:57 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2012-09-26 19:57 . 2012-09-26 19:57 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2012-09-26 19:57 . 2012-09-26 19:57 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2012-09-26 19:57 . 2012-09-26 19:57 245760 ----a-w- c:\windows\system32\MSCLib.dll
2012-09-26 19:57 . 2012-09-26 19:57 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2012-09-26 19:57 . 2012-09-26 19:57 200704 ----a-w- c:\windows\system32\muzwmts.dll
2012-09-26 19:57 . 2012-09-26 19:57 155648 ----a-w- c:\windows\system32\MSFLib.dll
2012-09-26 19:57 . 2012-09-26 19:57 143360 ----a-w- c:\windows\system32\3DAudio.ax
2012-09-26 19:57 . 2012-09-26 19:57 135168 ----a-w- c:\windows\system32\muzaf1.dll
2012-09-26 19:57 . 2012-09-26 19:57 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2012-09-26 19:57 . 2012-09-26 19:57 122880 ----a-w- c:\windows\system32\muzeffect.ax
2012-09-26 19:57 . 2012-09-26 19:57 118784 ----a-w- c:\windows\system32\MaDRM.dll
2012-09-26 19:57 . 2012-09-26 19:57 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2012-09-13 13:28 . 2012-10-10 07:11 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-02 06:23 . 2012-09-02 06:24 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-02 06:23 . 2012-06-03 06:59 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-02 06:23 . 2010-10-30 07:58 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-29 11:27 . 2012-10-10 07:11 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-29 11:27 . 2012-10-10 07:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 15:53 . 2012-10-10 07:12 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-10-24 17:50 . 2012-10-28 19:48 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2012-11-12 968120]
"KiesAirMessage"="c:\program files\Samsung\Kies\KiesAirMessage.exe" [2012-11-01 577536]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-11-12 309688]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-6-28 739880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\G:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 10.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snagit 10.lnk
backupExtension=.CommonStartup
backup=c:\windows\pss\Snagit 10.lnk.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VideoBrowser Camera Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VideoBrowser Camera Monitor.lnk
backup=c:\windows\pss\VideoBrowser Camera Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
2012-10-13 00:54 1088424 ----a-w- c:\program files\Nokia\Nokia Suite\NokiaSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAC7302_Monitor]
2007-12-10 13:55 323584 ----a-w- c:\windows\PixArt\Pac7302\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
2007-02-20 10:07 199752 ----a-w- c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
.
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:02]
.
2012-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-05 21:24]
.
2012-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-05 21:24]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\15ai4oup.default-1351523987079\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2012-10-28 20:49; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-ISW - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-19 17:14
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0015\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0016\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0017\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0018\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0019\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0020\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0021\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0022\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0023\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0024\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0025\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0026\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(720)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Celkový čas: 2012-11-19 17:18:27
ComboFix-quarantined-files.txt 2012-11-19 16:18
.
Před spuštěním: 2 632 196 096
Po spuštění: 2 449 149 952
.
- - End Of File - - 801F3A6F9A3357D02FA87CCC0E1D2DB8

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "KiesPreload"=-
  "KiesAirMessage"=-
  "WMPNSCFG"=-
  "NokiaSuite.exe"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Windows Mobile Device Center"=-
  "SunJavaUpdateSched"=-
  "KiesTrayAgent"=-
  [-HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 10.lnk]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
  
  File::
  c:\windows\Tasks\Adobe Flash Player Updater.job
  c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  RegLock::
  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Tady je provedena akce. Děkuji za další rady.

ComboFix 12-11-16.02 - Radek 20.11.2012 18:04:24.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2037.948 [GMT 1:00]
Spuštěný z: c:\users\Radek\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Radek\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: ZoneAlarm Free Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-20 do 2012-11-20 )))))))))))))))))))))))))))))))
.
.
2012-11-20 17:13 . 2012-11-20 17:13 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-11-20 17:13 . 2012-11-20 17:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-20 10:11 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{673A239F-8E5F-4A41-A808-D39E9F3D996C}\mpengine.dll
2012-11-19 20:35 . 2012-11-19 20:41 -------- d-----w- c:\programdata\OviInstallerCache
2012-11-19 15:33 . 2012-11-19 15:43 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-11-18 19:48 . 2012-11-18 19:48 -------- d-----w- c:\program files\Common Files\PCSuite
2012-11-18 19:44 . 2012-11-18 19:44 -------- d-----w- c:\users\Radek\AppData\Roaming\VeryAndroid
2012-11-18 19:09 . 2010-01-02 14:02 413719 ----a-w- C:\sqlite3.dll
2012-11-18 19:08 . 2010-08-30 20:03 1339904 ----a-w- C:\Nokia2AndroidSMS.exe
2012-11-17 22:20 . 2012-11-17 22:20 -------- d-----w- c:\programdata\Malwarebytes
2012-11-15 19:01 . 2012-09-25 16:19 75776 ----a-w- c:\windows\system32\synceng.dll
2012-11-15 19:00 . 2012-10-12 14:29 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-11-11 20:20 . 2012-11-11 20:20 -------- d-----w- c:\program files\MyFree Codec
2012-11-11 20:17 . 2012-11-11 20:17 -------- d-----w- C:\Temp
2012-11-11 20:15 . 2012-11-11 20:15 -------- d-----w- c:\users\Radek\AppData\Local\Samsung
2012-11-11 20:15 . 2012-11-17 17:31 -------- d-----w- c:\users\Radek\AppData\Roaming\Samsung
2012-11-11 20:09 . 2012-09-20 04:35 83168 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2012-11-11 20:09 . 2012-09-20 04:35 181344 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2012-11-11 20:04 . 2012-09-26 19:57 4659712 ----a-w- c:\windows\system32\Redemption.dll
2012-11-11 20:03 . 2012-11-11 20:03 -------- d-----w- c:\program files\MarkAny
2012-11-11 20:03 . 2012-09-26 19:57 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2012-11-11 20:03 . 2012-09-26 19:57 821824 ----a-w- c:\windows\system32\dgderapi.dll
2012-11-11 20:03 . 2012-09-26 19:57 20032 ----a-w- c:\windows\system32\drivers\dgderdrv.sys
2012-11-11 20:01 . 2012-11-11 20:07 -------- d-----w- c:\program files\Samsung
2012-11-11 20:01 . 2012-11-11 20:04 -------- d-----w- c:\programdata\Samsung
2012-11-11 14:58 . 2012-06-27 14:18 19072 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2012-11-11 14:58 . 2012-11-11 14:58 -------- d-----w- c:\program files\PC Connectivity Solution
2012-11-03 20:34 . 2012-11-11 17:25 -------- d-----w- c:\users\Radek\AppData\Roaming\Media Player Classic
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\XviD
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\AviSynth 2.5
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\Gabest
2012-11-03 20:33 . 2012-11-03 20:33 -------- d-----w- c:\program files\AutoGK
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-30 22:51 . 2011-11-20 06:36 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2010-10-29 13:42 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2010-10-29 13:42 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2010-10-29 13:42 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2010-10-29 13:42 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2010-10-29 13:42 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2010-10-30 07:39 41224 ----a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2010-10-29 13:41 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-30 18:01 . 2012-04-12 17:59 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-30 18:01 . 2011-07-29 16:26 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-01 14:12 . 2012-09-09 19:20 2626163 ----a-w- C:\Setting A200-48sat-V218B4p.zip
2012-09-26 19:57 . 2012-09-26 19:57 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2012-09-26 19:57 . 2012-09-26 19:57 330240 ----a-w- c:\windows\MASetupCaller.dll
2012-09-26 19:57 . 2012-09-26 19:57 30568 ----a-w- c:\windows\MusiccityDownload.exe
2012-09-26 19:57 . 2012-09-26 19:57 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2012-09-26 19:57 . 2012-09-26 19:57 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2012-09-26 19:57 . 2012-09-26 19:57 569344 ----a-w- c:\windows\system32\muzdecode.ax
2012-09-26 19:57 . 2012-09-26 19:57 491520 ----a-w- c:\windows\system32\muzapp.dll
2012-09-26 19:57 . 2012-09-26 19:57 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2012-09-26 19:57 . 2012-09-26 19:57 45320 ----a-w- c:\windows\system32\MAMACExtract.dll
2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2012-09-26 19:57 . 2012-09-26 19:57 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2012-09-26 19:57 . 2012-09-26 19:57 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2012-09-26 19:57 . 2012-09-26 19:57 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2012-09-26 19:57 . 2012-09-26 19:57 245760 ----a-w- c:\windows\system32\MSCLib.dll
2012-09-26 19:57 . 2012-09-26 19:57 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2012-09-26 19:57 . 2012-09-26 19:57 200704 ----a-w- c:\windows\system32\muzwmts.dll
2012-09-26 19:57 . 2012-09-26 19:57 155648 ----a-w- c:\windows\system32\MSFLib.dll
2012-09-26 19:57 . 2012-09-26 19:57 143360 ----a-w- c:\windows\system32\3DAudio.ax
2012-09-26 19:57 . 2012-09-26 19:57 135168 ----a-w- c:\windows\system32\muzaf1.dll
2012-09-26 19:57 . 2012-09-26 19:57 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2012-09-26 19:57 . 2012-09-26 19:57 122880 ----a-w- c:\windows\system32\muzeffect.ax
2012-09-26 19:57 . 2012-09-26 19:57 118784 ----a-w- c:\windows\system32\MaDRM.dll
2012-09-26 19:57 . 2012-09-26 19:57 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2012-09-13 13:28 . 2012-10-10 07:11 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-02 06:23 . 2012-09-02 06:24 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-02 06:23 . 2012-06-03 06:59 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-02 06:23 . 2010-10-30 07:58 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-29 11:27 . 2012-10-10 07:11 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-29 11:27 . 2012-10-10 07:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 15:53 . 2012-10-10 07:12 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-10-24 17:50 . 2012-10-28 19:48 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"ISW"="" [BU]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-6-28 739880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\G:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VideoBrowser Camera Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VideoBrowser Camera Monitor.lnk
backup=c:\windows\pss\VideoBrowser Camera Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAC7302_Monitor]
2007-12-10 13:55 323584 ----a-w- c:\windows\PixArt\Pac7302\Monitor.exe
.
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:02]
.
2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-05 21:24]
.
2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-05 21:24]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\15ai4oup.default-1351523987079\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2012-10-28 20:49; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-20 18:17
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5016)
c:\windows\system32\btmmhook.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\CheckPoint\ZAForceField\IswSvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
c:\windows\system32\conime.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Celkový čas: 2012-11-20 18:22:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-20 17:22
ComboFix2.txt 2012-11-19 16:18
.
Před spuštěním: 2 852 294 656
Po spuštění: 3 643 043 840
.
- - End Of File - - C4E3C74EBC8C72AD0DB017BD53200AE7

Prosím, kde se zapíná automatický start Avastu? Po Combofixu se musí startovat ručně:o((.

Ja jej nevypinal, ono vypada ze jej havet poskodila, doporucuji reinstal a pak napiste jak se chova PC

Bohužel to dnes nepujde, samotná aktualizace vyhazuje chybu 404 a přímo z avastu antivir taky jede pomalu a pak se spojení přeruší. Ostatní fungujr krásně, PC je živý:o). Děkuji

Ono je problem na strane avastu s aktualizacemi, ani me nefunguji - jiz je to nahlaseno a v reseni

Zdravím. Bohužel, jak ten avast měl problém, mám pcit, že se sem něco zas dostalo:o((. PC se restartuje:o((. Který z testu opět provést. Děkuji PS: Avast už mám opraven.

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

• Provedte aktualizaci
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Takže MBAM C:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.11.22.08

Windows Vista Service Pack 2 x86 NTFS (Safe Mode s podporou sítě)
Internet Explorer 9.0.8112.16421
Radek :: RADEK-PC [administrátor]

22.11.2012 19:15:29
mbam-log-2012-11-22 (19-15-29).txt

Typ: Úplná kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 372443
Uplynulý čas: 1 hodin, 5 minut, 58 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

D:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Verze databáze: v2012.11.22.08

Windows Vista Service Pack 2 x86 NTFS (Safe Mode s podporou sítě)
Internet Explorer 9.0.8112.16421
Radek :: RADEK-PC [administrátor]

22.11.2012 20:49:12
mbam-log-2012-11-22 (20-49-12).txt

Typ: Úplná kontrola (D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 251093
Uplynulý čas: 16 minut, 30 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

PC se mi zda byt cisty, jak se chova

Děkuji za veškerou podporu. PC se zdá vpořádku.
Moc děkuji!

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

Vse provedeno bez problemu. Moc, moc děkuji.
Jen poslední dotaz z jiného soudku. Mobil s Androidem, staci, když mám naisntalován jen Avast, nic jiného?
Nemusím mít z havěti obavu?
Děkuji