VIRY.CZ

All processes killed
========== SERVICES/DRIVERS ==========
Error: No service named NisDrv was found to stop!
Service\Driver key NisDrv not found.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Skype deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\UpdateP2GoShortCut deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\UpdateLBPShortCut deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"DisplayName"|"@%systemroot%\\system32\\FntCache.dll,-100" /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"ImagePath"|hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,41,00,6e,00,64,00,4e,00,6f,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,69,00,6f,00,6e,00,00,00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"Description"|"@%systemroot%\\system32\\FntCache.dll,-101" /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"ObjectName"|"NT AUTHORITY\\LocalService" /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"ErrorControl"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"Start"|dword:00000002 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"Type"|dword:00000020 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"ServiceSidType"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"RequiredPrivileges"|hex(7):53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"FailureActions"|hex:2c,01,00,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,00,01,00,00,00,60,ea,00,00,01,00,00,00,c0,d4,01,00,00,00,00,00,00,00,00,00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\\"DelayedAutoStart"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"InitialSystemCacheSize"|dword:00400000 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"InitialUserCacheSize"|dword:00400000 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"MaximumSystemCacheSize"|dword:01000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"MaximumUserCacheSize"|dword:04000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"ServiceDll"|hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,46,00,6e,00,74,00,43,00,61,00,63,00,68,00,65,00,2e,00,64,00,6c,00,6c,00,00,00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Parameters\\"ServiceDllUnloadOnStop"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache\Security\\"Security"|hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,00,00,02,00,84,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,10,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,14,00,10,00,00,00,01,01,00,00,00,00,00,05,06,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 /E : value set successfully!
========== FILES ==========
c:\users\Eliška\AppData\Roaming\dauqy.exe moved successfully.
c:\users\Eliška\AppData\Roaming\hevnhk.exe moved successfully.
c:\users\Eliška\AppData\Roaming\lljqrh.exe moved successfully.
c:\users\Eliška\AppData\Roaming\ttppsu.exe moved successfully.
c:\users\Eliška\AppData\Roaming\xfsovh.exe moved successfully.
c:\users\Eliška\AppData\Roaming\xllkyx.exe moved successfully.
c:\users\Eliška\AppData\Roaming\xpswt.exe moved successfully.
c:\users\Eliška\AppData\Roaming\xurtta.exe moved successfully.
c:\users\Eliška\AppData\Roaming\yckeyq.exe moved successfully.
c:\users\Eliška\AppData\Roaming\yhuert.exe moved successfully.
c:\users\Eliška\AppData\Roaming\ymrsqq.exe moved successfully.
c:\users\Eliška\AppData\Roaming\ytvuvf.exe moved successfully.
c:\users\Eliška\AppData\Roaming\zbwwur.exe moved successfully.
c:\users\Eliška\AppData\Roaming\zgwptw.exe moved successfully.
c:\users\Eliška\AppData\Roaming\zpvzhj.exe moved successfully.
c:\users\Eliška\AppData\Roaming\zrvdtl.exe moved successfully.
c:\users\Eliška\AppData\Roaming\ztootr.exe moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Eliška
->Temp folder emptied: 247641735 bytes
->Temporary Internet Files folder emptied: 3068717759 bytes
->Java cache emptied: 1801014 bytes
->FireFox cache emptied: 8128795 bytes
->Google Chrome cache emptied: 52381836 bytes
->Flash cache emptied: 16596103 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16691844 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50507 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3 254,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Eliška
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Eliška
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 03062013_172119

Files\Folders moved on Reboot...
C:\Users\Eliška\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\startupCache\startupCache.4.little moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Eliška\AppData\Local\Mozilla\Firefox\Profiles\i4e5q24g.default\_CACHE_CLEAN_ moved successfully.
C:\Windows\temp\etilqs_6vU5dXNcshCf3Viiqbhm moved successfully.
C:\Windows\temp\etilqs_DXxcGenuHN3QoI5jqkNA moved successfully.
C:\Windows\temp\etilqs_K0UeLGHrZ00zKSZC6f6V moved successfully.
C:\Windows\temp\etilqs_PAkIqobYh6DuQUKHFRUV moved successfully.
C:\Windows\temp\etilqs_u48aYHOwbtVBZAFLzBtW moved successfully.
C:\Windows\temp\etilqs_VyEidOgg0E29aBdNqVDF moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Pokud nemate, tak presunte Combofix primo na disk c:\

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  RegLock::
  [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
  
  File::
  c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt tez primo na c:\
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Děkuji za rady a pomoc. Problém je, že to tentokrát byl počítač známého a on už večer musel odjet. Je to potřeba udělat ihned, ten ComboFix?

Ano, je potreba to udelat, jelikoz tam je jeste nejaka havet a muze se mu to rozsirit...