prosim o kontrolu logu a radu

[hp123]

bohuzel jsem stahl neaky facebook vir se kterym si malwarebytes nedokaze poradit takze prosim o radu


Logfile of random's system information tool 1.09 (written by random/random)
Run by Ja at 2012-01-11 21:39:48
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 2 GB (11%) free of 20 GB
Total RAM: 2813 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:40:07, on 11.1.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskhost.exe
D:\Downloads\RSIT.exe
C:\Program Files\trend micro\Ja.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/sk27211/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [DeskUpdateNotifier] "C:\Program Files\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Google Update] "C:\Users\Ja\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [googletalk] C:\Users\Ja\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6926 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default

prefs.js - "browser.startup.homepage" - "http://google.com/"

"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
"{6904342A-8307-11DF-A508-4AE2DFD72085}"=C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
"{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}"=C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.93\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.93\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@wolfram.com/Mathematica]
"Description"=Wolfram Mathematica Plug-in
"Path"=C:\Program Files\Common Files\Wolfram Research\Browser\8.0.1.2063897\npmathplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\
btpersonas@brandthunder.com
{800b5000-a755-47e1-992b-48a1c1357f07}

C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\
icqplugin.gif
icqplugin.src
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2011-11-17 59272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2011-02-28 1048888]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DeskUpdateNotifier"=C:\Program Files\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe [2010-10-13 97560]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-11-28 3744552]
"SiSTray"=C:\Program Files\SiS VGA Utilities\SiSTray.exe [2011-06-02 557056]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-08-14 1348904]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-03-21 1230704]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-09-30 252296]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2011-12-24 460872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Ja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-02 136176]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"NokiaOviSuite2"=C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2011-09-01 966712]
""= []
"googletalk"=C:\Users\Ja\AppData\Roaming\Google\Google Talk\googletalk.exe [2007-01-01 3739648]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-11-10 3514176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.FMVC"=fmcodec.dll
"vidc.xvid"=xvidvfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-01-11 21:33:31 ----D---- C:\Program Files\trend micro
2012-01-11 21:33:29 ----D---- C:\rsit
2012-01-11 12:47:32 ----A---- C:\Windows\system32\ntdll.dll
2012-01-11 12:46:38 ----A---- C:\Windows\system32\packager.dll
2012-01-11 12:46:21 ----A---- C:\Windows\system32\quartz.dll
2012-01-11 12:46:20 ----A---- C:\Windows\system32\qdvd.dll
2012-01-10 23:07:02 ----D---- C:\Users\Ja\AppData\Roaming\Malwarebytes
2012-01-10 23:06:49 ----D---- C:\ProgramData\Malwarebytes
2012-01-10 23:06:47 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-01-10 23:06:46 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-01-04 12:21:07 ----D---- C:\Program Files\Common Files\Java
2012-01-04 12:20:40 ----A---- C:\Windows\system32\npdeployJava1.dll
2012-01-04 12:20:40 ----A---- C:\Windows\system32\javaws.exe
2012-01-04 12:20:40 ----A---- C:\Windows\system32\javaw.exe
2012-01-04 12:20:40 ----A---- C:\Windows\system32\java.exe
2011-12-17 22:05:06 ----D---- C:\Windows\rescache
2011-12-16 13:13:31 ----D---- C:\Users\Ja\AppData\Roaming\Crayon Physics Deluxe
2011-12-16 02:35:28 ----A---- C:\Windows\system32\mshtmled.dll
2011-12-16 02:35:27 ----A---- C:\Windows\system32\jscript.dll
2011-12-16 02:35:27 ----A---- C:\Windows\system32\iertutil.dll
2011-12-16 02:35:26 ----A---- C:\Windows\system32\jsproxy.dll
2011-12-16 02:35:26 ----A---- C:\Windows\system32\jscript9.dll
2011-12-16 02:35:25 ----A---- C:\Windows\system32\wininet.dll
2011-12-16 02:35:25 ----A---- C:\Windows\system32\url.dll
2011-12-16 02:35:25 ----A---- C:\Windows\system32\ieui.dll
2011-12-16 02:35:23 ----A---- C:\Windows\system32\urlmon.dll
2011-12-16 02:35:23 ----A---- C:\Windows\system32\mshtml.dll
2011-12-16 02:35:22 ----A---- C:\Windows\system32\ieframe.dll
2011-12-15 15:09:35 ----A---- C:\Windows\system32\EncDec.dll
2011-12-15 15:09:22 ----A---- C:\Windows\system32\tzres.dll
2011-12-15 15:09:01 ----A---- C:\Windows\system32\win32k.sys
2011-12-15 15:08:59 ----A---- C:\Windows\system32\csrsrv.dll
2011-12-15 15:08:53 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-12-15 15:08:52 ----A---- C:\Windows\system32\ntkrnlpa.exe

======List of files/folders modified in the last 1 month======

2012-01-11 21:40:07 ----D---- C:\Windows\Temp
2012-01-11 21:33:32 ----D---- C:\Windows\Prefetch
2012-01-11 21:33:31 ----RD---- C:\Program Files
2012-01-11 21:19:11 ----D---- C:\Windows\system32\drivers
2012-01-11 20:25:19 ----D---- C:\Windows\system32\config
2012-01-11 20:13:59 ----SHD---- C:\System Volume Information
2012-01-11 17:42:48 ----D---- C:\Windows\Microsoft.NET
2012-01-11 17:42:07 ----RSD---- C:\Windows\assembly
2012-01-11 17:19:22 ----D---- C:\Windows\winsxs
2012-01-11 17:17:49 ----D---- C:\Windows\System32
2012-01-11 16:08:38 ----A---- C:\Windows\system32\MRT.exe
2012-01-11 16:08:18 ----D---- C:\Windows\ehome
2012-01-11 16:08:02 ----SHD---- C:\Windows\Installer
2012-01-11 16:07:10 ----D---- C:\Windows\inf
2012-01-11 16:07:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-11 12:42:30 ----D---- C:\Windows\system32\catroot
2012-01-11 12:42:29 ----D---- C:\Windows\system32\catroot2
2012-01-10 23:06:49 ----HD---- C:\ProgramData
2012-01-07 18:25:25 ----D---- C:\Users\Ja\AppData\Roaming\ICQ
2012-01-04 12:21:07 ----D---- C:\Program Files\Common Files
2012-01-04 12:20:36 ----D---- C:\Program Files\Java
2012-01-03 03:28:14 ----D---- C:\Users\Ja\AppData\Roaming\vlc
2011-12-25 19:18:18 ----D---- C:\Windows\system32\wdi
2011-12-20 19:02:02 ----D---- C:\Windows\system32\NDF
2011-12-17 22:05:06 ----D---- C:\Windows
2011-12-16 10:54:01 ----D---- C:\Windows\system32\cs-CZ
2011-12-16 10:54:00 ----D---- C:\Windows\system32\migration
2011-12-16 10:54:00 ----D---- C:\Program Files\Internet Explorer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-11-28 34392]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-11-28 435032]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-11-28 314456]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-11-28 52952]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-01 239168]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-11-28 20568]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-20 117760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-05 1221632]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 20464]
R3 SiS6350;SiS6350; C:\Windows\system32\DRIVERS\SISGRKMD.sys [2011-06-02 466432]
R3 SiSGbeLH;SiS191/SiS190 – ovladač NDIS 6.0 zařízení sítě Ethernet; C:\Windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-08-14 203312]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-11-28 44768]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2011-02-28 247096]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2011-06-08 633856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-04 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-04 136176]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-06-02 1343400]

-----------------EOF-----------------

[Mc_Murphy]

Zdravím.

Uvolni nějaké místo na systémovém disku C:\ => 2 GB je opravdu málo, systém se dusí.
Malwarebytes' Anti-Malware vypni z rezidentní ochrany, jako antivir tam máš AVAST.


Potom stáhni RogueKiller - http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

• Ukonči všechny programy!
• Pokud používáš Win Vista či Win 7, klikni na RogueKiller pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Zvol možnost 2 a potvrď [Enter].
• Utilita provede svou činnost a dá log - ten mi sem vlož.
• Nyní znovu stejný postup, ale zvol možnost 3 a poté ještě jednou s možností 4 - logy mi sem opět vlož.

[hp123]

report 2


RogueKiller V6.2.3 [01/09/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Ja [Admin rights]
Mode: Remove -- Date : 01/12/2012 12:42:00

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 3 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] a39c8163f67cfec3297dfd3d65b5e023
[BSP] e40d2b99e2974c7cd08e44251cce5ed4 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 2048 | Size: 104 Mo
1 - [XXXXXX] FAT16 [VISIBLE] Offset (sectors): 206848 | Size: 6843 Mo
2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 13572096 | Size: 20970 Mo
3 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 54530048 | Size: 132120 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

[hp123]

report 3


RogueKiller V6.2.3 [01/09/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Ja [Admin rights]
Mode: HOSTSFix -- Date : 01/12/2012 12:44:20

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ Resetted HOSTS: ¤¤¤
127.0.0.1 localhost

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

[hp123]

report 4


RogueKiller V6.2.3 [01/09/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/fi ... guekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Ja [Admin rights]
Mode: ProxyFix -- Date : 01/12/2012 12:46:23

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Registry Entries: 0 ¤¤¤

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

[Mc_Murphy]

PROSÍM, ČTI NÁVOD DŮKLADNĚ - TATO UTILITA MÁ VELKOU SCHOPNOST MAZAT A JE NUTNÉ JI APLIKOVAT JEN NA DOPORUČENÍ, JINAK TI MŮŽE JÍT SYSTÉM DO KYTEK
Stáhni a ulož na Plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypni všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary apod.
• Vypni všechny běžící aplikace - ICQ, Skype, browsery, prostě všechny programy, ať běží pouze ComboFix.
• Pokud máš Win XP, spusť pod účtem Správce/Administrator.
• Pokud máš Win Vista či Win 7, klikni na ComboFix pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Ihned po startu se zobrazí stránka s licenčním ujednáním - pokračuj kliknutím na [Ano].
• Pokud Ti ComboFix nabídne instalaci Konzoly pro zotavení, tak souhlas.
• Dále postupuj dle pokynů. Během scanu nech PC naprosto v klidu - nespouštěj žádné aplikace a neklikej do zobrazujícího se okna!
• Scan by měl trvat cca 10 min, ale pokud bude PC hodne zaneseno, může se čas samozřejmě prodloužit.
• Po dokončení scanu a případném restartu ComboFix zobrazí log, který případně najdeš v C:\ComboFix.txt. Jeho obsah mi sem vlož.
• Detailní postup včetně obrázků najdeš zde: http://www.bleepingcomputer.com/combofi ... t-combofix

[hp123]

log z combofix


ComboFix 12-01-12.02 - Ja 12.01.2012 15:36:32.1.1 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2813.1961 [GMT 1:00]
Spuštěný z: c:\users\Ja\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-12 do 2012-01-12 )))))))))))))))))))))))))))))))
.
.
2012-01-12 14:42 . 2012-01-12 14:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-12 14:29 . 2012-01-12 14:29 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{455C103B-E95D-4436-AD9A-C841583F4E00}\offreg.dll
2012-01-12 11:42 . 2011-11-17 05:34 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-12 11:42 . 2011-11-17 05:41 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-12 11:42 . 2011-11-17 05:39 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-12 11:42 . 2011-11-17 05:32 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-12 11:42 . 2011-11-17 05:41 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-12 11:42 . 2011-11-17 05:35 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-12 11:42 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-12 11:42 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-12 11:42 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-12 11:42 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-12 11:31 . 2012-01-12 11:48 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2012-01-11 20:33 . 2012-01-11 20:40 -------- d-----w- c:\program files\trend micro
2012-01-11 20:33 . 2012-01-11 20:40 -------- d-----w- C:\rsit
2012-01-11 11:47 . 2011-11-17 05:38 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 11:46 . 2011-11-19 14:01 67072 ----a-w- c:\windows\system32\packager.dll
2012-01-11 11:46 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 11:46 . 2011-10-26 04:32 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-10 22:07 . 2012-01-10 22:07 -------- d-----w- c:\users\Ja\AppData\Roaming\Malwarebytes
2012-01-10 22:06 . 2012-01-10 22:06 -------- d-----w- c:\programdata\Malwarebytes
2012-01-10 22:06 . 2012-01-12 11:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-10 10:43 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{455C103B-E95D-4436-AD9A-C841583F4E00}\mpengine.dll
2012-01-04 11:21 . 2012-01-04 11:21 -------- d-----w- c:\program files\Common Files\Java
2012-01-04 11:20 . 2011-11-17 17:06 637848 ----a-w- c:\windows\system32\npdeployJava1.dll
2011-12-17 21:05 . 2011-12-17 21:05 -------- d-----w- c:\windows\rescache
2011-12-16 12:13 . 2011-12-16 12:16 -------- d-----w- c:\users\Ja\AppData\Roaming\Crayon Physics Deluxe
2011-12-15 14:09 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-15 14:09 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-15 14:09 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-15 14:08 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-15 14:08 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-15 14:08 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-02 12:09 . 2011-06-20 06:16 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-01 10:39 . 2011-12-01 10:39 239168 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-11-28 18:01 . 2011-06-02 11:31 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-06-02 11:31 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-06-02 11:32 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-06-02 11:32 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-06-02 11:32 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-06-02 11:32 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-06-02 11:32 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2011-06-02 11:32 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-17 17:06 . 2011-06-26 13:32 567184 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-17 05:34 . 2012-01-12 11:42 224768 ----a-w- c:\windows\system32\schannel.dll
2011-09-29 07:07 . 2011-10-26 06:39 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-09-01 966712]
"googletalk"="c:\users\Ja\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-11-10 3514176]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"DeskUpdateNotifier"="c:\program files\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe" [2010-10-13 97560]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2011-06-02 557056]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-04 136176]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-04 136176]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-02 1343400]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-01 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2011-02-28 247096]
S3 SiS6350;SiS6350;c:\windows\system32\DRIVERS\SISGRKMD.sys [2011-06-02 466432]
S3 SiSGbeLH;SiS191/SiS190 – ovladač NDIS 6.0 zařízení sítě Ethernet;c:\windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-04 15:53]
.
2012-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-04 15:53]
.
2012-01-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job
- c:\users\Ja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-02 11:49]
.
2012-01-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job
- c:\users\Ja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-02 11:49]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/sk27211/
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
pref('extensions.shownSelectionUI',true); pref('extensions.autoDisableScopes',0);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-01-12 15:47:04
ComboFix-quarantined-files.txt 2012-01-12 14:47
.
Před spuštěním: 2 759 856 128
Po spuštění: 3 254 263 808
.
- - End Of File - - 5B918AE7638CBFA7918C290A8E0F4174

[Mc_Murphy]

Pokud jsi tak ještě neučinil, přesuň ComboFix na Plochu.

• Otevři si Poznámkový blok (Start >> Spustit... (nebo Win+R) >> do okénka napiš notepad >> [Enter]).
• Zkopíruj do něj tento script:

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=-
"Google Update"=-
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DivXUpdate"=-
"Adobe ARM"=-
"SunJavaUpdateSched"=-

Driver::
gupdate
gupdatem
ICQ Service

Folder::
C:\Program Files\ICQ6Toolbar

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job
C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.gif
C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.src
C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.xml
C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\btpersonas@brandthunder.com
C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

DDS::
uStart Page = hxxp://start.icq.com/sk27211/
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
FF - prefs.js: browser.search.selectedEngine - ICQ Search

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

• Ulož vytvořený TXT jako CFScript.txt
• Přetáhni vytvořený CFScript.txt nad ComboFix a pusť (viz obrázek).
  
• Po aplikaci scriptu (a případném restartu PC) na Tebe vyskočí log. Jeho obsah mi sem vlož.

Může se stát, že po aplikaci scriptu nenaběhnou Windows. V tom případě restartuj PC, hned při náběhu mačkej klávesu F8 a zvol Poslední známou konfiguraci.

[hp123]

tohle je log z C:\ComboFix.txt (zadnej se nezobrazil)




ComboFix 12-01-12.02 - Ja 12.01.2012 20:25:12.2.1 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2813.2007 [GMT 1:00]
Spuštěný z: C:\Users\Ja\Desktop\ComboFix.exe
Použité ovládací přepínače :: C:\Users\Ja\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}"
"C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\btpersonas@brandthunder.com"
"C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.gif"
"C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.src"
"C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.xml"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job"

[Mc_Murphy]

To není celé. Mrkni ještě jednou, jestli tam není a když tak aplikuj script v Nouzovém režimu ještě jednou.

[hp123]

log (po druhem spusteni se zobrazil)


ComboFix 12-01-12.02 - Ja 13.01.2012 12:18:58.3.1 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2813.1912 [GMT 1:00]
Spuštěný z: c:\users\Ja\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Ja\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}"
"c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\extensions\btpersonas@brandthunder.com"
"c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.gif"
"c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.src"
"c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.xml"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt
c:\program files\ICQ6Toolbar\voucher.bmp
c:\program files\ICQ6Toolbar\voucher2.bmp
c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.gif
c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.src
c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\searchplugins\icqplugin.xml
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3088516472-269752039-1467059600-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_ICQ Service
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-13 do 2012-01-13 )))))))))))))))))))))))))))))))
.
.
2012-01-13 11:25 . 2012-01-13 11:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-13 11:12 . 2012-01-13 11:29 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2991EDB5-2A5E-40EB-9B44-F04BA23540E2}\offreg.dll
2012-01-13 11:12 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2991EDB5-2A5E-40EB-9B44-F04BA23540E2}\mpengine.dll
2012-01-12 11:42 . 2011-11-17 05:34 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-12 11:42 . 2011-11-17 05:41 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-12 11:42 . 2011-11-17 05:39 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-12 11:42 . 2011-11-17 05:32 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-12 11:42 . 2011-11-17 05:41 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-12 11:42 . 2011-11-17 05:35 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-12 11:42 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-12 11:42 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-12 11:42 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-12 11:42 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-12 11:31 . 2012-01-12 11:48 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2012-01-11 20:33 . 2012-01-11 20:40 -------- d-----w- c:\program files\trend micro
2012-01-11 20:33 . 2012-01-11 20:40 -------- d-----w- C:\rsit
2012-01-11 11:47 . 2011-11-17 05:38 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 11:46 . 2011-11-19 14:01 67072 ----a-w- c:\windows\system32\packager.dll
2012-01-11 11:46 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 11:46 . 2011-10-26 04:32 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-10 22:07 . 2012-01-10 22:07 -------- d-----w- c:\users\Ja\AppData\Roaming\Malwarebytes
2012-01-10 22:06 . 2012-01-10 22:06 -------- d-----w- c:\programdata\Malwarebytes
2012-01-10 22:06 . 2012-01-12 11:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-04 11:21 . 2012-01-04 11:21 -------- d-----w- c:\program files\Common Files\Java
2012-01-04 11:20 . 2011-11-17 17:06 637848 ----a-w- c:\windows\system32\npdeployJava1.dll
2011-12-17 21:05 . 2011-12-17 21:05 -------- d-----w- c:\windows\rescache
2011-12-16 12:13 . 2011-12-16 12:16 -------- d-----w- c:\users\Ja\AppData\Roaming\Crayon Physics Deluxe
2011-12-15 14:09 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-15 14:09 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-15 14:09 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-15 14:08 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-15 14:08 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-15 14:08 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-02 12:09 . 2011-06-20 06:16 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-01 10:39 . 2011-12-01 10:39 239168 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-11-28 18:01 . 2011-06-02 11:31 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-06-02 11:31 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-06-02 11:32 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-06-02 11:32 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-06-02 11:32 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-06-02 11:32 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-06-02 11:32 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2011-06-02 11:32 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-17 17:06 . 2011-06-26 13:32 567184 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-17 05:34 . 2012-01-12 11:42 224768 ----a-w- c:\windows\system32\schannel.dll
2011-09-29 07:07 . 2011-10-26 06:39 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-09-01 966712]
"googletalk"="c:\users\Ja\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"DeskUpdateNotifier"="c:\program files\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe" [2010-10-13 97560]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2011-06-02 557056]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-02 1343400]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-01 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
S3 SiS6350;SiS6350;c:\windows\system32\DRIVERS\SISGRKMD.sys [2011-06-02 466432]
S3 SiSGbeLH;SiS191/SiS190 – ovladač NDIS 6.0 zařízení sítě Ethernet;c:\windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]
.
.
.
------- Doplňkový sken -------
.
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\geg2evjl.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
pref('extensions.shownSelectionUI',true); pref('extensions.autoDisableScopes',0);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
.
**************************************************************************
.
Celkový čas: 2012-01-13 12:52:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-01-13 11:52
ComboFix2.txt 2012-01-12 14:47
.
Před spuštěním: 3 018 534 912
Po spuštění: 3 005 558 784
.
- - End Of File - - FEE6806F01A5A2A41EFC8BE760ED638D

[Mc_Murphy]

To už vypadá lépe. Jak se chová počítač?

[hp123]

pc se chová normálně (až na to že na google Chrome občas stránka sama přejde na facebook na nějakou hru - to pravděpodobně způsobuje ten vir)

[Mc_Murphy]

Tohle žádný vir pravděpodobně není. Nemáme to ještě pořádně prošetřeno. Počítače lidí, co to chytli jsou čisté.
Zkus se přihlásit na Facebook a zkontroluj si pořádně nastavení aplikací, které máš povolené. Třeba tam bude něco, co tam nepatří.
Ono, co si budeme povídat, že? - každý klikáte na kdejakou kravinu, povolujete vše možné, co vidíte nebo co vám kdo pošle a pak se strašně divíte.

Dej mi sem ještě log z OTL, mrknu, jestli něco nevisí v tom Google Chrome.

Stáhni OTL z tohoto odkazu a ulož jej na Plochu.

• Pokud používáš Win Vista či Win7, klikni na OTL pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Pokud používáš 64bitový OS, zkontroluj, zda-li je zaškrtnutý čtvereček Pro 64 bitové OS. Pokud ne, zaškrtni jej.
• Zaškrtni okénko Pro všechny uživatele.
• Zaškrtni okénko Kontrola na havěť "LOP".
• Zaškrtni okénko Kontrola na havěť "Purity".
• Stáři souborů změň z 30 dnů na 7 dnů!!
• Do spodního okénka Vlastní skenování/opravy vlož tento script (pouze zelená písmenka v bílém poli!):

Kód: Vybrat vše

CREATERESTOREPOINT
netsvc
drivers32
savembr:0
/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop
%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe
%userprofile%\Plocha\*.*
%userprofile%\Desktop\*.*
%ALLUSERSPROFILE%\Plocha\*.*
%ALLUSERSPROFILE%\Desktop\*.*
*crack* /s
*keygen* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*TemDono* /s
*AutoKMS* /s
*KMSEmulator* /s
*activator* /s
*serial* /s
*w7lxe* /s
*AutoRearm* /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /s
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5

• Klikni na tlačítko [Prohledat].
• Po dokončení skenu se objeví logy OTL.txt a Extras.txt, oba mi sem vlož.
• Logy se nevejdou do jednoho, rozděl je tedy prosím do více příspěvků.

[hp123]

bohužel OTL se po chvíli zasekne takže log nemám ale po reinstalaci Chromu problém přestal takže díky za pomoc (a ještě k tomu "každý klikáte na kdejakou kravinu, povolujete vše možné, co vidíte nebo co vám kdo pošle a pak se strašně divíte.") tento odkaz byl bohužel přesná kopie youtube (pouze se objevil dotaz na přehrátí v HD) při pokusu o zavření se stáhla tahle havěť