VIRY.CZ

Zdravím, chalani pozreli by ste mi prosím log? ďiky moc

Logfile of random's system information tool 1.09 (written by random/random)
Run by majlo at 2012-03-31 19:35:29
Microsoft Windows 7 Ultimate
System drive C: has 3 GB (21%) free of 15 GB
Total RAM: 1012 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:36:50, on 31. 3. 2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\majlo\Desktop\RSIT.exe
C:\Program Files\trend micro\majlo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/softwa ... Plugin.cab
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Scia Licence Server - Flexera Software, Inc. - C:\Program Files\Common Files\SCIA\Protection\lmgrd.exe

--
End of file - 2910 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2012-03-20 192112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll [2012-03-05 1003576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2012-03-20 192112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SearchSettings"=C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe [2012-03-04 934752]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-31 460872]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-31 460872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2012-03-05 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [2006-03-05 11000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - "C:\Windows\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2012-03-31 19:35:44 ----D---- C:\Program Files\trend micro
2012-03-31 19:35:29 ----D---- C:\rsit
2012-03-31 18:43:13 ----D---- C:\Users\majlo\AppData\Roaming\Malwarebytes
2012-03-31 18:41:40 ----D---- C:\ProgramData\Malwarebytes
2012-03-31 18:41:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-03-31 18:41:34 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-03-31 17:11:43 ----D---- C:\Windows\Temp
2012-03-31 17:02:37 ----SHD---- C:\Config.Msi
2012-03-31 16:36:47 ----SHD---- C:\$RECYCLE.BIN
2012-03-31 16:35:14 ----A---- C:\ComboFix.txt
2012-03-31 14:51:11 ----D---- C:\Windows\ERDNT
2012-03-29 14:20:02 ----N---- C:\bootsqm.dat
2012-03-29 01:31:52 ----D---- C:\Users\majlo\AppData\Roaming\AVG2012
2012-03-29 01:26:25 ----HD---- C:\ProgramData\Common Files
2012-03-29 00:59:10 ----D---- C:\ProgramData\AVG2012
2012-03-29 00:39:56 ----D---- C:\ProgramData\MFAData
2012-03-28 23:03:22 ----D---- C:\Users\majlo\AppData\Roaming\AVG
2012-03-28 23:02:15 ----AD---- C:\ProgramData\TEMP
2012-03-28 22:59:36 ----D---- C:\Program Files\AVG
2012-03-28 00:14:59 ----A---- C:\Windows\system32\psisdecd.dll
2012-03-28 00:12:12 ----A---- C:\Windows\system32\umpnpmgr.dll
2012-03-28 00:06:28 ----A---- C:\Windows\system32\tzres.dll
2012-03-27 23:56:25 ----A---- C:\Windows\system32\shell32.dll
2012-03-27 23:56:07 ----A---- C:\Windows\system32\lsasrv.dll
2012-03-27 23:56:07 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-03-27 23:53:43 ----A---- C:\Windows\system32\t2embed.dll
2012-03-27 23:53:43 ----A---- C:\Windows\system32\fontsub.dll
2012-03-27 23:53:43 ----A---- C:\Windows\system32\atmfd.dll
2012-03-27 23:35:33 ----A---- C:\Windows\system32\browserchoice.exe
2012-03-27 22:25:54 ----D---- C:\Program Files\MSXML 4.0
2012-03-27 16:13:18 ----A---- C:\Windows\system32\csrsrv.dll
2012-03-27 14:39:44 ----A---- C:\Windows\system32\quartz.dll
2012-03-27 14:39:40 ----A---- C:\Windows\system32\qdvd.dll
2012-03-27 14:30:45 ----A---- C:\Windows\system32\odbcjt32.dll
2012-03-27 14:30:44 ----A---- C:\Windows\system32\odbccp32.dll
2012-03-27 14:30:33 ----A---- C:\Windows\system32\odbccr32.dll
2012-03-27 14:30:31 ----A---- C:\Windows\system32\odbccu32.dll
2012-03-27 14:30:19 ----A---- C:\Windows\system32\odbctrac.dll
2012-03-27 13:57:32 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-03-27 13:57:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-03-27 13:54:02 ----A---- C:\Windows\system32\wmpmde.dll
2012-03-27 13:27:05 ----A---- C:\Windows\system32\mfc42.dll
2012-03-27 13:26:19 ----A---- C:\Windows\system32\mfc42u.dll
2012-03-27 11:48:51 ----A---- C:\Windows\system32\StructuredQuery.dll
2012-03-27 11:15:58 ----D---- C:\Windows\Minidump
2012-03-27 11:09:15 ----A---- C:\Windows\system32\rdpcore.dll
2012-03-27 11:08:50 ----A---- C:\Windows\system32\drivers\tdtcp.sys
2012-03-27 11:08:48 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-03-27 10:57:39 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-03-27 10:57:39 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-03-27 10:57:33 ----A---- C:\Windows\system32\rdpwsx.dll
2012-03-27 10:52:51 ----A---- C:\Windows\system32\cabview.dll
2012-03-27 10:31:42 ----D---- C:\ProgramData\AVAST Software
2012-03-27 10:31:41 ----D---- C:\Program Files\AVAST Software
2012-03-27 10:28:23 ----A---- C:\Windows\system32\poqexec.exe
2012-03-22 17:04:21 ----D---- C:\Windows\pss
2012-03-22 16:25:08 ----D---- C:\ProgramData\FNP
2012-03-22 16:25:08 ----D---- C:\ProgramData\FLEXnet
2012-03-22 16:24:04 ----D---- C:\Program Files\Common Files\Macrovision Shared
2012-03-22 16:21:34 ----D---- C:\Program Files\Common Files\SCIA
2012-03-22 16:16:03 ----D---- C:\Program Files\Common Files\CADS Shared
2012-03-22 15:42:09 ----D---- C:\Program Files\InstallShield Installation Information
2012-03-22 15:34:50 ----D---- C:\ProgramData\Scia
2012-03-22 15:24:20 ----D---- C:\Program Files\SCIA
2012-03-20 21:31:00 ----D---- C:\Program Files\Application Updater
2012-03-20 21:30:39 ----D---- C:\Program Files\pdfforge Toolbar
2012-03-20 21:30:39 ----D---- C:\Program Files\Common Files\Spigot
2012-03-20 21:25:56 ----A---- C:\Windows\system32\pdfcmnnt.dll
2012-03-20 21:25:41 ----D---- C:\Program Files\PDFCreator
2012-03-20 21:25:41 ----A---- C:\Windows\system32\MSMPIDE.DLL
2012-03-05 22:11:07 ----D---- C:\Program Files\Sibelius Software
2012-03-05 19:28:49 ----D---- C:\Program Files\Common Files\Adobe
2012-03-05 19:28:49 ----D---- C:\Program Files\Adobe
2012-03-05 19:24:50 ----D---- C:\ProgramData\Adobe
2012-03-05 15:09:23 ----D---- C:\Users\majlo\AppData\Roaming\WinRAR
2012-03-05 15:08:41 ----D---- C:\Program Files\WinRAR
2012-03-05 13:32:07 ----D---- C:\Program Files\Microsoft Office
2012-03-05 13:31:05 ----D---- C:\Program Files\AnswerWorks 4.0
2012-03-05 13:30:23 ----D---- C:\Program Files\Common Files\Designer
2012-03-05 13:26:32 ----D---- C:\Users\majlo\AppData\Roaming\Autodesk
2012-03-05 13:26:32 ----D---- C:\ProgramData\Autodesk
2012-03-05 13:26:30 ----D---- C:\Program Files\AutoCAD 2007
2012-03-05 13:21:13 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-03-05 13:20:04 ----D---- C:\Program Files\Autodesk
2012-03-05 13:18:59 ----A---- C:\Windows\system32\d3dx9_27.dll
2012-03-05 12:06:19 ----D---- C:\Users\majlo\AppData\Roaming\Google
2012-03-05 12:04:36 ----D---- C:\Users\majlo\AppData\Roaming\Macromedia
2012-03-05 12:04:30 ----D---- C:\Users\majlo\AppData\Roaming\Adobe
2012-03-05 12:01:44 ----SHD---- C:\Windows\Installer
2012-03-05 11:59:11 ----D---- C:\ProgramData\Google
2012-03-05 11:59:11 ----D---- C:\Program Files\Google
2012-03-05 11:59:01 ----D---- C:\Windows\system32\Macromed
2012-03-05 11:54:26 ----A---- C:\Windows\system32\EuEpmGdi.dll
2012-03-05 11:54:26 ----A---- C:\Windows\system32\BootMan.exe
2012-03-05 11:54:18 ----A---- C:\Windows\system32\setupempdrv03.exe
2012-03-05 11:54:18 ----A---- C:\Windows\system32\EuGdiDrv.sys
2012-03-05 11:54:18 ----A---- C:\Windows\system32\epmntdrv.sys
2012-03-05 11:53:36 ----D---- C:\Program Files\EASEUS
2012-03-04 13:48:17 ----N---- C:\Windows\system32\MpSigStub.exe
2012-03-04 13:25:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-03-04 13:24:14 ----D---- C:\Users\majlo\AppData\Roaming\Identities
2012-03-04 13:19:39 ----D---- C:\Users\majlo\AppData\Roaming\Media Center Programs
2012-03-04 13:19:37 ----SD---- C:\Users\majlo\AppData\Roaming\Microsoft
2012-03-04 13:03:53 ----D---- C:\Recovery
2012-03-04 12:07:20 ----D---- C:\Windows\SoftwareDistribution
2012-03-04 11:58:29 ----D---- C:\Windows\Prefetch
2012-03-04 11:57:18 ----ASH---- C:\hiberfil.sys
2012-03-04 11:57:17 ----SHD---- C:\System Volume Information
2012-03-04 11:57:17 ----ASH---- C:\pagefile.sys
2012-03-04 11:56:13 ----D---- C:\Windows\Panther

======List of files/folders modified in the last 1 month======

2012-03-31 19:35:44 ----RD---- C:\Program Files
2012-03-31 19:35:23 ----D---- C:\Windows
2012-03-31 19:24:51 ----D---- C:\Windows\system32\drivers
2012-03-31 18:41:40 ----D---- C:\ProgramData
2012-03-31 17:11:30 ----D---- C:\Windows\inf
2012-03-31 16:09:56 ----A---- C:\Windows\system.ini
2012-03-31 16:08:06 ----D---- C:\Windows\system32\drivers\etc
2012-03-31 15:24:22 ----D---- C:\Windows\System32
2012-03-31 15:24:21 ----D---- C:\Windows\AppPatch
2012-03-31 15:24:05 ----D---- C:\Program Files\Common Files
2012-03-31 13:05:49 ----D---- C:\Windows\Microsoft.NET
2012-03-31 13:01:23 ----RSD---- C:\Windows\assembly
2012-03-31 12:55:57 ----D---- C:\Windows\system32\wdi
2012-03-31 12:14:31 ----D---- C:\Windows\system32\config
2012-03-31 01:57:12 ----D---- C:\Windows\debug
2012-03-30 23:43:28 ----D---- C:\Windows\system32\catroot
2012-03-30 23:43:08 ----D---- C:\Windows\system32\catroot2
2012-03-30 22:33:13 ----D---- C:\Windows\winsxs
2012-03-29 01:33:00 ----D---- C:\Windows\system32\Tasks
2012-03-29 01:14:15 ----D---- C:\Windows\system32\DriverStore
2012-03-28 23:40:12 ----D---- C:\Windows\Downloaded Program Files
2012-03-28 20:11:57 ----D---- C:\Windows\ehome
2012-03-28 20:09:24 ----D---- C:\Windows\system32\sk-SK
2012-03-28 18:32:40 ----D---- C:\Windows\Logs
2012-03-25 11:18:44 ----D---- C:\Windows\system32\NDF
2012-03-22 15:44:51 ----D---- C:\Program Files\Common Files\microsoft shared
2012-03-21 01:47:03 ----D---- C:\Windows\system32\FxsTmp
2012-03-11 22:44:17 ----SD---- C:\ProgramData\Microsoft
2012-03-05 22:11:52 ----RSD---- C:\Windows\Fonts
2012-03-05 13:29:17 ----D---- C:\Windows\Help
2012-03-05 13:12:01 ----D---- C:\Windows\system32\LogFiles
2012-03-05 12:01:17 ----D---- C:\Windows\Tasks
2012-03-04 13:44:50 ----D---- C:\Windows\system32\restore
2012-03-04 13:24:56 ----D---- C:\Windows\system32\wbem
2012-03-04 13:19:34 ----RD---- C:\Users
2012-03-04 12:33:07 ----D---- C:\Windows\system32\sysprep
2012-03-04 12:16:50 ----D---- C:\Windows\system32\drivers\UMDF
2012-03-04 12:07:08 ----D---- C:\Windows\system32\CodeIntegrity
2012-03-04 12:00:28 ----D---- C:\Windows\CSC
2012-03-04 11:54:36 ----D---- C:\Windows\Setup

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-07-14 1096704]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 20464]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\majlo\AppData\Local\Temp\catchme.sys []
S3 epmntdrv;epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [2011-07-29 14216]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [2011-07-29 8456]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-31 652360]
R2 Scia Licence Server;Scia Licence Server; C:\Program Files\Common Files\SCIA\Protection\lmgrd.exe [2010-10-12 1379664]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-03-22 1045328]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 Application Updater;Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [2012-03-04 748440]
S4 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2012-03-05 77944]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-05 136176]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-03-05 136176]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-03-05 182768]

-----------------EOF-----------------

Také zdravím!
Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Zdravím, nech sa pači:

ComboFix 12-04-01.03 - majlo . 04. 2012 12:37:01.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.421.1051.18.1012.508 [GMT 2:00]
Running from: c:\users\majlo\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-03-03 to 2012-04-03 )))))))))))))))))))))))))))))))
.
.
2012-04-03 11:04 . 2012-04-03 11:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-28 23:26 . 2012-03-28 23:26 -------- d--h--w- c:\programdata\Common Files
2012-03-28 22:59 . 2012-03-31 16:32 -------- d-----w- c:\programdata\AVG2012
2012-03-28 22:39 . 2012-03-31 15:27 -------- d-----w- c:\programdata\MFAData
2012-03-28 20:59 . 2012-03-28 22:47 -------- d-----w- c:\program files\AVG
2012-03-27 22:14 . 2011-08-17 04:26 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-03-27 22:14 . 2011-08-17 04:22 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-03-27 22:14 . 2011-08-17 04:22 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-03-27 22:14 . 2011-08-17 04:22 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-03-27 22:14 . 2011-08-17 04:22 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-03-27 22:12 . 2011-05-24 10:35 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-03-27 22:06 . 2011-11-05 04:30 2048 ----a-w- c:\windows\system32\tzres.dll
2012-03-27 21:56 . 2009-12-11 07:44 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-03-27 21:56 . 2009-12-11 07:38 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2012-03-27 21:53 . 2009-10-19 14:10 108544 ----a-w- c:\windows\system32\t2embed.dll
2012-03-27 21:53 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2012-03-27 21:53 . 2009-07-30 04:44 293888 ----a-w- c:\windows\system32\atmfd.dll
2012-03-27 21:35 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2012-03-27 20:25 . 2012-03-27 20:25 -------- d-----w- c:\program files\MSXML 4.0
2012-03-27 16:05 . 2012-03-14 02:15 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3193DCED-A2DD-4707-8B7C-264AF2A4CD03}\mpengine.dll
2012-03-27 14:13 . 2011-10-26 04:25 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-03-27 12:39 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-03-27 12:39 . 2011-10-26 04:28 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-03-27 12:30 . 2011-06-15 09:04 319488 ----a-w- c:\windows\system32\odbcjt32.dll
2012-03-27 12:30 . 2011-06-15 09:04 122880 ----a-w- c:\windows\system32\odbccp32.dll
2012-03-27 12:30 . 2011-06-15 09:04 81920 ----a-w- c:\windows\system32\odbccr32.dll
2012-03-27 12:30 . 2011-06-15 09:04 86016 ----a-w- c:\windows\system32\odbccu32.dll
2012-03-27 12:30 . 2011-06-15 09:04 94208 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
2012-03-27 12:30 . 2011-06-15 09:04 163840 ----a-w- c:\windows\system32\odbctrac.dll
2012-03-27 11:57 . 2011-10-26 04:42 3957104 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-27 11:57 . 2011-10-26 04:42 3901808 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-27 11:54 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2012-03-27 11:27 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\system32\mfc42.dll
2012-03-27 11:26 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2012-03-27 09:48 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-03-27 09:09 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-27 09:08 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-27 09:08 . 2012-02-15 04:22 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-27 08:57 . 2012-01-25 05:44 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-27 08:57 . 2012-01-25 05:40 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-27 08:57 . 2012-01-25 05:44 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-27 08:52 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2012-03-27 08:31 . 2012-03-27 12:07 -------- d-----w- c:\programdata\AVAST Software
2012-03-27 08:31 . 2012-03-27 08:31 -------- d-----w- c:\program files\AVAST Software
2012-03-27 08:28 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2012-03-22 14:25 . 2012-03-28 20:00 -------- d-----w- c:\programdata\FLEXnet
2012-03-22 14:25 . 2012-03-22 14:25 -------- d-----w- c:\programdata\FNP
2012-03-22 14:24 . 2012-03-22 14:24 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2012-03-22 14:21 . 2012-03-22 14:21 -------- d-----w- c:\program files\Common Files\SCIA
2012-03-22 14:16 . 2012-03-22 14:16 -------- d-----w- c:\program files\Common Files\CADS Shared
2012-03-22 13:42 . 2012-03-22 14:22 -------- d-----w- c:\program files\InstallShield Installation Information
2012-03-22 13:34 . 2012-03-22 13:34 -------- d-----w- c:\programdata\Scia
2012-03-22 13:24 . 2012-03-22 13:24 -------- d-----w- c:\program files\SCIA
2012-03-20 19:31 . 2012-03-20 19:31 -------- d-----w- c:\program files\Application Updater
2012-03-20 19:30 . 2012-03-20 19:31 -------- d-----w- c:\program files\pdfforge Toolbar
2012-03-20 19:30 . 2012-03-20 19:30 -------- d-----w- c:\program files\Common Files\Spigot
2012-03-20 19:25 . 2005-04-15 19:58 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-03-20 19:25 . 1998-06-24 00:00 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-03-20 19:25 . 2004-03-09 00:00 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-03-20 19:25 . 2001-10-28 16:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2012-03-20 19:25 . 2012-03-20 19:54 -------- d-----w- c:\program files\PDFCreator
2012-03-20 19:25 . 1998-07-06 00:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-03-05 20:11 . 2012-03-05 20:11 -------- d-----w- c:\program files\Sibelius Software
2012-03-05 17:28 . 2012-03-05 17:30 -------- d-----w- c:\program files\Common Files\Adobe
2012-03-05 11:31 . 2012-03-05 11:31 -------- d-----w- c:\program files\AnswerWorks 4.0
2012-03-05 11:26 . 2012-03-05 12:58 -------- d-----w- c:\programdata\Autodesk
2012-03-05 11:26 . 2012-03-05 13:10 -------- d-----w- c:\program files\AutoCAD 2007
2012-03-05 11:21 . 2012-03-05 11:44 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2012-03-05 11:20 . 2012-03-05 11:20 -------- d-----w- c:\program files\Autodesk
2012-03-05 10:01 . 2012-03-31 15:27 -------- d-sh--w- c:\windows\Installer
2012-03-05 09:59 . 2012-03-05 10:03 -------- d-----w- c:\program files\Google
2012-03-05 09:59 . 2012-03-05 09:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-05 09:59 . 2012-03-05 09:59 -------- d-----w- c:\windows\system32\Macromed
2012-03-05 09:54 . 2011-09-09 17:23 2469760 ----a-w- c:\windows\system32\BootMan.exe
2012-03-05 09:54 . 2011-07-29 12:54 19840 ----a-w- c:\windows\system32\EuEpmGdi.dll
2012-03-05 09:54 . 2011-07-29 12:54 86408 ----a-w- c:\windows\system32\setupempdrv03.exe
2012-03-05 09:54 . 2011-07-29 12:54 8456 ----a-w- c:\windows\system32\EuGdiDrv.sys
2012-03-05 09:54 . 2011-07-29 12:54 14216 ----a-w- c:\windows\system32\epmntdrv.sys
2012-03-05 09:53 . 2012-03-05 09:53 -------- d-----w- c:\program files\EASEUS
2012-03-04 11:48 . 2012-02-23 07:18 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-03-04 11:24 . 2012-03-28 21:16 -------- d-----w- c:\windows\system32\wbem\Performance
2012-03-04 11:19 . 2012-03-27 11:08 -------- d-----w- c:\users\majlo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSTITL.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSTEXT.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSSTMP.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSSPEC.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSSCRP.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSREH_.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSMET_.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRSCHOR.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\RPRS____.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSTEXT.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSSE__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSS___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSROMC.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSPC__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSP___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSO___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSNN__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSM___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSFS__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSFBE_.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSFB__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSCSC_.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSCS__.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUSC___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\OPUS____.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INKPEN2_.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INK2TEXT.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INK2SPEC.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INK2SCRI.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INK2METR.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\INK2CHOR.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\HELST___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\HELSS___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\HELSM___.FOT
2012-03-05 20:11 . 2012-03-05 20:11 1409 ----a-w- c:\windows\Fonts\HELSINKI.FOT
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-05 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-03-04 934752]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-31 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 11:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 14216]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2012-03-04 748440]
R4 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2012-03-05 136176]
R4 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2012-03-05 136176]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-31 652360]
S2 Scia Licence Server;Scia Licence Server;c:\program files\Common Files\SCIA\Protection\lmgrd.exe [2010-10-12 1379664]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-05 09:59]
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-05 09:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
TCP: DhcpNameServer = 192.168.234.100 192.168.234.1
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600
.
CreateFile("\\.\PHYSICALDRIVE0"): Proces nemôže získať prístup k súboru, pretože daný súbor práve používa iný proces.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-04-03 13:34:01
ComboFix-quarantined-files.txt 2012-04-03 11:34
ComboFix2.txt 2012-03-31 14:35
.
Pre-Run: 3 186 688 000 bytes free
Post-Run: 3 222 794 240 bytes free
.
- - End Of File - - C0E1BF2C309C41914905BC103D02F19C

1. Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files\Google\GoogleToolbarNotifier
c:\program files\Common Files\Spigot

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SearchSettings"=-

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.



2. Po akci s CF Stáhněte, rozbalte a spusťte TDSSKiller: http://support.kaspersky.com/downloads/ ... killer.zip . nechte pracovat a na závěr sem dejte log.