VIRY.CZ

Prosím o kontrolu logu strašně pomalý notebook, pomalé mazaní souborů a vysipávání koše.



Logfile of random's system information tool 1.09 (written by random/random)
Run by Petra at 2012-07-25 14:40:50
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 5 GB (7%) free of 67 GB
Total RAM: 1015 MB (36% free)


======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\rqthheys.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872, avg@igeared:6.010.006.004, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://isearch.avg.com/search?cid=%7B63 ... &sap=ku&q="

"{3f963a5b-e555-4543-90e2-c3908898db71}"=C:\Program Files\AVG\AVG9\Firefox
"avg@toolbar"=C:\ProgramData\AVG Secure Search\11.1.0.7\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.3.300.265 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin]
"Description"=
"Path"=C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
avg-secure-search.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\rqthheys.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-03-26 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-11-27 1623392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll [2012-07-03 2068536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll [2012-07-03 2068536]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2012-03-04 2077536]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2012-07-03 1104440]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-03-27 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-07-25 14:40:51 ----D---- C:\Program Files\trend micro
2012-07-25 14:40:50 ----D---- C:\rsit
2012-07-25 14:40:16 ----D---- C:\Program Files\Defraggler
2012-07-24 20:42:54 ----D---- C:\Filmy
2012-07-24 19:41:28 ----A---- C:\Windows\system32\mshtmled.dll
2012-07-24 19:41:27 ----A---- C:\Windows\system32\iertutil.dll
2012-07-24 19:41:26 ----A---- C:\Windows\system32\ieui.dll
2012-07-24 19:41:25 ----A---- C:\Windows\system32\wininet.dll
2012-07-24 19:41:25 ----A---- C:\Windows\system32\jsproxy.dll
2012-07-24 19:41:25 ----A---- C:\Windows\system32\ieUnatt.exe
2012-07-24 19:41:24 ----A---- C:\Windows\system32\jscript9.dll
2012-07-24 19:41:24 ----A---- C:\Windows\system32\jscript.dll
2012-07-24 19:41:23 ----A---- C:\Windows\system32\url.dll
2012-07-24 19:41:21 ----A---- C:\Windows\system32\urlmon.dll
2012-07-24 19:41:19 ----A---- C:\Windows\system32\mshtml.dll
2012-07-24 19:41:15 ----A---- C:\Windows\system32\ieframe.dll
2012-07-24 19:32:30 ----A---- C:\Windows\system32\win32k.sys
2012-07-24 19:29:42 ----A---- C:\Windows\system32\msxml6.dll
2012-07-24 19:29:42 ----A---- C:\Windows\system32\msxml3.dll
2012-07-24 19:29:41 ----A---- C:\Windows\system32\msxml3r.dll
2012-07-24 19:29:02 ----A---- C:\Windows\system32\cdosys.dll
2012-07-24 19:28:22 ----A---- C:\Windows\system32\ncrypt.dll
2012-07-24 19:28:22 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-07-24 19:28:22 ----A---- C:\Windows\system32\drivers\cng.sys
2012-07-24 19:28:21 ----A---- C:\Windows\system32\schannel.dll
2012-07-24 19:28:21 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-07-24 19:28:16 ----A---- C:\Windows\system32\shell32.dll
2012-07-03 21:53:46 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-07-03 21:02:06 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-07-03 21:02:05 ----A---- C:\Windows\system32\wmi.dll
2012-07-03 21:02:05 ----A---- C:\Windows\system32\wintrust.dll
2012-07-03 21:02:05 ----A---- C:\Windows\system32\imagehlp.dll
2012-07-03 20:57:52 ----A---- C:\Windows\system32\profsvc.dll
2012-07-03 20:57:49 ----A---- C:\Windows\system32\drivers\partmgr.sys
2012-07-03 20:57:28 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-07-03 20:57:27 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-07-03 20:57:23 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-07-03 20:57:14 ----A---- C:\Windows\system32\msi.dll
2012-07-03 20:57:12 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-07-03 20:57:08 ----A---- C:\Windows\system32\rdpcorekmts.dll
2012-07-03 20:57:07 ----A---- C:\Windows\system32\rdrmemptylst.exe
2012-07-03 20:57:07 ----A---- C:\Windows\system32\rdpwsx.dll
2012-07-03 20:56:44 ----A---- C:\Windows\system32\DWrite.dll
2012-07-03 20:53:47 ----A---- C:\Windows\system32\cryptsvc.dll
2012-07-03 20:53:47 ----A---- C:\Windows\system32\crypt32.dll
2012-07-03 20:53:46 ----A---- C:\Windows\system32\cryptnet.dll
2012-07-03 20:47:12 ----A---- C:\Windows\system32\wups2.dll
2012-07-03 20:47:11 ----A---- C:\Windows\system32\wucltux.dll
2012-07-03 20:47:11 ----A---- C:\Windows\system32\wuaueng.dll
2012-07-03 20:47:11 ----A---- C:\Windows\system32\wuauclt.exe
2012-07-03 20:45:56 ----A---- C:\Windows\system32\wups.dll
2012-07-03 20:45:56 ----A---- C:\Windows\system32\wudriver.dll
2012-07-03 20:45:56 ----A---- C:\Windows\system32\wuapi.dll
2012-07-03 20:43:35 ----D---- C:\ProgramData\MFAData
2012-07-03 20:41:48 ----D---- C:\ProgramData\Temp
2012-07-03 20:41:40 ----D---- C:\Program Files\Adobe
2012-07-03 20:41:37 ----A---- C:\Windows\system32\wuwebv.dll
2012-07-03 20:41:37 ----A---- C:\Windows\system32\wuapp.exe
2012-07-03 20:37:13 ----SHD---- C:\Config.Msi

======List of files/folders modified in the last 1 month======

2012-07-25 14:40:51 ----RD---- C:\Program Files
2012-07-25 14:38:50 ----D---- C:\Windows\system32\config
2012-07-25 14:38:06 ----D---- C:\Windows\Temp
2012-07-25 14:33:14 ----D---- C:\Windows\system32\drivers\Avg
2012-07-25 12:32:42 ----D---- C:\PETRA
2012-07-25 09:26:14 ----D---- C:\Windows
2012-07-24 21:52:17 ----D---- C:\Windows\Microsoft.NET
2012-07-24 21:52:15 ----RSD---- C:\Windows\assembly
2012-07-24 21:00:27 ----D---- C:\Users\Petra\AppData\Roaming\DAEMON Tools Lite
2012-07-24 20:17:42 ----D---- C:\Windows\system32\NDF
2012-07-24 19:59:59 ----D---- C:\Windows\debug
2012-07-24 19:51:39 ----D---- C:\Windows\winsxs
2012-07-24 19:46:56 ----D---- C:\Windows\system32\migration
2012-07-24 19:46:55 ----D---- C:\Windows\System32
2012-07-24 19:46:50 ----D---- C:\Program Files\Internet Explorer
2012-07-24 19:46:43 ----D---- C:\Windows\system32\drivers
2012-07-24 19:43:15 ----D---- C:\Windows\system32\catroot
2012-07-24 19:43:00 ----D---- C:\Windows\system32\catroot2
2012-07-24 19:33:31 ----A---- C:\Windows\system32\MRT.exe
2012-07-24 19:30:59 ----SHD---- C:\System Volume Information
2012-07-24 19:09:40 ----D---- C:\Program Files\McAfee Security Scan
2012-07-04 16:26:41 ----SD---- C:\Users\Petra\AppData\Roaming\Microsoft
2012-07-03 21:59:06 ----D---- C:\Windows\inf
2012-07-03 21:56:25 ----D---- C:\Windows\system32\Tasks
2012-07-03 21:56:19 ----D---- C:\Program Files\CCleaner
2012-07-03 21:53:54 ----D---- C:\Windows\Tasks
2012-07-03 21:50:27 ----D---- C:\Program Files\Mozilla Firefox
2012-07-03 21:49:24 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-07-03 21:38:34 ----D---- C:\Windows\system32\cs-CZ
2012-07-03 21:38:33 ----D---- C:\Program Files\Windows Journal
2012-07-03 21:35:22 ----SHD---- C:\Windows\Installer
2012-07-03 20:43:35 ----HD---- C:\ProgramData
2012-07-03 20:42:41 ----D---- C:\Program Files\Common Files\Adobe
2012-07-03 20:42:33 ----D---- C:\ProgramData\Adobe
2012-07-03 20:30:20 ----D---- C:\ProgramData\AVG Secure Search
2012-07-03 20:30:17 ----D---- C:\Program Files\AVG Secure Search
2012-07-03 20:30:05 ----D---- C:\Program Files\Common Files\AVG Secure Search

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2010-07-22 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2011-12-02 29712]
R1 AvgTdiX;AVG Free Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2011-08-01 243152]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-02 239168]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-07-08 2506232]
R3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2009-07-14 159232]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2009-04-20 9344]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-14 207360]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-14 980992]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-14 661504]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg9emc;AVG Free E-mail Scanner; C:\Program Files\AVG\AVG9\avgemc.exe [2010-07-22 921952]
R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-11-27 308136]
R2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-07-03 935480]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-24 250056]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-11-10 167264]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-04-05 1343400]

-----------------EOF-----------------

Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

ComboFix 12-07-26.03 - Petra 25.07.2012 20:09:14.1.1 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1015.384 [GMT 2:00]
Spuštěný z: c:\users\Petra\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-25 do 2012-07-25 )))))))))))))))))))))))))))))))
.
.
2012-07-25 18:16 . 2012-07-25 18:16 -------- d-----w- c:\users\Petra\AppData\Local\temp
2012-07-25 18:16 . 2012-07-25 18:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-25 12:40 . 2012-07-25 12:40 -------- d-----w- c:\program files\trend micro
2012-07-25 12:40 . 2012-07-25 12:42 -------- d-----w- C:\rsit
2012-07-25 12:40 . 2012-07-25 12:40 -------- d-----w- c:\program files\Defraggler
2012-07-24 18:42 . 2012-07-24 19:40 -------- d-----w- C:\Filmy
2012-07-24 17:32 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-24 17:29 . 2012-06-06 05:05 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-07-24 17:29 . 2012-06-06 05:05 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-24 17:29 . 2010-06-26 03:24 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-24 17:29 . 2012-06-06 05:05 1019904 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-24 17:29 . 2012-06-06 05:03 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-07-24 17:29 . 2012-06-06 05:05 143360 ----a-w- c:\program files\Common Files\System\ado\msjro.dll
2012-07-24 17:29 . 2012-06-06 05:05 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-24 17:29 . 2012-06-06 05:05 57344 ----a-w- c:\program files\Common Files\System\ado\msador15.dll
2012-07-24 17:29 . 2012-06-06 05:05 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-24 17:29 . 2012-06-06 05:05 212992 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-24 17:28 . 2012-06-02 04:45 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-07-24 17:28 . 2012-06-02 04:40 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-07-24 17:28 . 2012-06-02 04:39 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-24 17:28 . 2012-06-02 04:45 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-24 17:28 . 2012-06-02 04:40 225280 ----a-w- c:\windows\system32\schannel.dll
2012-07-04 14:26 . 2012-07-04 14:26 -------- d-----w- c:\users\Petra\AppData\Local\Macromedia
2012-07-03 19:53 . 2012-07-24 17:19 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-03 19:53 . 2012-07-24 17:19 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-03 19:44 . 2012-07-03 19:44 -------- d-----w- c:\users\Petra\AppData\Local\AVG Secure Search
2012-07-03 19:02 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-03 19:02 . 2012-03-01 05:37 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-07-03 19:02 . 2012-03-01 05:33 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-03 19:02 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-03 18:56 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-07-03 18:53 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-07-03 18:53 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-07-03 18:53 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-07-03 18:47 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-03 18:47 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-03 18:47 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-03 18:47 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-03 18:45 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-03 18:45 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-07-03 18:45 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-07-03 18:43 . 2012-07-03 18:47 -------- d-----w- c:\programdata\MFAData
2012-07-03 18:41 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-07-03 18:41 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-07-03 18:39 . 2012-07-03 18:39 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-07-03 18:39 . 2012-07-03 18:39 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-07-03 18:39 . 2012-07-03 18:39 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-07-03 18:39 . 2012-07-03 18:39 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-07-03 18:39 . 2012-07-03 18:39 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 04:40 . 2012-07-24 17:28 225280 ----a-w- c:\windows\system32\schannel.dll
2012-07-03 18:39 . 2011-04-03 12:03 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-25 17:45 2074208 ----a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-25 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2012-03-04 2077536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-25 1107552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.207\McCHSvc.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [x]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [x]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [x]
S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 17:19]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\rqthheys.default\
FF - prefs.js: browser.search.selectedEngine - WebHledani
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B633d5291-090f-4905-9879-441ccd3e1c5b%7D&mid=5900238d3c9297ca656272277446d9fa-317274e15a20d3d742a46375e57fa0fa9a365cdd&ds=AVG&v=10.2.0.3&lang=cz&pr=fr&d=2012-03-04%2012%3A04%3A42&sap=ku&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-07-25 20:20:56
ComboFix-quarantined-files.txt 2012-07-25 18:20
.
Před spuštěním: Volných bajtů: 17 786 839 040
Po spuštění: Volných bajtů: 17 794 011 136
.
- - End Of File - - 38D01DE63F59AFE9593C5405FCC3DE2A

Otevřte poznámkový blok a zkopírujte do něj:

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Tak jsem to udělal a bylo asi něco špatně. Přetáhl jsem text na ComboFix ten se spustil. Vyskočila tabulka na vypnutí AVG (před tím jsem to neudělal moje chyba) vypnul jsem rezidentní štít dal ok a CF se spustil. Po ukončení CF jsem chtěl zapnout AVG a skočila tabulka že nelze zapnout protože soubory jsou označené k smazání. Nic se nedělo tak jsem dal restartovat. Vyskočila tabulka obnovit z režimu spánku dal jsem ano skočila tabulka přihlásit dal jsem přihlásit vyskočila tabulka nelze se přihlásit. Zkusil jsem notbuk vypnout a znovu zapnout běžel, ale na obrazovce nic. Na několikátý pokus naskočila tabulka, že nějaká chyba a Windows se nespustí, ale pokusí se systém opravit a vrátit do stavu kdy fungoval což se podařilo. Bylo to do stavu před jakoukoli manipulací s CF. Nevíš co by mohlo být špatně.

Přesně netuším. Nejspíše se "popral" s AVG. Antivir je opravdu nutné vypnout.