VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

vir Policie ČR

https://forum.viry.cz:443/viewtopic.php?t=135233

Stránka 1 z 2

vir Policie ČR

Napsal: 05 led 2014 12:46
od skorojoerg
Zdravím, potřebuji radu, případně kontrolu, zda je pryč. Včera se přítelkyni podařilo stáhnout ze stránek filmyonline tento vir. Zavolala kamaráda ajťáka a ten si s tím pravděpodobně poradil, ale přesto pak sken antivirem hlásil trojana. Tak píši sem, kdyby se někdo mrknul, jestli to je v pořádku. Díky předem

Re: vir Policie ČR

Napsal: 05 led 2014 12:47
od Rudy
Zdravím!
Dejte log RSIT: http://forum.viry.cz/viewtopic.php?f=24&t=130784 .

Re: vir Policie ČR

Napsal: 05 led 2014 13:04
od skorojoerg
Logfile of random's system information tool 1.09 (written by random/random)
Run by Karolína at 2014-01-05 12:57:26
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 89 GB (60%) free of 150 GB
Total RAM: 4026 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:57:29, on 5.1.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe
C:\Users\Karolína\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe
C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Karolína.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [WebCake Desktop] C:\Users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe
O4 - HKCU\..\Run: [SDP] C:\Users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe /auto
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AllShare Framework DMS - Samsung - C:\Program Files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\SysWOW64\nlssrv32.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung Link Service - Copyright 2013 SAMSUNG - C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Aktivátor Správce výběru OS Acronis (Správce výběru OS) - Unknown owner - C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WebCakeUpdater - cake bake - C:\Program Files (x86)\Web Cake\WDesktop.Updater.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9168 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe"
"C:\Program Files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkDMS.exe"
\??\C:\Windows\system32\conhost.exe "923812217-967876271785769036-3625734851356440481-670412059-1982593960516838601
"C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe"
"C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe"
C:\Windows\SysWOW64\nlssrv32.exe
"C:\Program Files\Samsung\Samsung Link\Samsung Link.exe"
"C:\Program Files\Samsung\Samsung Link\Samsung Link.exe" "Samsung Link Service" __i4j_restart
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Web Cake\WDesktop.Updater.exe"
"C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe"
"C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe"
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskhost.exe USER
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
"C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe"
"C:\Users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe"
szndesktop.exe default start
"C:\Users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe" /auto
"C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="5048.0.870977948\637501713" --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,3,12,22 --disable-accelerated-video-decode --gpu-vendor-id=0x8086 --gpu-device-id=0x2a42 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=8.15.10.2202 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserPreReadExperiment/100-pct-default/CookieRetentionPriorityStudy/ExperimentOn/DeferBackgroundExtensionCreation/RateLimited/ForceCompositingMode/thread/InstantExtended/Group4 pct:10c stable:r7 use_cacheable_ntp:1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_10/UMA-Uniformity-Trial-1-Percent/group_21/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_18/UMA-Uniformity-Trial-50-Percent/group_01/" --enable-threaded-compositing --renderer-print-preview --disable-html-notifications --disable-accelerated-2d-canvas --disable-accelerated-video-decode --channel="5048.1.1133029628\1550915194" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserPreReadExperiment/100-pct-default/CookieRetentionPriorityStudy/ExperimentOn/DeferBackgroundExtensionCreation/RateLimited/ForceCompositingMode/thread/InstantExtended/Group4 pct:10c stable:r7 use_cacheable_ntp:1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/OmniboxBundledExperimentV1/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_10/UMA-Uniformity-Trial-1-Percent/group_21/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_18/UMA-Uniformity-Trial-50-Percent/group_01/" --enable-threaded-compositing --renderer-print-preview --disable-html-notifications --disable-accelerated-2d-canvas --disable-accelerated-video-decode --channel="5048.4.56323492\117509977" /prefetch:673131151
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Users\Karolína\Desktop\RSITx64.exe"
"C:\Program Files\Microsoft Security Client\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 59E3F875-F641-7EEA-6CB5-96C08F5D9729 -Reinvoke
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Karolína\AppData\Roaming\Mozilla\Firefox\Profiles\hu588l26.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\samsung.com/SamsungLinkPCPlugin]
"Description"=
"Path"=C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


C:\Program Files (x86)\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
NPOFF12.DLL
nppdf32.dll
QuickTimePlugin.class

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-08-25 161304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 386584]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-08-25 415256]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-10-23 1266912]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"LogMeIn GUI"=C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [2011-09-16 57928]
"Samsung Link"=C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [2013-11-05 597576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"cz.seznam.software.autoupdate"=C:\Users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe [2012-09-13 1009288]
"cz.seznam.software.szndesktop"=C:\Users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2013-01-22 92152]
"WebCake Desktop"=C:\Users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe [2013-08-11 52504]
"SDP"=C:\Users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe [2013-01-31 201808]
"Zoner Photo Studio Autoupdate"=C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE [2012-10-18 752736]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2012-09-13 1009288]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"AdobeCS5.5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-08-25 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-01-05 12:57:26 ----D---- C:\rsit
2014-01-05 12:57:26 ----D---- C:\Program Files\trend micro
2014-01-04 22:25:46 ----D---- C:\Program Files (x86)\ESET
2014-01-04 22:24:54 ----SHD---- C:\$RECYCLE.BIN
2014-01-04 22:24:48 ----A---- C:\ComboFix.txt
2014-01-04 22:06:54 ----A---- C:\Windows\zip.exe
2014-01-04 22:06:54 ----A---- C:\Windows\SWSC.exe
2014-01-04 22:06:54 ----A---- C:\Windows\SWREG.exe
2014-01-04 22:06:54 ----A---- C:\Windows\sed.exe
2014-01-04 22:06:54 ----A---- C:\Windows\PEV.exe
2014-01-04 22:06:54 ----A---- C:\Windows\NIRCMD.exe
2014-01-04 22:06:54 ----A---- C:\Windows\MBR.exe
2014-01-04 22:06:54 ----A---- C:\Windows\grep.exe
2014-01-04 22:06:18 ----D---- C:\Qoobox
2014-01-04 22:05:56 ----D---- C:\Windows\erdnt
2013-12-20 16:47:15 ----D---- C:\ProgramData\Western Digital
2013-12-16 11:08:26 ----D---- C:\Program Files (x86)\GUM8777.tmp
2013-12-14 19:06:40 ----D---- C:\Upload
2013-12-14 19:06:11 ----D---- C:\ProgramData\SAMSUNG
2013-12-14 19:05:30 ----D---- C:\Program Files\Samsung
2013-12-11 23:36:18 ----A---- C:\Windows\system32\wmploc.DLL
2013-12-11 23:36:17 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2013-12-11 23:36:17 ----A---- C:\Windows\SYSWOW64\wmp.dll
2013-12-11 23:36:15 ----A---- C:\Windows\system32\wmp.dll
2013-12-11 23:34:18 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 23:34:17 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-12-11 23:34:17 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-12-11 23:34:17 ----A---- C:\Windows\system32\jsproxy.dll
2013-12-11 23:34:17 ----A---- C:\Windows\system32\ieui.dll
2013-12-11 23:34:16 ----A---- C:\Windows\system32\ieUnatt.exe
2013-12-11 23:34:16 ----A---- C:\Windows\system32\iesetup.dll
2013-12-11 23:34:16 ----A---- C:\Windows\system32\iernonce.dll
2013-12-11 23:34:16 ----A---- C:\Windows\system32\ieetwproxystub.dll
2013-12-11 23:34:16 ----A---- C:\Windows\system32\ieetwcollector.exe
2013-12-11 23:34:16 ----A---- C:\Windows\system32\ie4uinit.exe
2013-12-11 23:34:15 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2013-12-11 23:34:15 ----A---- C:\Windows\system32\mshtml.dll
2013-12-11 23:34:15 ----A---- C:\Windows\system32\jscript9diag.dll
2013-12-11 23:34:14 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2013-12-11 23:34:14 ----A---- C:\Windows\system32\iertutil.dll
2013-12-11 23:34:14 ----A---- C:\Windows\system32\ieapfltr.dll
2013-12-11 23:34:13 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-12-11 23:34:13 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-12-11 23:34:13 ----A---- C:\Windows\system32\wininet.dll
2013-12-11 23:34:12 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-12-11 23:34:12 ----A---- C:\Windows\system32\urlmon.dll
2013-12-11 23:34:11 ----A---- C:\Windows\system32\ieframe.dll
2013-12-11 23:34:10 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-12-11 23:34:09 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-12-11 23:34:09 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-12-11 23:34:08 ----A---- C:\Windows\system32\jscript9.dll
2013-12-11 15:23:53 ----A---- C:\Windows\system32\msieftp.dll
2013-12-11 15:23:52 ----A---- C:\Windows\SYSWOW64\msieftp.dll
2013-12-11 15:23:51 ----A---- C:\Windows\system32\win32k.sys
2013-12-11 15:23:50 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-12-11 15:23:50 ----A---- C:\Windows\system32\WMPhoto.dll
2013-12-11 15:23:49 ----A---- C:\Windows\SYSWOW64\imagehlp.dll
2013-12-11 15:23:49 ----A---- C:\Windows\system32\imagehlp.dll
2013-12-11 15:23:45 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-12-11 15:23:45 ----A---- C:\Windows\system32\tzres.dll
2013-12-11 15:23:38 ----A---- C:\Windows\system32\drivers\portcls.sys
2013-12-11 15:23:38 ----A---- C:\Windows\system32\drivers\drmk.sys
2013-12-11 15:23:25 ----A---- C:\Windows\SYSWOW64\wscript.exe
2013-12-11 15:23:25 ----A---- C:\Windows\SYSWOW64\scrrun.dll
2013-12-11 15:23:25 ----A---- C:\Windows\SYSWOW64\cscript.exe
2013-12-11 15:23:25 ----A---- C:\Windows\system32\wscript.exe
2013-12-11 15:23:25 ----A---- C:\Windows\system32\scrrun.dll
2013-12-11 15:23:25 ----A---- C:\Windows\system32\cscript.exe
2013-12-07 23:09:24 ----D---- C:\ProgramData\Acronis
2013-12-07 23:09:03 ----A---- C:\Windows\system32\drivers\snapman.sys
2013-12-07 23:09:01 ----A---- C:\Windows\system32\drivers\fltsrv.sys
2013-12-07 23:08:48 ----D---- C:\Program Files (x86)\Acronis

======List of files/folders modified in the last 1 month======

2014-01-05 12:57:29 ----D---- C:\Windows\Prefetch
2014-01-05 12:57:26 ----RD---- C:\Program Files
2014-01-05 12:57:23 ----D---- C:\Windows\Temp
2014-01-05 12:46:24 ----D---- C:\Windows\system32\config
2014-01-05 12:16:49 ----SHD---- C:\System Volume Information
2014-01-05 12:14:14 ----D---- C:\Users\Karolína\AppData\Roaming\Seznam.cz
2014-01-05 12:09:23 ----D---- C:\Users\Karolína\AppData\Roaming\Movdap
2014-01-05 01:31:41 ----D---- C:\ProgramData\LogMeIn
2014-01-04 23:55:23 ----D---- C:\Program Files (x86)\Web Cake
2014-01-04 23:55:21 ----D---- C:\Program Files (x86)\Portrait Professional Studio 10
2014-01-04 22:31:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-01-04 22:25:46 ----RD---- C:\Program Files (x86)
2014-01-04 22:20:47 ----AD---- C:\Windows
2014-01-04 22:20:47 ----A---- C:\Windows\system.ini
2014-01-04 22:20:41 ----D---- C:\Windows\system32\drivers\etc
2014-01-04 22:19:37 ----D---- C:\Windows\SysWOW64
2014-01-04 22:13:34 ----D---- C:\Windows\SYSWOW64\drivers
2014-01-04 22:13:34 ----D---- C:\Windows\AppPatch
2014-01-04 22:13:32 ----D---- C:\Program Files (x86)\Common Files
2014-01-04 22:06:20 ----D---- C:\Windows\system32\drivers
2014-01-04 22:02:31 ----D---- C:\Windows\Tasks
2014-01-04 22:02:31 ----D---- C:\Windows\system32\wfp
2014-01-04 22:02:29 ----D---- C:\Windows\system32\wbem
2014-01-04 22:01:53 ----D---- C:\Windows\system32\DriverStore
2014-01-04 22:01:53 ----D---- C:\Windows\system32\catroot2
2014-01-04 22:01:53 ----D---- C:\Windows\System32
2014-01-04 22:01:51 ----D---- C:\Windows\system32\drivers\UMDF
2014-01-04 22:01:51 ----D---- C:\Windows\system32\CodeIntegrity
2014-01-04 22:01:51 ----D---- C:\Windows\inf
2014-01-04 22:01:51 ----D---- C:\Windows\AppCompat
2014-01-04 22:01:51 ----D---- C:\Users\Karolína\AppData\Roaming\GHISLER
2014-01-04 22:01:49 ----D---- C:\Windows\registration
2014-01-04 22:01:39 ----D---- C:\Users\Karolína\AppData\Roaming\Skype
2013-12-26 18:52:39 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-12-20 16:47:15 ----D---- C:\ProgramData
2013-12-20 15:30:44 ----D---- C:\Windows\LiveKernelReports
2013-12-17 00:34:55 ----D---- C:\Windows\system32\MRT
2013-12-17 00:32:49 ----D---- C:\Windows\debug
2013-12-17 00:32:46 ----A---- C:\Windows\system32\MRT.exe
2013-12-16 10:19:12 ----D---- C:\Program Files (x86)\LogMeIn
2013-12-16 10:17:58 ----A---- C:\Windows\system32\LMIRfsClientNP.dll
2013-12-16 10:17:55 ----A---- C:\Windows\system32\LMIport.dll
2013-12-16 10:17:54 ----A---- C:\Windows\system32\LMIinit.dll
2013-12-14 19:06:39 ----SHD---- C:\Windows\Installer
2013-12-14 12:28:28 ----D---- C:\Windows\rescache
2013-12-12 07:09:16 ----D---- C:\Windows\winsxs
2013-12-12 07:06:58 ----D---- C:\Program Files\Windows Media Player
2013-12-12 07:06:58 ----D---- C:\Program Files (x86)\Windows Media Player
2013-12-12 07:06:57 ----D---- C:\Program Files\Internet Explorer
2013-12-12 07:06:57 ----D---- C:\Program Files (x86)\Internet Explorer
2013-12-12 07:06:56 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-12-12 07:06:56 ----D---- C:\Windows\system32\cs-CZ
2013-12-11 23:36:30 ----D---- C:\Windows\system32\catroot
2013-12-11 23:35:55 ----D---- C:\ProgramData\Microsoft Help
2013-12-11 16:31:34 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fltsrv;Acronis Storage Filter Management; C:\Windows\system32\DRIVERS\fltsrv.sys [2013-12-07 132704]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-09-27 248240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2013-12-07 310368]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [2013-06-01 16056]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2011-09-16 72216]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 134944]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2009-10-05 1542656]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-08-25 10611552]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2011-09-16 11552]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-09-05 65640]
R2 AllShare Framework DMS;AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe [2013-10-11 404360]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2013-12-16 376144]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [2013-12-16 226640]
R2 LogMeIn;LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [2011-09-16 407424]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-10-23 23808]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\Windows\SysWOW64\nlssrv32.exe [2012-11-09 71280]
R2 Samsung Link Service;Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [2013-11-05 605768]
R2 Správce výběru OS;Aktivátor Správce výběru OS Acronis; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2011-12-12 2156952]
R2 WebCakeUpdater;WebCakeUpdater; C:\Program Files (x86)\Web Cake\WDesktop.Updater.exe [2013-07-31 51992]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-07 161384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11 257416]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2013-05-22 655624]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 116648]
S3 gusvc;Google Updater Service; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-05-09 136120]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2013-11-26 111616]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-11-13 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-02-20 1255736]

-----------------EOF-----------------

Re: vir Policie ČR

Napsal: 05 led 2014 13:32
od Rudy
Ještě poprosím o log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

Re: vir Policie ČR

Napsal: 05 led 2014 14:33
od skorojoerg
ComboFix 14-01-04.03 - Karolína 05.01.2014 14:22:02.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4026.2256 [GMT 1:00]
Spuštěný z: c:\users\KarolÝna\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\TEMP\sqlite-3.7.2-sqlitejdbc.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-05 do 2014-01-05 )))))))))))))))))))))))))))))))
.
.
2014-01-05 13:29 . 2014-01-05 13:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- C:\rsit
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- c:\program files\trend micro
2014-01-05 11:57 . 2014-01-05 11:57 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{849FE3D1-35C4-434C-8F5D-375718E9337B}\offreg.dll
2014-01-05 11:17 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{849FE3D1-35C4-434C-8F5D-375718E9337B}\mpengine.dll
2014-01-04 21:25 . 2014-01-04 21:25 -------- d-----w- c:\program files (x86)\ESET
2014-01-04 21:02 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-20 15:47 . 2013-12-20 15:47 -------- d-----w- c:\programdata\Western Digital
2013-12-16 10:08 . 2013-12-16 10:08 -------- d-----w- c:\program files (x86)\GUM8777.tmp
2013-12-14 18:07 . 2013-12-14 18:19 -------- d-----w- c:\users\Karolína\Samsung Link
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- C:\Upload
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\AppData\Local\SAMSUNG
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\.swt
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\programdata\SAMSUNG
2013-12-14 18:05 . 2013-12-14 18:06 -------- d-----w- c:\program files\Samsung
2013-12-11 22:36 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-11 14:23 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-12-07 22:09 . 2013-12-07 22:09 310368 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-12-07 22:09 . 2013-12-07 22:09 132704 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Acronis
2013-12-06 20:44 . 2013-10-19 08:16 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7030BCC6-68C9-4B49-B7E6-CD401551756C}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-16 23:32 . 2013-02-21 08:00 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-16 09:17 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-12-16 09:17 . 2013-02-23 15:10 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-12-16 09:17 . 2013-02-23 15:10 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-12-11 15:31 . 2013-02-19 20:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 15:31 . 2013-02-19 20:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-20 21:12 . 2013-11-20 21:12 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-20 21:12 . 2013-11-20 21:12 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-20 21:12 . 2013-11-20 21:12 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-20 21:12 . 2013-11-20 21:12 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-20 21:12 . 2013-11-20 21:12 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-20 21:12 . 2013-11-20 21:12 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-20 21:12 . 2013-11-20 21:12 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-20 21:12 . 2013-11-20 21:12 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-20 21:12 . 2013-11-20 21:12 413696 ----a-w- c:\windows\system32\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-20 21:12 . 2013-11-20 21:12 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-20 21:12 . 2013-11-20 21:12 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-20 21:12 . 2013-11-20 21:12 235520 ----a-w- c:\windows\system32\url.dll
2013-11-20 21:12 . 2013-11-20 21:12 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-20 21:12 . 2013-11-20 21:12 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-20 21:12 . 2013-11-20 21:12 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-20 21:12 . 2013-11-20 21:12 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 10:21 . 2013-02-19 20:36 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-01 11:22 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-10-19 08:16 . 2013-03-12 10:37 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-14 17:00 . 2013-11-20 21:17 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-13 08:59 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 08:59 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 08:59 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 08:59 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 08:59 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-28 16:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cz.seznam.software.autoupdate"="c:\users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe" [2012-09-13 1009288]
"cz.seznam.software.szndesktop"="c:\users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-01-22 92152]
"WebCake Desktop"="c:\users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe" [2013-08-11 52504]
"SDP"="c:\users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe" [2013-01-31 201808]
"Zoner Photo Studio Autoupdate"="c:\program files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE" [2012-10-18 752736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2012-09-13 1009288]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S2 AllShare Framework DMS;AllShare Framework DMS;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 Samsung Link Service;Samsung Link Service;c:\program files\Samsung\Samsung Link\Samsung Link.exe;c:\program files\Samsung\Samsung Link\Samsung Link.exe [x]
S2 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Web Cake\WDesktop.Updater.exe;c:\program files (x86)\Web Cake\WDesktop.Updater.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-06 12:02 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-19 15:31]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-09-16 57928]
"Samsung Link"="c:\program files\Samsung\Samsung Link\Samsung Link Tray Agent.exe" [2013-11-05 597576]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Karolína\AppData\Roaming\Mozilla\Firefox\Profiles\hu588l26.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - user.js: extentions.webcake.installId - 3726f695-6a64-461f-9749-3c0e01fef849
FF - user.js: extentions.webcake.defaultEnableAppsList - layers,brain/features,newOffers/wc
.
Binary file temp00 matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-05 14:32:10
ComboFix-quarantined-files.txt 2014-01-05 13:32
ComboFix2.txt 2014-01-04 21:24
.
Před spuštěním: Volných bajtů: 93 587 722 240
Po spuštění: Volných bajtů: 93 149 892 608
.
- - End Of File - - 8106E971134AEA4795E4E090B3AF5A62
A36C5E4F47E84449FF07ED3517B43A31

Re: vir Policie ČR

Napsal: 05 led 2014 16:17
od Rudy
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

File::
c:\program files (x86)\GUM8777.tmp
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: vir Policie ČR

Napsal: 05 led 2014 17:36
od skorojoerg
hotovo! Mám poslat log z combofix, co vytvořil?

Re: vir Policie ČR

Napsal: 05 led 2014 18:29
od Rudy
Určitě. :)

Re: vir Policie ČR

Napsal: 05 led 2014 18:30
od skorojoerg
ComboFix 14-01-04.03 - Karolína 05.01.2014 17:10:05.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4026.2390 [GMT 1:00]
Spuštěný z: c:\users\KarolÝna\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\KarolÝna\Desktop\CFScript.txt.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-05 do 2014-01-05 )))))))))))))))))))))))))))))))
.
.
2014-01-05 16:16 . 2014-01-05 16:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-05 13:50 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E4591D3-45E6-4DD7-81EC-46AA3190EACA}\mpengine.dll
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- C:\rsit
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- c:\program files\trend micro
2014-01-04 21:25 . 2014-01-04 21:25 -------- d-----w- c:\program files (x86)\ESET
2014-01-04 21:02 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-20 15:47 . 2013-12-20 15:47 -------- d-----w- c:\programdata\Western Digital
2013-12-16 10:08 . 2013-12-16 10:08 -------- d-----w- c:\program files (x86)\GUM8777.tmp
2013-12-14 18:07 . 2013-12-14 18:19 -------- d-----w- c:\users\Karolína\Samsung Link
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- C:\Upload
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\AppData\Local\SAMSUNG
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\.swt
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\programdata\SAMSUNG
2013-12-14 18:05 . 2013-12-14 18:06 -------- d-----w- c:\program files\Samsung
2013-12-11 22:36 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-11 14:23 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-12-07 22:09 . 2013-12-07 22:09 310368 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-12-07 22:09 . 2013-12-07 22:09 132704 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Acronis
2013-12-06 20:44 . 2013-10-19 08:16 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7030BCC6-68C9-4B49-B7E6-CD401551756C}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-16 23:32 . 2013-02-21 08:00 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-16 09:17 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-12-16 09:17 . 2013-02-23 15:10 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-12-16 09:17 . 2013-02-23 15:10 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-12-11 15:31 . 2013-02-19 20:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 15:31 . 2013-02-19 20:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-20 21:12 . 2013-11-20 21:12 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-20 21:12 . 2013-11-20 21:12 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-20 21:12 . 2013-11-20 21:12 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-20 21:12 . 2013-11-20 21:12 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-20 21:12 . 2013-11-20 21:12 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-20 21:12 . 2013-11-20 21:12 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-20 21:12 . 2013-11-20 21:12 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-20 21:12 . 2013-11-20 21:12 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-20 21:12 . 2013-11-20 21:12 413696 ----a-w- c:\windows\system32\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-20 21:12 . 2013-11-20 21:12 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-20 21:12 . 2013-11-20 21:12 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-20 21:12 . 2013-11-20 21:12 235520 ----a-w- c:\windows\system32\url.dll
2013-11-20 21:12 . 2013-11-20 21:12 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-20 21:12 . 2013-11-20 21:12 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-20 21:12 . 2013-11-20 21:12 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-20 21:12 . 2013-11-20 21:12 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 10:21 . 2013-02-19 20:36 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-01 11:22 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-10-19 08:16 . 2013-03-12 10:37 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-14 17:00 . 2013-11-20 21:17 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-13 08:59 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 08:59 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 08:59 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 08:59 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 08:59 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-28 16:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cz.seznam.software.autoupdate"="c:\users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe" [2012-09-13 1009288]
"cz.seznam.software.szndesktop"="c:\users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-01-22 92152]
"WebCake Desktop"="c:\users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe" [2013-08-11 52504]
"SDP"="c:\users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe" [2013-01-31 201808]
"Zoner Photo Studio Autoupdate"="c:\program files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE" [2012-10-18 752736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2012-09-13 1009288]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S2 AllShare Framework DMS;AllShare Framework DMS;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 Samsung Link Service;Samsung Link Service;c:\program files\Samsung\Samsung Link\Samsung Link.exe;c:\program files\Samsung\Samsung Link\Samsung Link.exe [x]
S2 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Web Cake\WDesktop.Updater.exe;c:\program files (x86)\Web Cake\WDesktop.Updater.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-06 12:02 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-19 15:31]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-09-16 57928]
"Samsung Link"="c:\program files\Samsung\Samsung Link\Samsung Link Tray Agent.exe" [2013-11-05 597576]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Karolína\AppData\Roaming\Mozilla\Firefox\Profiles\hu588l26.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - user.js: extentions.webcake.installId - 3726f695-6a64-461f-9749-3c0e01fef849
FF - user.js: extentions.webcake.defaultEnableAppsList - layers,brain/features,newOffers/wc
.
Binary file temp00 matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-05 17:18:31
ComboFix-quarantined-files.txt 2014-01-05 16:18
ComboFix2.txt 2014-01-05 13:32
ComboFix3.txt 2014-01-04 21:24
.
Před spuštěním: Volných bajtů: 93 215 928 320
Po spuštění: Volných bajtů: 93 114 273 792
.
- - End Of File - - A52F8FFF6789047701B51A0D958FC904
A36C5E4F47E84449FF07ED3517B43A31

Re: vir Policie ČR

Napsal: 05 led 2014 18:38
od Rudy
CF nemazal, skript byl chybně uložen (CFScript.txt.txt). Musí být uložen jako CFScript.txt . Zkuste znovu.

Re: vir Policie ČR

Napsal: 05 led 2014 19:17
od skorojoerg
zkusil jsem to znovu, ale nevím, nevím, tyhle win 7 to prostě nějak sabotují, jsem zvyklý na svý starý dobrý XP ;-) a tam to vždycky dopadlo.
log:
ComboFix 14-01-04.03 - Karolína 05.01.2014 19:01:27.5.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4026.1803 [GMT 1:00]
Spuštěný z: c:\users\KarolÝna\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\KarolÝna\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-05 do 2014-01-05 )))))))))))))))))))))))))))))))
.
.
2014-01-05 18:07 . 2014-01-05 18:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-05 13:50 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E4591D3-45E6-4DD7-81EC-46AA3190EACA}\mpengine.dll
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- C:\rsit
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- c:\program files\trend micro
2014-01-04 21:25 . 2014-01-04 21:25 -------- d-----w- c:\program files (x86)\ESET
2014-01-04 21:02 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-20 15:47 . 2013-12-20 15:47 -------- d-----w- c:\programdata\Western Digital
2013-12-16 10:08 . 2013-12-16 10:08 -------- d-----w- c:\program files (x86)\GUM8777.tmp
2013-12-14 18:07 . 2013-12-14 18:19 -------- d-----w- c:\users\Karolína\Samsung Link
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- C:\Upload
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\AppData\Local\SAMSUNG
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\.swt
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\programdata\SAMSUNG
2013-12-14 18:05 . 2013-12-14 18:06 -------- d-----w- c:\program files\Samsung
2013-12-11 22:36 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-11 14:23 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-12-07 22:09 . 2013-12-07 22:09 310368 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-12-07 22:09 . 2013-12-07 22:09 132704 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Acronis
2013-12-06 20:44 . 2013-10-19 08:16 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7030BCC6-68C9-4B49-B7E6-CD401551756C}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-16 23:32 . 2013-02-21 08:00 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-16 09:17 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-12-16 09:17 . 2013-02-23 15:10 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-12-16 09:17 . 2013-02-23 15:10 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-12-11 15:31 . 2013-02-19 20:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 15:31 . 2013-02-19 20:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-20 21:12 . 2013-11-20 21:12 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-20 21:12 . 2013-11-20 21:12 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-20 21:12 . 2013-11-20 21:12 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-20 21:12 . 2013-11-20 21:12 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-20 21:12 . 2013-11-20 21:12 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-20 21:12 . 2013-11-20 21:12 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-20 21:12 . 2013-11-20 21:12 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-20 21:12 . 2013-11-20 21:12 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-20 21:12 . 2013-11-20 21:12 413696 ----a-w- c:\windows\system32\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-20 21:12 . 2013-11-20 21:12 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-20 21:12 . 2013-11-20 21:12 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-20 21:12 . 2013-11-20 21:12 235520 ----a-w- c:\windows\system32\url.dll
2013-11-20 21:12 . 2013-11-20 21:12 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-20 21:12 . 2013-11-20 21:12 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-20 21:12 . 2013-11-20 21:12 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-20 21:12 . 2013-11-20 21:12 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 10:21 . 2013-02-19 20:36 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-01 11:22 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-10-19 08:16 . 2013-03-12 10:37 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-14 17:00 . 2013-11-20 21:17 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-13 08:59 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 08:59 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 08:59 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 08:59 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 08:59 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-28 16:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cz.seznam.software.autoupdate"="c:\users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe" [2012-09-13 1009288]
"cz.seznam.software.szndesktop"="c:\users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-01-22 92152]
"WebCake Desktop"="c:\users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe" [2013-08-11 52504]
"SDP"="c:\users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe" [2013-01-31 201808]
"Zoner Photo Studio Autoupdate"="c:\program files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE" [2012-10-18 752736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2012-09-13 1009288]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S2 AllShare Framework DMS;AllShare Framework DMS;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 Samsung Link Service;Samsung Link Service;c:\program files\Samsung\Samsung Link\Samsung Link.exe;c:\program files\Samsung\Samsung Link\Samsung Link.exe [x]
S2 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Web Cake\WDesktop.Updater.exe;c:\program files (x86)\Web Cake\WDesktop.Updater.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-06 12:02 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-19 15:31]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-09-16 57928]
"Samsung Link"="c:\program files\Samsung\Samsung Link\Samsung Link Tray Agent.exe" [2013-11-05 597576]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Karolína\AppData\Roaming\Mozilla\Firefox\Profiles\hu588l26.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - user.js: extentions.webcake.installId - 3726f695-6a64-461f-9749-3c0e01fef849
FF - user.js: extentions.webcake.defaultEnableAppsList - layers,brain/features,newOffers/wc
.
Binary file temp00 matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-05 19:10:19
ComboFix-quarantined-files.txt 2014-01-05 18:10
ComboFix2.txt 2014-01-05 17:56
ComboFix3.txt 2014-01-05 16:18
ComboFix4.txt 2014-01-05 13:32
ComboFix5.txt 2014-01-05 17:59
.
Před spuštěním: Volných bajtů: 93 170 122 752
Po spuštění: Volných bajtů: 93 109 256 192
.
- - End Of File - - 8B00F81B7844126E95C7698B43B6E60A
A36C5E4F47E84449FF07ED3517B43A31

Re: vir Policie ČR

Napsal: 05 led 2014 19:39
od Rudy
Nesabotují. Já jsem přehlédl, že název adresáře, z něhož je CF spouštěn, obsahuje diakritiku. CF není schopen pak skript načíst. Přesuňte jak CF, tak skript na kořenový adresář c:\ a přetažení proveďte tam (v průzkumníku windows, nebo jiném souborovém manažeru). Omlouvám se.

Re: vir Policie ČR

Napsal: 05 led 2014 20:37
od skorojoerg
Aha, tak to jsem vůbec netušil. Teď se to tedy už zdařilo, posílám log
ComboFix 14-01-04.03 - Karolína 05.01.2014 20:22:13.6.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4026.1998 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\GUM8777.tmp"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-05 do 2014-01-05 )))))))))))))))))))))))))))))))
.
.
2014-01-05 19:28 . 2014-01-05 19:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-05 13:50 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E4591D3-45E6-4DD7-81EC-46AA3190EACA}\mpengine.dll
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- C:\rsit
2014-01-05 11:57 . 2014-01-05 11:57 -------- d-----w- c:\program files\trend micro
2014-01-04 21:25 . 2014-01-04 21:25 -------- d-----w- c:\program files (x86)\ESET
2014-01-04 21:02 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-20 15:47 . 2013-12-20 15:47 -------- d-----w- c:\programdata\Western Digital
2013-12-16 10:08 . 2013-12-16 10:08 -------- d-----w- c:\program files (x86)\GUM8777.tmp
2013-12-14 18:07 . 2013-12-14 18:19 -------- d-----w- c:\users\Karolína\Samsung Link
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- C:\Upload
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\AppData\Local\SAMSUNG
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\users\Karolína\.swt
2013-12-14 18:06 . 2013-12-14 18:06 -------- d-----w- c:\programdata\SAMSUNG
2013-12-14 18:05 . 2013-12-14 18:06 -------- d-----w- c:\program files\Samsung
2013-12-11 22:36 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 22:36 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-11 22:36 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-11 14:23 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-12-07 22:09 . 2013-12-07 22:09 310368 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-12-07 22:09 . 2013-12-07 22:09 132704 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2013-12-07 22:08 . 2013-12-07 22:08 -------- d-----w- c:\program files (x86)\Acronis
2013-12-06 20:44 . 2013-10-19 08:16 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7030BCC6-68C9-4B49-B7E6-CD401551756C}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-16 23:32 . 2013-02-21 08:00 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-16 09:17 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-12-16 09:17 . 2013-02-23 15:10 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-12-16 09:17 . 2013-02-23 15:10 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-12-11 15:31 . 2013-02-19 20:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 15:31 . 2013-02-19 20:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-20 21:12 . 2013-11-20 21:12 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-20 21:12 . 2013-11-20 21:12 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-20 21:12 . 2013-11-20 21:12 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-20 21:12 . 2013-11-20 21:12 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-20 21:12 . 2013-11-20 21:12 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-20 21:12 . 2013-11-20 21:12 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-20 21:12 . 2013-11-20 21:12 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-20 21:12 . 2013-11-20 21:12 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-20 21:12 . 2013-11-20 21:12 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-20 21:12 . 2013-11-20 21:12 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-20 21:12 . 2013-11-20 21:12 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-20 21:12 . 2013-11-20 21:12 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-20 21:12 . 2013-11-20 21:12 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-20 21:12 . 2013-11-20 21:12 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-20 21:12 . 2013-11-20 21:12 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-20 21:12 . 2013-11-20 21:12 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-20 21:12 . 2013-11-20 21:12 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-20 21:12 . 2013-11-20 21:12 413696 ----a-w- c:\windows\system32\html.iec
2013-11-20 21:12 . 2013-11-20 21:12 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 21:12 . 2013-11-20 21:12 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-20 21:12 . 2013-11-20 21:12 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-20 21:12 . 2013-11-20 21:12 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-20 21:12 . 2013-11-20 21:12 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-20 21:12 . 2013-11-20 21:12 235520 ----a-w- c:\windows\system32\url.dll
2013-11-20 21:12 . 2013-11-20 21:12 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-20 21:12 . 2013-11-20 21:12 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-20 21:12 . 2013-11-20 21:12 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-20 21:12 . 2013-11-20 21:12 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-20 21:12 . 2013-11-20 21:12 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-20 21:12 . 2013-11-20 21:12 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-20 21:12 . 2013-11-20 21:12 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-20 21:12 . 2013-11-20 21:12 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-20 21:12 . 2013-11-20 21:12 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-20 21:12 . 2013-11-20 21:12 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-20 21:12 . 2013-11-20 21:12 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-20 21:12 . 2013-11-20 21:12 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-20 21:12 . 2013-11-20 21:12 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 10:21 . 2013-02-19 20:36 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-01 11:22 . 2013-02-23 15:10 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-10-19 08:16 . 2013-03-12 10:37 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-14 17:00 . 2013-11-20 21:17 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-13 08:59 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 08:59 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 08:59 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 08:59 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 08:59 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-08 06:50 . 2013-10-28 16:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cz.seznam.software.autoupdate"="c:\users\Karolína\AppData\Roaming\Seznam.cz\szninstall.exe" [2012-09-13 1009288]
"cz.seznam.software.szndesktop"="c:\users\Karolína\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-01-22 92152]
"WebCake Desktop"="c:\users\Karolína\AppData\Roaming\Movdap\WebCakeDesktop.exe" [2013-08-11 52504]
"SDP"="c:\users\Karolína\AppData\Local\FilesFrog Update Checker\update_checker.exe" [2013-01-31 201808]
"Zoner Photo Studio Autoupdate"="c:\program files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE" [2012-10-18 752736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2012-09-13 1009288]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S2 AllShare Framework DMS;AllShare Framework DMS;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe;c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkManagerDMS.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 Samsung Link Service;Samsung Link Service;c:\program files\Samsung\Samsung Link\Samsung Link.exe;c:\program files\Samsung\Samsung Link\Samsung Link.exe [x]
S2 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Web Cake\WDesktop.Updater.exe;c:\program files (x86)\Web Cake\WDesktop.Updater.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-06 12:02 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-19 15:31]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
2014-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-19 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-09-16 57928]
"Samsung Link"="c:\program files\Samsung\Samsung Link\Samsung Link Tray Agent.exe" [2013-11-05 597576]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Karolína\AppData\Roaming\Mozilla\Firefox\Profiles\hu588l26.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - user.js: extentions.webcake.installId - 3726f695-6a64-461f-9749-3c0e01fef849
FF - user.js: extentions.webcake.defaultEnableAppsList - layers,brain/features,newOffers/wc
.
Binary file temp00 matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Samsung\AllShare Framework DMS\1.3.21\AllShareFrameworkDMS.exe
c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
.
**************************************************************************
.
Celkový čas: 2014-01-05 20:35:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-01-05 19:35
ComboFix2.txt 2014-01-05 18:10
ComboFix3.txt 2014-01-05 17:56
ComboFix4.txt 2014-01-05 16:18
ComboFix5.txt 2014-01-05 19:20
.
Před spuštěním: Volných bajtů: 93 215 703 040
Po spuštění: Volných bajtů: 93 164 609 536
.
- - End Of File - - 2615793D35F376FFADE22D2C5994D4CD
A36C5E4F47E84449FF07ED3517B43A31

Re: vir Policie ČR

Napsal: 05 led 2014 20:50
od Rudy
Jj. Teď je to v pořádku. Log je již OK.

Re: vir Policie ČR

Napsal: 05 led 2014 20:51
od skorojoerg
Moc díky a přeji hezký večer!
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz