VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Rozesílám spam - prosím pomoc

https://forum.viry.cz:443/viewtopic.php?t=136272

Stránka 1 z 2

Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 18:52
od eva.h
Dobrý den,
poskytovatel internetu mi oznámil, že z mé adresy bylo odesíláno velké množství mailů a proto mi pozastavil některé služby internetu, usuzuji na to, že to musí být z tohoto počítače (protože v době kdy se to mělo dít, tak jiné PC prokazatelně nebyly zapnuté, ani +- týden potom ani předtím), divím se tomu i proto, že tento počítač není využíván pro nějaké stahování a procházení divných stránek, je používán poměrně zřídka a poměrně bezpečně. Ale havěť je havěť.
Ještě bych dodala, že v počítači je obrovské množství "hodně pochybných HP programů nainstalovaných od výroby", které opravdu nepřispívají k ničemu dobrému.
Chtěla bych požádat o kontrolu logu. Vkládám tedy log z FRST a RSIT.

Děkuji za pomoc

Re: Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 18:54
od Rudy
Zdravím!
Spusťte nejprve tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 19:14
od eva.h
Zdravím, objevily se mi 2 logy:

AdwCleaner[R0].txt :

# AdwCleaner v3.019 - Report created 17/02/2014 at 19:07:07
# Updated 17/02/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Eva Horecká - EVAHORECKA-HP
# Running from : C:\Users\Eva Horecká\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****

Service Found : ICQ Service

***** [ Files / Folders ] *****

File Found : C:\END
Folder Found : C:\Users\Eva Horecká\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle
Folder Found C:\Program Files (x86)\ICQ6Toolbar
Folder Found C:\ProgramData\Ask
Folder Found C:\ProgramData\ICQ\ICQToolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\91c41535f03b9fc8c069f5d041d357ca
Key Found : HKCU\Software\APN DTX
Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\ICQ\ICQToolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : [x64] HKCU\Software\APN DTX
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\ICQ\ICQToolbar
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}
Key Found : HKLM\Software\caphyon
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Key Found : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Key Found : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\Software\FLEXnet
Key Found : HKLM\Software\ICQ\ICQToolbar
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Key Found : HKLM\Software\PIP
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ask.com/web?l=dis&o=APN10147&gct=hp ... YYYY^YY^US

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Eva Horecká\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage

*************************

AdwCleaner[R0].txt - [3580 octets] - [17/02/2014 19:07:07]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3640 octets] ##########



























AdwCleaner[S0].txt :

# AdwCleaner v3.019 - Report created 17/02/2014 at 19:08:10
# Updated 17/02/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Eva Horecká - EVAHORECKA-HP
# Running from : C:\Users\Eva Horecká\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : ICQ Service

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\ICQ\ICQToolbar
Folder Deleted : C:\Program Files (x86)\ICQ6Toolbar
Folder Deleted : C:\Users\Eva Horecká\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle
File Deleted : C:\END

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKCU\Software\91c41535f03b9fc8c069f5d041d357ca
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKCU\Software\APN DTX
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ICQ\ICQToolbar
Key Deleted : HKLM\Software\caphyon
Key Deleted : HKLM\Software\FLEXnet
Key Deleted : HKLM\Software\ICQ\ICQToolbar
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Eva Horecká\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

*************************

AdwCleaner[R0].txt - [3744 octets] - [17/02/2014 19:07:07]
AdwCleaner[S0].txt - [3327 octets] - [17/02/2014 19:08:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3387 octets] ##########

Re: Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 19:55
od Rudy
Nyní poprosím o log Combofix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

Re: Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 21:31
od eva.h
ComboFix 14-02-16.01 - Eva Horecká 17.02.2014 20:57:00.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4030.2152 [GMT 1:00]
Spuštěný z: c:\users\Eva Horeckß\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\E4463B213F.sys
c:\windows\iun6002.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-17 do 2014-02-17 )))))))))))))))))))))))))))))))
.
.
2014-02-17 20:10 . 2014-02-17 20:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-17 18:07 . 2014-02-17 18:08 -------- d-----w- C:\AdwCleaner
2014-02-17 17:42 . 2014-02-17 17:42 -------- d-----w- c:\program files\trend micro
2014-02-17 17:40 . 2014-02-17 17:41 -------- d-----w- C:\FRST
2014-02-15 17:29 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-15 17:29 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-03 18:15 . 2012-09-19 18:07 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2013-12-19 09:38 . 2013-12-19 09:38 35352 ----a-w- c:\windows\system32\drivers\cnnctfy3.sys
2013-12-19 09:24 . 2013-12-19 09:24 31344 ----a-w- c:\windows\system32\drivers\cnnctfy2.sys
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-04 19:00 . 2013-12-04 19:00 84328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-12-04 19:00 . 2013-12-04 19:00 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-04 19:00 . 2013-12-04 19:00 65264 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-04 19:00 . 2013-12-04 19:00 409832 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-12-04 19:00 . 2013-12-04 19:00 38984 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-12-04 19:00 . 2013-12-04 19:00 205320 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-04 19:00 . 2013-12-04 19:00 1032416 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-12-04 19:00 . 2013-12-04 19:00 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-04 19:00 . 2013-12-04 19:00 43152 ----a-w- c:\windows\avastSS.scr
2013-12-04 19:00 . 2012-08-14 11:44 334648 ----a-w- c:\windows\system32\aswBoot.exe
2013-12-04 05:47 . 2013-12-04 05:47 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-04 05:47 . 2013-12-04 05:47 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-04 05:47 . 2013-12-04 05:47 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-04 05:47 . 2013-12-04 05:47 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-04 05:47 . 2013-12-04 05:47 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-04 05:47 . 2013-12-04 05:47 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-04 05:47 . 2013-12-04 05:47 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-04 05:47 . 2013-12-04 05:47 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-04 05:47 . 2013-12-04 05:47 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-04 05:47 . 2013-12-04 05:47 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-04 05:47 . 2013-12-04 05:47 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-04 05:47 . 2013-12-04 05:47 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-04 05:47 . 2013-12-04 05:47 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-04 05:47 . 2013-12-04 05:47 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-04 05:47 . 2013-12-04 05:47 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-04 05:47 . 2013-12-04 05:47 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-04 05:47 . 2013-12-04 05:47 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-04 05:47 . 2013-12-04 05:47 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-04 05:47 . 2013-12-04 05:47 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-04 05:47 . 2013-12-04 05:47 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-04 05:47 . 2013-12-04 05:47 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-04 05:47 . 2013-12-04 05:47 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-04 05:47 . 2013-12-04 05:47 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-04 05:47 . 2013-12-04 05:47 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-04 05:47 . 2013-12-04 05:47 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-04 05:47 . 2013-12-04 05:47 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-04 05:47 . 2013-12-04 05:47 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-04 05:47 . 2013-12-04 05:47 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-04 05:47 . 2013-12-04 05:47 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-04 05:47 . 2013-12-04 05:47 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-04 05:47 . 2013-12-04 05:47 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-04 05:47 . 2013-12-04 05:47 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-04 05:47 . 2013-12-04 05:47 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-04 05:47 . 2013-12-04 05:47 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-04 05:47 . 2013-12-04 05:47 413696 ----a-w- c:\windows\system32\html.iec
2013-12-04 05:47 . 2013-12-04 05:47 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-04 05:47 . 2013-12-04 05:47 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-04 05:47 . 2013-12-04 05:47 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-04 05:47 . 2013-12-04 05:47 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-04 05:47 . 2013-12-04 05:47 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-04 05:47 . 2013-12-04 05:47 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-04 05:47 . 2013-12-04 05:47 235520 ----a-w- c:\windows\system32\url.dll
2013-12-04 05:47 . 2013-12-04 05:47 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-04 05:47 . 2013-12-04 05:47 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-04 05:47 . 2013-12-04 05:47 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-04 05:47 . 2013-12-04 05:47 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-04 05:47 . 2013-12-04 05:47 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-04 05:47 . 2013-12-04 05:47 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-04 05:47 . 2013-12-04 05:47 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-04 05:47 . 2013-12-04 05:47 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-04 05:47 . 2013-12-04 05:47 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-04 05:47 . 2013-12-04 05:47 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-27 01:41 . 2014-01-18 17:47 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:41 . 2014-01-18 17:47 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:41 . 2014-01-18 17:47 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:41 . 2014-01-18 17:47 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-11-27 01:41 . 2014-01-18 17:47 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:41 . 2014-01-18 17:47 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:41 . 2014-01-18 17:47 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-11-26 11:40 . 2014-01-18 17:47 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2013-11-26 10:32 . 2014-01-18 17:47 3156480 ----a-w- c:\windows\system32\win32k.sys
2013-11-23 18:26 . 2013-12-12 07:49 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 07:49 465920 ----a-w- c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-01-28 299576]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"HP HD Webcam [Fixed]_Monitor"="c:\program files (x86)\HP HD Webcam [Fixed]\monitor.exe" [2010-11-26 11:31 267128]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-14 343168]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-04-05 94264]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-11-10 169528]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-04 3568312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-05-09 23:43 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe;c:\program files\Motorola\Bluetooth\audiosrv.exe [x]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys;c:\windows\SYSNATIVE\Drivers\btmcom.sys [x]
R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys;c:\windows\SYSNATIVE\Drivers\btmusb.sys [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 MfeEpePc;MfeEpePc; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe;c:\program files\Motorola\Bluetooth\obexsrv.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [x]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
S3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-04 04:28 1211720 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-14 11:44]
.
2014-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-14 11:44]
.
2014-01-20 c:\windows\Tasks\HPCeeScheduleForEVAHORECKA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-04 19:00 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2011-01-27 13880]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2011-02-16 21709904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-09-01 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-09-01 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-09-01 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-27 835072]
"MfeEpePcMonitor"="c:\program files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe" [2011-02-09 200704]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm
TCP: DhcpNameServer = 213.46.172.37 213.46.172.36
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{086A3F0F-CF9A-441C-94E6-7EA920ED8B7F}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{0BEBE1C3-9906-437B-8BF0-26098FCCFB11}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{11307AAE-E562-4152-882F-89E1B82E80C3}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{11D3ED8F-3FA3-4642-8A03-BED919B50C2E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{18BCA438-BAAC-4E76-BC6F-1FD5DFB5D81E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{198BA995-6D8D-48C9-BA2D-28199F0E07BD}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1A70F1DA-8801-44B7-B227-43FD85C1BD46}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1C239B4E-866D-4FB2-A0F5-E6DB538C17B2}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1FC61CE5-9303-481A-9304-7FF9BA2EF5FC}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{23D283CF-8041-43CB-8AC3-EB0CAB136BE3}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{2454BDDB-3EDD-4A29-9CE8-16DA41ED5AEF}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{27951AC3-2100-454B-A8A4-0FBE431BCEA8}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{289D00A6-6A73-49F3-8F82-5404EC25E829}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{37F2C54C-DE73-4D7E-92D8-6330DC235EF0}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{393E0E68-11AC-41D6-BF70-8263EB0420BE}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{4089E469-7D38-4B58-824D-8535E1252D41}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{451FFA0D-F091-45E8-B294-8CEDFAFB0554}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{548E275F-0290-40E7-B454-738B0C61DE60}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{55E8577B-E48A-49C3-BC87-DCAB90157603}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{5722C2DA-A84E-487B-A1BA-E688C3790626}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{62072A9D-B793-4E4F-BC83-D927275FC0F8}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{6A5C6DEE-C603-4402-B78D-8010C031CF63}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{6FEAA44D-B4A8-4078-A262-6C9C59F768AE}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7148D525-A487-4B84-A850-52BB1C9AA444}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{714D3A9D-F7C6-487F-A903-E01D9B70C0D2}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7A1668A0-0C28-4F00-BC93-EC1D4FCEF2FF}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7D39C2C5-D11A-497F-9C9C-9573C0A6D87C}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{825BDDE4-ECCD-4652-800C-6E06F1717224}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{8D9BB053-FEE5-4411-B6F5-F1E37DDC3106}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{96526238-2A9E-4F78-96AB-1A0EFC45C61E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{A80A9CEC-401F-4242-9579-6A8BC2FA9072}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{ACA2EA65-587D-409D-A0E9-36B0A6E2D2E0}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{ADCF5391-C7F8-4909-A415-6959B0F10769}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{B906071E-9281-44B9-BBDB-98893081D222}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{C1942E1F-1B66-464E-A408-4AE7D2B3C9A3}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{C6A83752-462C-4213-835F-41B93E30A113}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{D0EC826A-16E3-432C-BCAE-667C25A2756C}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{D8F219B9-D0C0-470C-8210-74650E79D3DC}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{DED72938-4B76-40A5-BE13-845F4AF4B983}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{E26D94DD-4CF7-4705-9DFB-5A00B07C4D19}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{E49B30C9-6D7E-48F5-91DA-F2F0414C6A13}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EA9C5C50-F43B-4AEB-A994-58520C38D640}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EB65EDA9-9261-4604-A706-8FC34AB65297}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EE4E49B0-38EC-4C23-A7A6-2E190B5E3418}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{F80E0A72-22C2-4307-9738-79DD4502FCCE}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2014-02-17 21:28:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-02-17 20:28
.
Před spuštěním: Volných bajtů: 53 772 419 072
Po spuštění: Volných bajtů: 55 189 467 136
.
- - End Of File - - 58CFC8A239ABFB7F67B9BCD29E13E1B0

Re: Rozesílám spam - prosím pomoc

Napsal: 17 úno 2014 22:19
od Rudy
Ještě dočistíme. Přesuňte Combofix na kořenový adresář c:\. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

File::
c:\programdata\KGyGaAvL.sys
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Driver::
MfeEpePc
McAfee Endpoint Encryption Agent

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

Reboot::
Uložte rovněž na kořenový adresář c:\ jako CFScript.txt. Pak je myší v průzkumníku windows (nebo jiném souborovém manažeru) přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 09:08
od eva.h
Udělala jsem co bylo napsáno, po restartu naběhlo okno: "počítač nelze spustit, nástroj Oprava spouštění systému hledá problémy v systému...", až to doběhlo, napsalo to, že problémy nebyly odstraněny. Tlačítko [Dokončit], počítač se vypnul. Po zapnutí (nabíhá vlaječka Windows), pak hned krátce blikne modré okno a konec.
Po restartu to nabídne pak buď spustit systém běžným způsobem a nebo spustit opravu chyb. První možnost opakuje modrou smrt dokola a oprava chyb zase nic neopraví.

Co s tím mám teď dělat?

V rozšířených možnostech je pak ta Automatická oprava. Obnovení systému na dřívější bod v čase (píše že to nejde... neexistuje záloha), pak bitová kopie systému (tu nemám, škoda), Diagnostika paměti Windows (to nic neudělá) a Příkazový řádek (a tam nevím co psát :) ).

Doufám, že to nebudu muset přeinstalovat.

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 19:21
od Rudy
Lze nastartovat do nouz. režimu? Nebylo smazáno nic, co by mohlo poškodit systém.

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 19:30
od eva.h
Nelze. Zvolím nouzový režim, hodí to černou obrazovku a začne to vypisovat řádky (jako vždycky), pak se to kousne a hodí modrou smrt (zase na desetinu vteřiny modrá smrt a hned restart). Poslední načtený řádek je aswRvrt.sys

Bohužel nemůžu dát log z ComboFixu, protože se tam prostě nedostanu (a snad ani nebyl vytvořen). Jediné kam se dostanu a co by k něčemu mohlo vést, je ta konzole v obnovovací funkci (automatické obnovení, které mi pořád Windows nabízí, tak nikdy nic nevyřeší).

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 19:43
od eva.h
No asi jsem to pořešila, protože mě předtím vůbec nenapadl nouzový režim. Ten sice nejde, ale bylo to vodítko. Po stisku F8 tam bylo spousta dalších možností a jedna z nich [Poslední známá funkční konfigurace (pokročilé)], ta samá nabídka ale byla i ve Windows okně (automatická obnova, bitová kopie, poslední konfigurace, kontrola paměti a konzole) a tady mi to napsalo, že žádnou poslední konfiguraci nemá. Spuštěním této možnosti z F8 a ne z Windows okna už ji měl.

A dokonce se spustil i ComboFix a vyplivuje log takže ho sem za chvíli dám...

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 19:56
od eva.h
ComboFix 14-02-16.01 - Eva Horecká 18.02.2014 8:30.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4030.2182 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\programdata\KGyGaAvL.sys"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\KGyGaAvL.sys
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_McAfee Endpoint Encryption Agent
-------\Service_MfeEpePc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-18 do 2014-02-18 )))))))))))))))))))))))))))))))
.
.
2014-02-18 07:42 . 2014-02-18 07:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-17 18:07 . 2014-02-17 18:08 -------- d-----w- C:\AdwCleaner
2014-02-17 17:42 . 2014-02-17 17:42 -------- d-----w- c:\program files\trend micro
2014-02-17 17:40 . 2014-02-17 17:41 -------- d-----w- C:\FRST
2014-02-15 17:29 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-15 17:29 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 09:01 . 2014-02-18 18:44 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B405709A-B37E-4FE1-A749-EFCE563EA22C}\mpengine.dll
2013-12-19 09:38 . 2013-12-19 09:38 35352 ----a-w- c:\windows\system32\drivers\cnnctfy3.sys
2013-12-19 09:24 . 2013-12-19 09:24 31344 ----a-w- c:\windows\system32\drivers\cnnctfy2.sys
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-04 19:00 . 2013-12-04 19:00 84328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-12-04 19:00 . 2013-12-04 19:00 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-04 19:00 . 2013-12-04 19:00 65264 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-04 19:00 . 2013-12-04 19:00 409832 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-12-04 19:00 . 2013-12-04 19:00 38984 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-12-04 19:00 . 2013-12-04 19:00 205320 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-04 19:00 . 2013-12-04 19:00 1032416 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-12-04 19:00 . 2013-12-04 19:00 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-04 19:00 . 2013-12-04 19:00 43152 ----a-w- c:\windows\avastSS.scr
2013-12-04 19:00 . 2012-08-14 11:44 334648 ----a-w- c:\windows\system32\aswBoot.exe
2013-12-04 05:47 . 2013-12-04 05:47 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-04 05:47 . 2013-12-04 05:47 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-04 05:47 . 2013-12-04 05:47 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-04 05:47 . 2013-12-04 05:47 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-04 05:47 . 2013-12-04 05:47 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-04 05:47 . 2013-12-04 05:47 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-04 05:47 . 2013-12-04 05:47 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-04 05:47 . 2013-12-04 05:47 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-04 05:47 . 2013-12-04 05:47 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-04 05:47 . 2013-12-04 05:47 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-04 05:47 . 2013-12-04 05:47 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-04 05:47 . 2013-12-04 05:47 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-04 05:47 . 2013-12-04 05:47 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-04 05:47 . 2013-12-04 05:47 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-04 05:47 . 2013-12-04 05:47 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-04 05:47 . 2013-12-04 05:47 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-04 05:47 . 2013-12-04 05:47 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-04 05:47 . 2013-12-04 05:47 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-04 05:47 . 2013-12-04 05:47 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-04 05:47 . 2013-12-04 05:47 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-04 05:47 . 2013-12-04 05:47 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-04 05:47 . 2013-12-04 05:47 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-04 05:47 . 2013-12-04 05:47 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-04 05:47 . 2013-12-04 05:47 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-04 05:47 . 2013-12-04 05:47 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-04 05:47 . 2013-12-04 05:47 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-04 05:47 . 2013-12-04 05:47 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-04 05:47 . 2013-12-04 05:47 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-04 05:47 . 2013-12-04 05:47 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-04 05:47 . 2013-12-04 05:47 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-04 05:47 . 2013-12-04 05:47 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-04 05:47 . 2013-12-04 05:47 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-04 05:47 . 2013-12-04 05:47 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-04 05:47 . 2013-12-04 05:47 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-04 05:47 . 2013-12-04 05:47 413696 ----a-w- c:\windows\system32\html.iec
2013-12-04 05:47 . 2013-12-04 05:47 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-04 05:47 . 2013-12-04 05:47 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-04 05:47 . 2013-12-04 05:47 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-04 05:47 . 2013-12-04 05:47 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-04 05:47 . 2013-12-04 05:47 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-04 05:47 . 2013-12-04 05:47 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-04 05:47 . 2013-12-04 05:47 235520 ----a-w- c:\windows\system32\url.dll
2013-12-04 05:47 . 2013-12-04 05:47 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-04 05:47 . 2013-12-04 05:47 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-04 05:47 . 2013-12-04 05:47 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-04 05:47 . 2013-12-04 05:47 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-04 05:47 . 2013-12-04 05:47 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-04 05:47 . 2013-12-04 05:47 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-04 05:47 . 2013-12-04 05:47 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-04 05:47 . 2013-12-04 05:47 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-04 05:47 . 2013-12-04 05:47 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-04 05:47 . 2013-12-04 05:47 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-27 01:41 . 2014-01-18 17:47 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:41 . 2014-01-18 17:47 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:41 . 2014-01-18 17:47 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:41 . 2014-01-18 17:47 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-11-27 01:41 . 2014-01-18 17:47 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:41 . 2014-01-18 17:47 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:41 . 2014-01-18 17:47 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-11-26 11:40 . 2014-01-18 17:47 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2013-11-26 10:32 . 2014-01-18 17:47 3156480 ----a-w- c:\windows\system32\win32k.sys
2013-11-23 18:26 . 2013-12-12 07:49 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 07:49 465920 ----a-w- c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-01-28 299576]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"HP HD Webcam [Fixed]_Monitor"="c:\program files (x86)\HP HD Webcam [Fixed]\monitor.exe" [2010-11-26 11:31 267128]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-14 343168]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-04-05 94264]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-11-10 169528]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-04 3568312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-05-09 23:43 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe;c:\program files\Motorola\Bluetooth\audiosrv.exe [x]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys;c:\windows\SYSNATIVE\Drivers\btmcom.sys [x]
R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys;c:\windows\SYSNATIVE\Drivers\btmusb.sys [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe;c:\program files\Motorola\Bluetooth\obexsrv.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [x]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
S3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-04 04:28 1211720 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-20 c:\windows\Tasks\HPCeeScheduleForEVAHORECKA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-04 19:00 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2011-01-27 13880]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2011-02-16 21709904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-09-01 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-09-01 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-09-01 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-27 835072]
"MfeEpePcMonitor"="c:\program files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe" [2011-02-09 200704]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm
TCP: DhcpNameServer = 213.46.172.37 213.46.172.36
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{086A3F0F-CF9A-441C-94E6-7EA920ED8B7F}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{0BEBE1C3-9906-437B-8BF0-26098FCCFB11}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{11307AAE-E562-4152-882F-89E1B82E80C3}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{11D3ED8F-3FA3-4642-8A03-BED919B50C2E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{18BCA438-BAAC-4E76-BC6F-1FD5DFB5D81E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{198BA995-6D8D-48C9-BA2D-28199F0E07BD}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1A70F1DA-8801-44B7-B227-43FD85C1BD46}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1C239B4E-866D-4FB2-A0F5-E6DB538C17B2}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{1FC61CE5-9303-481A-9304-7FF9BA2EF5FC}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{23D283CF-8041-43CB-8AC3-EB0CAB136BE3}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{2454BDDB-3EDD-4A29-9CE8-16DA41ED5AEF}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{27951AC3-2100-454B-A8A4-0FBE431BCEA8}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{289D00A6-6A73-49F3-8F82-5404EC25E829}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{37F2C54C-DE73-4D7E-92D8-6330DC235EF0}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{393E0E68-11AC-41D6-BF70-8263EB0420BE}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{4089E469-7D38-4B58-824D-8535E1252D41}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{451FFA0D-F091-45E8-B294-8CEDFAFB0554}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{548E275F-0290-40E7-B454-738B0C61DE60}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{55E8577B-E48A-49C3-BC87-DCAB90157603}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{5722C2DA-A84E-487B-A1BA-E688C3790626}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{62072A9D-B793-4E4F-BC83-D927275FC0F8}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{6A5C6DEE-C603-4402-B78D-8010C031CF63}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{6FEAA44D-B4A8-4078-A262-6C9C59F768AE}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7148D525-A487-4B84-A850-52BB1C9AA444}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{714D3A9D-F7C6-487F-A903-E01D9B70C0D2}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7A1668A0-0C28-4F00-BC93-EC1D4FCEF2FF}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{7D39C2C5-D11A-497F-9C9C-9573C0A6D87C}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{825BDDE4-ECCD-4652-800C-6E06F1717224}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{8D9BB053-FEE5-4411-B6F5-F1E37DDC3106}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{96526238-2A9E-4F78-96AB-1A0EFC45C61E}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{A80A9CEC-401F-4242-9579-6A8BC2FA9072}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{ACA2EA65-587D-409D-A0E9-36B0A6E2D2E0}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{ADCF5391-C7F8-4909-A415-6959B0F10769}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{B906071E-9281-44B9-BBDB-98893081D222}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{C1942E1F-1B66-464E-A408-4AE7D2B3C9A3}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{C6A83752-462C-4213-835F-41B93E30A113}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{D0EC826A-16E3-432C-BCAE-667C25A2756C}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{D8F219B9-D0C0-470C-8210-74650E79D3DC}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{DED72938-4B76-40A5-BE13-845F4AF4B983}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{E26D94DD-4CF7-4705-9DFB-5A00B07C4D19}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11.01"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{E49B30C9-6D7E-48F5-91DA-F2F0414C6A13}]
@DACL=(02 0000)
@="FLEXnet Connect Agent 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EA9C5C50-F43B-4AEB-A994-58520C38D640}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EB65EDA9-9261-4604-A706-8FC34AB65297}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{EE4E49B0-38EC-4C23-A7A6-2E190B5E3418}]
@DACL=(02 0000)
@="FlexnetConnect61"
.
[HKEY_USERS\.Default\Software\Classes\CLSID\{F80E0A72-22C2-4307-9738-79DD4502FCCE}]
@DACL=(02 0000)
@="FLEXnet Connect Download Manager 11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
c:\program files (x86)\PDF Complete\pdfsvc.exe
c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe
c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
c:\program files (x86)\Internet Explorer\IELowutil.exe
.
**************************************************************************
.
Celkový čas: 2014-02-18 19:54:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-02-18 18:54
.
Před spuštěním: Volných bajtů: 55 194 480 640
Po spuštění: Volných bajtů: 54 621 650 944
.
- - End Of File - - 9212897D9B32C1B4F87715FD49ADDFE6

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 20:16
od Rudy
Vše smazáno. Změnilo se teď něco?

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 20:20
od eva.h
No 3x po normálním restartu mi to zase dělalo stejný problém a musela jsem dát zase poslední známou konfiguraci, ale po 4. restartu už to naběhlo normálně a doufám že už to bude nabíhat normálně i dál. Vytvořím tedy bod obnovy a asi i bitovou kopii (po této zkušenosti).
Takže jestli je všechna havěť pryč, tak je to ok.

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 20:25
od Rudy
Určitě vytvořte. Předpokládám, že po virové stránce je PC čistý. CF odinstalujte pomocí t-Cleaneru: http://vyosek.tym.cz/pro_usery/T-Cleaner.exe .

Re: Rozesílám spam - prosím pomoc

Napsal: 18 úno 2014 20:27
od eva.h
Tak děkuji za pomoc :thumbsup: A můžete lock.
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz