Problém - trojany

[mutycz]

Zdravím,

nastal mi u PC problém s tím že nešly psát diakritkcá písmena přes shift a také zmizel osobní certifikát z certmgr. AVG test nešel spusti a tak jsem to projel Eset onlinem - nalezl následující
C:\Users\judr.ACCONTESBRNO\AppData\Roaming\Xigyi\datocu.exe varianta infiltrace Win32/Kryptik.BBUI trojský kůň vyléčen smazáním - uložen do karantény
Paměť varianta infiltrace Win32/Spy.Zbot.ZR trojský kůň

Asi bude potřeba celkové pročistění - přídávám log z RSIT
Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2013-05-24 20:47:30
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 2 GB (6%) free of 38 GB
Total RAM: 2047 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:47:41, on 24.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\rdpclip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Software602\Print2PDF\Print2PDF.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
D:\Program Files\APC\PowerChute Personal Edition\apcsystray.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\judr.ACCONTESBRNO\Downloads\RSIT.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Print2PDF Print Monitor] "C:\Program Files\Software602\Print2PDF\Print2PDF.exe" /server
O4 - HKLM\..\Run: [gemstrmw] C:\Windows\system32\gemstrmw.exe /r
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Display] D:\Program Files\APC\PowerChute Personal Edition\DataCollectionLauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1616587249-3722754679-407430079-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1616587249-3722754679-407430079-1001\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1942028738-3123094729-2533903162-1106\..\Run: [APC] C:\Users\judr.ACCONTESBRNO\AppData\Roaming\rduwdvrc\sagiagee.exe (User 'judr')
O4 - S-1-5-21-1942028738-3123094729-2533903162-1106 Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'judr')
O4 - S-1-5-21-1942028738-3123094729-2533903162-1106 User Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'judr')
O4 - Global Startup: APC UPS Status.lnk = D:\Program Files\APC\PowerChute Personal Edition\Display.exe
O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = accontesbrno.net
O17 - HKLM\Software\..\Telephony: DomainName = ACCONTES
O17 - HKLM\System\CCS\Services\Tcpip\..\{5FAB7261-615B-478A-86D7-0D0213979C95}: NameServer = 192.168.2.150
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = accontesbrno.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{5FAB7261-615B-478A-86D7-0D0213979C95}: NameServer = 192.168.2.150
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = accontesbrno.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{5FAB7261-615B-478A-86D7-0D0213979C95}: NameServer = 192.168.2.150
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: APC Data Service - Schneider Electric - D:\Program Files\APC\PowerChute Personal Edition\dataserv.exe
O23 - Service: APC UPS Service - Schneider Electric - D:\Program Files\APC\PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: HP SI Service (HPSIService) - HP - C:\Windows\system32\HPSIsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--
End of file - 8714 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}]
AVG Do Not Track - C:\Program Files\AVG\AVG2012\avgdtiex.dll [2012-10-15 938104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-04-04 462752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17 3855520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-04-04 171424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2010-12-13 135536]
"Print2PDF Print Monitor"=C:\Program Files\Software602\Print2PDF\Print2PDF.exe [2011-04-12 222776]
"gemstrmw"=C:\Windows\system32\gemstrmw.exe [2003-08-29 24576]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 336384]
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2012-11-19 2598520]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
""= []
"Display"=D:\Program Files\APC\PowerChute Personal Edition\DataCollectionLauncher.exe [2012-01-24 284024]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2013-05-15 2255184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\Sidebar.exe [2010-11-20 1174016]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
APC UPS Status.lnk - D:\Program Files\APC\PowerChute Personal Edition\Display.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux1"=wdmaud.drv
"wave4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"mixer5"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-05-24 18:12:52 ----D---- C:\Program Files\ESET
2013-05-24 18:07:30 ----D---- C:\Program Files\trend micro
2013-05-24 18:07:29 ----D---- C:\rsit
2013-05-23 10:57:46 ----D---- C:\Program Files\LogMeIn Hamachi
2013-05-17 14:41:11 ----D---- C:\Program Files\Common Files\Java
2013-05-17 12:04:57 ----A---- C:\Windows\system32\WindowsAccessBridge.dll
2013-05-17 12:04:57 ----A---- C:\Windows\system32\javaw.exe
2013-05-17 12:04:57 ----A---- C:\Windows\system32\java.exe
2013-05-16 04:05:30 ----D---- C:\Windows\rescache
2013-05-16 03:07:57 ----A---- C:\Windows\system32\jscript9.dll
2013-05-16 03:07:57 ----A---- C:\Windows\system32\jscript.dll
2013-05-16 03:07:55 ----A---- C:\Windows\system32\jsproxy.dll
2013-05-16 03:07:55 ----A---- C:\Windows\system32\iesetup.dll
2013-05-16 03:07:54 ----A---- C:\Windows\system32\ieui.dll
2013-05-16 03:07:53 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-05-16 03:07:53 ----A---- C:\Windows\system32\msfeeds.dll
2013-05-16 03:07:53 ----A---- C:\Windows\system32\iernonce.dll
2013-05-16 03:07:53 ----A---- C:\Windows\system32\ie4uinit.exe
2013-05-16 03:07:52 ----A---- C:\Windows\system32\urlmon.dll
2013-05-16 03:07:52 ----A---- C:\Windows\system32\iesysprep.dll
2013-05-16 03:07:51 ----A---- C:\Windows\system32\iertutil.dll
2013-05-16 03:07:47 ----A---- C:\Windows\system32\wininet.dll
2013-05-16 03:07:45 ----A---- C:\Windows\system32\ieframe.dll
2013-05-16 03:07:38 ----A---- C:\Windows\system32\mshtml.dll
2013-05-16 00:08:05 ----A---- C:\Windows\system32\wwansvc.dll
2013-05-16 00:08:05 ----A---- C:\Windows\system32\wwanprotdim.dll
2013-05-16 00:08:04 ----A---- C:\Windows\system32\win32k.sys
2013-05-16 00:07:58 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2013-05-16 00:07:58 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-05-16 00:07:51 ----A---- C:\Windows\system32\shell32.dll
2013-05-16 00:07:50 ----A---- C:\Windows\system32\shdocvw.dll
2013-05-16 00:07:50 ----A---- C:\Windows\system32\consent.exe
2013-05-16 00:07:50 ----A---- C:\Windows\system32\authui.dll
2013-05-16 00:07:50 ----A---- C:\Windows\system32\appinfo.dll
2013-05-06 13:46:40 ----D---- C:\RSAV

======List of files/folders modified in the last 1 month======

2013-05-24 20:47:42 ----D---- C:\Windows\Temp
2013-05-24 20:47:41 ----D---- C:\Windows\Prefetch
2013-05-24 20:18:18 ----D---- C:\Windows\system32\config
2013-05-24 20:06:20 ----SHD---- C:\System Volume Information
2013-05-24 18:17:41 ----D---- C:\Windows
2013-05-24 18:12:54 ----D---- C:\Windows\Downloaded Program Files
2013-05-24 18:12:52 ----RD---- C:\Program Files
2013-05-24 17:59:04 ----D---- C:\ProgramData\NVIDIA
2013-05-24 17:57:39 ----A---- C:\Windows\system32\PCPELog.txt
2013-05-24 15:33:34 ----D---- C:\Windows\system32\drivers\AVG
2013-05-23 23:32:50 ----SHD---- C:\Windows\Installer
2013-05-17 14:41:11 ----D---- C:\Program Files\Common Files
2013-05-17 12:04:57 ----D---- C:\Windows\System32
2013-05-17 12:04:57 ----D---- C:\Program Files\Java
2013-05-16 03:40:40 ----D---- C:\Windows\Microsoft.NET
2013-05-16 03:39:51 ----RSD---- C:\Windows\assembly
2013-05-16 03:29:21 ----D---- C:\Windows\winsxs
2013-05-16 03:26:05 ----D---- C:\Program Files\Internet Explorer
2013-05-16 03:26:03 ----D---- C:\Windows\system32\drivers
2013-05-16 03:26:03 ----D---- C:\Windows\system32\cs-CZ
2013-05-16 03:26:03 ----D---- C:\Windows\AppPatch
2013-05-16 03:08:28 ----D---- C:\Windows\system32\catroot
2013-05-16 03:08:24 ----D---- C:\Windows\system32\catroot2
2013-05-16 03:04:01 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-16 03:03:59 ----D---- C:\Windows\inf
2013-05-15 17:43:40 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-05-15 09:23:47 ----D---- C:\ProgramData\MFAData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHX;AVGIDSHX; C:\Windows\system32\DRIVERS\avgidshx.sys [2012-04-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys [2012-01-31 31952]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys [2012-11-08 250080]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys [2013-04-11 302368]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-25 7800832]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-25 245760]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2011-03-30 100880]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2008-01-19 20992]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver; C:\Windows\System32\Drivers\nx6000.sys [2010-12-13 30576]
R3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2012-09-26 17408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-14 347264]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-25 7800832]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 GemCCID;GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [2009-08-10 89600]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2011-05-25 139368]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;Ovladač WinUSB; C:\Windows\system32\drivers\WinUSB.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-25 176128]
R2 APC Data Service;APC Data Service; D:\Program Files\APC\PowerChute Personal Edition\dataserv.exe [2012-01-24 21880]
R2 APC UPS Service;APC UPS Service; D:\Program Files\APC\PowerChute Personal Edition\mainserv.exe [2012-01-24 705912]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2013-05-15 1435984]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2012-09-27 100256]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2010-12-13 135536]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-05-25 615528]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-02-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-15 256904]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-02-05 1343400]

-----------------EOF-----------------


Moc děkuji!

[Rudy]

Zdravím!
Poporsím o log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[mutycz]

Log
ComboFix 13-05-24.01 - Administrator 24.05.2013 21:44:36.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2047.1215 [GMT 2:00]
Spuštěný z: c:\users\judr.ACCONTESBRNO\Downloads\ComboFix.exe
AV: AVG Anti-Virus 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Administrator.ACCONTES\ResourceReader.dll
c:\windows\system32\SET125C.tmp
c:\windows\system32\SET1E8A.tmp
c:\windows\system32\SET2885.tmp
c:\windows\system32\SET7D31.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-24 do 2013-05-24 )))))))))))))))))))))))))))))))
.
.
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:03 -------- d-----w- c:\users\Administrator.ACCONTESBRNO\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\judr.ACCONTES\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\judr\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\ucetni4\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\Administrator.U4\AppData\Local\temp
2013-05-24 20:01 . 2013-05-24 20:01 -------- d-----w- c:\users\Administrator.ACCONTES\AppData\Local\temp
2013-05-24 20:00 . 2013-05-24 20:00 -------- d-----w- c:\users\ucetni3\AppData\Local\temp
2013-05-24 20:00 . 2013-05-24 20:00 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-05-24 16:12 . 2013-05-24 16:12 -------- d-----w- c:\program files\ESET
2013-05-24 16:07 . 2013-05-24 18:47 -------- d-----w- c:\program files\trend micro
2013-05-24 16:07 . 2013-05-24 16:07 -------- d-----w- C:\rsit
2013-05-24 10:39 . 2013-05-24 17:38 -------- d-----w- c:\users\judr.ACCONTESBRNO\AppData\Roaming\Xigyi
2013-05-24 10:39 . 2013-05-24 10:59 -------- d-----w- c:\users\judr.ACCONTESBRNO\AppData\Roaming\Atzus
2013-05-23 08:57 . 2013-05-23 08:57 -------- d-----w- c:\program files\LogMeIn Hamachi
2013-05-17 12:41 . 2013-05-17 12:41 -------- d-----w- c:\program files\Common Files\Java
2013-05-17 10:04 . 2013-04-04 03:35 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-16 02:05 . 2013-05-16 02:06 -------- d-----w- c:\windows\rescache
2013-05-15 22:08 . 2013-03-19 04:53 186368 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 22:08 . 2013-03-19 03:33 40960 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-15 22:08 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-15 22:07 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 22:07 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 22:07 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-15 22:07 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll
2013-05-15 22:07 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll
2013-05-06 11:46 . 2013-05-06 11:46 -------- d-----w- C:\RSAV
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 15:43 . 2012-09-01 19:51 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 15:43 . 2011-07-04 15:55 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-13 04:45 . 2013-05-15 22:08 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 22:08 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-24 08:02 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-11 01:18 . 2013-04-11 01:18 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2013-03-19 05:04 . 2013-04-10 08:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48 . 2013-04-10 08:04 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49 . 2013-04-10 08:04 69632 ----a-w- c:\windows\system32\smss.exe
2013-03-15 02:02 . 2013-03-15 02:02 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-15 02:02 . 2013-03-15 02:02 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-03-15 02:02 . 2013-03-15 02:02 158720 ----a-w- c:\windows\system32\msls31.dll
2013-03-15 02:02 . 2013-03-15 02:02 138752 ----a-w- c:\windows\system32\wextract.exe
2013-03-15 02:02 . 2013-03-15 02:02 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-03-15 02:02 . 2013-03-15 02:02 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-03-15 02:02 . 2013-03-15 02:02 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-15 02:02 . 2013-03-15 02:02 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-03-15 02:02 . 2013-03-15 02:02 12800 ----a-w- c:\windows\system32\mshta.exe
2013-03-15 02:02 . 2013-03-15 02:02 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-15 02:02 . 2013-03-15 02:02 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-15 02:02 . 2013-03-15 02:02 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-03-15 02:02 . 2013-03-15 02:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-15 02:02 . 2013-03-15 02:02 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-15 02:02 . 2013-03-15 02:02 361984 ----a-w- c:\windows\system32\html.iec
2013-03-15 02:02 . 2013-03-15 02:02 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-15 02:02 . 2013-03-15 02:02 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-05 18:37 . 2013-01-06 14:13 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-03-05 18:37 . 2011-07-04 14:26 782240 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-07 05:20 . 2011-12-13 08:03 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 336384]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-05-15 2255184]
.
c:\users\ucetni4\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\Administrator.ACCONTES\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Lingea Update Center.lnk - c:\program files\Common Files\Lingea Shared\luc.exe [2009-7-3 275736]
.
c:\users\judr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\judr.ACCONTES\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\judr.ACCONTESBRNO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
APC UPS Status.lnk - d:\program files\APC\PowerChute Personal Edition\Display.exe [2012-1-24 271736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logoff\0\0]
"Script"=logoff.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logoff\0\1]
"Script"=logoff2.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logon\0\0]
"Script"=logon.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logon\0\1]
"Script"=logon2.cmd
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 APC Data Service;APC Data Service;d:\program files\APC\PowerChute Personal Edition\dataserv.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [x]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-01 15:43]
.
.
------- Doplňkový sken -------
.
TCP: Interfaces\{5FAB7261-615B-478A-86D7-0D0213979C95}: NameServer = 192.168.2.150
FF - ProfilePath -
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-05-24 22:08:01
ComboFix-quarantined-files.txt 2013-05-24 20:08
.
Před spuštěním: 2 727 124 992
Po spuštění: 6 222 327 808
.
- - End Of File - - 627B7D6FE75ED37CF8A89FC07CA4C104

[Rudy]

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[mutycz]

Comboxif me vratil nasledujici log:
ComboFix 13-05-24.01 - Administrator 24.05.2013 22:49:51.2.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2047.1243 [GMT 2:00]
Spuštěný z: c:\users\judr.ACCONTESBRNO\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\judr.ACCONTESBRNO\Desktop\CFScript.txt
AV: AVG Anti-Virus 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-24 do 2013-05-24 )))))))))))))))))))))))))))))))
.
.
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\ucetni4\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\ucetni3\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\judr\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\judr.ACCONTES\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\Administrator.U4\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04 -------- d-----w- c:\users\Administrator.ACCONTES\AppData\Local\temp
2013-05-24 20:08 . 2013-05-24 21:14 -------- d-----w- c:\users\Administrator.ACCONTESBRNO\AppData\Local\temp
2013-05-24 20:08 . 2013-05-24 21:13 -------- d-----w- c:\users\judr.ACCONTESBRNO\AppData\Local\temp
2013-05-24 16:12 . 2013-05-24 16:12 -------- d-----w- c:\program files\ESET
2013-05-24 16:07 . 2013-05-24 18:47 -------- d-----w- c:\program files\trend micro
2013-05-24 16:07 . 2013-05-24 16:07 -------- d-----w- C:\rsit
2013-05-24 10:39 . 2013-05-24 17:38 -------- d-----w- c:\users\judr.ACCONTESBRNO\AppData\Roaming\Xigyi
2013-05-24 10:39 . 2013-05-24 10:59 -------- d-----w- c:\users\judr.ACCONTESBRNO\AppData\Roaming\Atzus
2013-05-23 08:57 . 2013-05-23 08:57 -------- d-----w- c:\program files\LogMeIn Hamachi
2013-05-17 12:41 . 2013-05-17 12:41 -------- d-----w- c:\program files\Common Files\Java
2013-05-17 10:04 . 2013-04-04 03:35 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-16 02:05 . 2013-05-16 02:06 -------- d-----w- c:\windows\rescache
2013-05-15 22:08 . 2013-03-19 04:53 186368 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 22:08 . 2013-03-19 03:33 40960 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-15 22:08 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-15 22:07 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 22:07 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 22:07 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-15 22:07 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll
2013-05-15 22:07 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll
2013-05-06 11:46 . 2013-05-06 11:46 -------- d-----w- C:\RSAV
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 15:43 . 2012-09-01 19:51 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 15:43 . 2011-07-04 15:55 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-13 04:45 . 2013-05-15 22:08 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 22:08 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-24 08:02 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-11 01:18 . 2013-04-11 01:18 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2013-03-19 05:04 . 2013-04-10 08:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48 . 2013-04-10 08:04 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49 . 2013-04-10 08:04 69632 ----a-w- c:\windows\system32\smss.exe
2013-03-15 02:02 . 2013-03-15 02:02 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-15 02:02 . 2013-03-15 02:02 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-03-15 02:02 . 2013-03-15 02:02 158720 ----a-w- c:\windows\system32\msls31.dll
2013-03-15 02:02 . 2013-03-15 02:02 138752 ----a-w- c:\windows\system32\wextract.exe
2013-03-15 02:02 . 2013-03-15 02:02 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-03-15 02:02 . 2013-03-15 02:02 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-03-15 02:02 . 2013-03-15 02:02 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-15 02:02 . 2013-03-15 02:02 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-03-15 02:02 . 2013-03-15 02:02 12800 ----a-w- c:\windows\system32\mshta.exe
2013-03-15 02:02 . 2013-03-15 02:02 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-15 02:02 . 2013-03-15 02:02 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-15 02:02 . 2013-03-15 02:02 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-03-15 02:02 . 2013-03-15 02:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-15 02:02 . 2013-03-15 02:02 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-15 02:02 . 2013-03-15 02:02 361984 ----a-w- c:\windows\system32\html.iec
2013-03-15 02:02 . 2013-03-15 02:02 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-15 02:02 . 2013-03-15 02:02 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-05 18:37 . 2013-01-06 14:13 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-03-05 18:37 . 2011-07-04 14:26 782240 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-07 05:20 . 2011-12-13 08:03 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 336384]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-05-15 2255184]
.
c:\users\ucetni4\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\Administrator.ACCONTES\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Lingea Update Center.lnk - c:\program files\Common Files\Lingea Shared\luc.exe [2009-7-3 275736]
.
c:\users\judr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\judr.ACCONTES\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\users\judr.ACCONTESBRNO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
APC UPS Status.lnk - d:\program files\APC\PowerChute Personal Edition\Display.exe [2012-1-24 271736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logoff\0\0]
"Script"=logoff.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logoff\0\1]
"Script"=logoff2.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logon\0\0]
"Script"=logon.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3248531015-3657829206-1257948550-1109\Scripts\Logon\0\1]
"Script"=logon2.cmd
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 APC Data Service;APC Data Service;d:\program files\APC\PowerChute Personal Edition\dataserv.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [x]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-01 15:43]
.
.
------- Doplňkový sken -------
.
TCP: Interfaces\{5FAB7261-615B-478A-86D7-0D0213979C95}: NameServer = 192.168.2.150
FF - ProfilePath -
.
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3540)
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\LogonUI.exe
c:\windows\system32\atieclxx.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
d:\program files\APC\PowerChute Personal Edition\mainserv.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\PrintIsolationHost.exe
c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
c:\windows\system32\rdpclip.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
.
**************************************************************************
.
Celkový čas: 2013-05-24 23:18:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-05-24 21:18
ComboFix2.txt 2013-05-24 20:08
.
Před spuštěním: 5 941 260 288
Po spuštění: 3 775 201 280
.
- - End Of File - - F4BB69AFB4A7A878A6B9C3471947E778

Jeste bych se zeptal kvuli tomu zmizelemu certifikatu z certmgr.msc (normální osobní kvalifikovaný)- mohl jej ten vir odeslat pryč nebo jej jen smazal? V životě jsem o tomhle chování neslyšel

[Rudy]

Řekl bych, že smazal. Také nemám žádné povědomí o tom, že by vir s certifikátem dělal něco jiného. Log je již OK.

[mutycz]

Moc děkuji za pomoc .

[Rudy]

Nemáte zač!