Kontrola logu

[sisik]

Ahoj, prosím o kontrolu logu. Díky moc

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:42:44, on 10.3.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\program files\relevantknowledge\rlvknlg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
E:\Hry\FM2007\fm.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14597&l=dis
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.3\youtubedownloaderToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.3\youtubedownloaderToolbarIE.dll
O3 - Toolbar: CENZURA Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\CENZURA Toolbar\IE\4.3\youtubedownloaderToolbarIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: RelevantKnowledge - C:\program files\relevantknowledge\rlls.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5508 bytes

[Reklama]

[Žbeky]

Nějaké problémy?

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[sisik]

Tady je log z Malware:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 6012

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

10.3.2011 21:27:06
mbam-log-2011-03-10 (21-27-03).txt

Typ kontroly: Rychlý test
Testované objekty: 141502
Uplynulý čas: 5 minut, 49 sekund

Infikované procesy v paměti: 3
Infikované moduly v paměti: 3
Infikované klíče v registru: 6
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 0
Infikované složky: 3
Infikované soubory: 20

Infikované procesy v paměti:
c:\program files\relevantknowledge\rlvknlg.exe (Adware.RelevantKnowledge) -> 1932 -> No action taken.
c:\program files\application updater\applicationupdater.exe (PUP.Dealio) -> 916 -> No action taken.
c:\program files\common files\Spigot\search settings\searchsettings.exe (PUP.Dealio) -> 556 -> No action taken.

Infikované moduly v paměti:
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> No action taken.
c:\program files\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> No action taken.
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> No action taken.

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater (PUP.Dealio) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A} (PUP.Dealio) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\APPLICATION UPDATER\APPLICATIONUPDATER.EXE (PUP.Dealio) -> Value: APPLICATIONUPDATER.EXE -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM\COMPONENTS\WIDGITOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: WIDGITOOLBARFF.DLL -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Value: {F3FEE66E-E034-436A-86E4-9690573BEE8A} -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Value: {F3FEE66E-E034-436A-86E4-9690573BEE8A} -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings (PUP.Dealio) -> Value: SearchSettings -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\COMMON FILES\SPIGOT\SEARCH SETTINGS\SEARCHSETTINGS.EXE (PUP.Dealio) -> Value: SEARCHSETTINGS.EXE -> No action taken.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
c:\program files\relevantknowledge (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\components (Spyware.MarketScore) -> No action taken.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge (Spyware.MarketScore) -> No action taken.

Infikované soubory:
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> No action taken.
c:\program files\relevantknowledge\rlvknlg.exe (Adware.RelevantKnowledge) -> No action taken.
c:\program files\application updater\applicationupdater.exe (PUP.Dealio) -> No action taken.
c:\program files\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> No action taken.
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> No action taken.
c:\program files\CENZURA toolbar\IE\4.3\youtubedownloadertoolbarie.dll (PUP.Dealio) -> No action taken.
c:\program files\common files\Spigot\search settings\searchsettings.exe (PUP.Dealio) -> No action taken.
c:\program files\relevantknowledge\chrome.manifest (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\install.rdf (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\nscf.dat (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rlls64.dll (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rloci.bin (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rlph.dll (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rlservice.exe (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rlvknlg64.exe (Spyware.MarketScore) -> No action taken.
c:\program files\relevantknowledge\rlxf.dll (Spyware.MarketScore) -> No action taken.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> No action taken.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> No action taken.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\Support.lnk (Spyware.MarketScore) -> No action taken.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> No action taken.

[Žbeky]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[sisik]

Log po smazaní:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 6012

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

10.3.2011 21:45:20
mbam-log-2011-03-10 (21-45-20).txt

Typ kontroly: Rychlý test
Testované objekty: 141523
Uplynulý čas: 3 minut, 37 sekund

Infikované procesy v paměti: 3
Infikované moduly v paměti: 3
Infikované klíče v registru: 6
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 0
Infikované složky: 3
Infikované soubory: 20

Infikované procesy v paměti:
c:\program files\relevantknowledge\rlvknlg.exe (Adware.RelevantKnowledge) -> 1932 -> Unloaded process successfully.
c:\program files\application updater\applicationupdater.exe (PUP.Dealio) -> 916 -> Unloaded process successfully.
c:\program files\common files\Spigot\search settings\searchsettings.exe (PUP.Dealio) -> 556 -> Unloaded process successfully.

Infikované moduly v paměti:
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\program files\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot.

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\APPLICATION UPDATER\APPLICATIONUPDATER.EXE (PUP.Dealio) -> Value: APPLICATIONUPDATER.EXE -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM\COMPONENTS\WIDGITOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: WIDGITOOLBARFF.DLL -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Value: {F3FEE66E-E034-436A-86E4-9690573BEE8A} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio) -> Value: {F3FEE66E-E034-436A-86E4-9690573BEE8A} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings (PUP.Dealio) -> Value: SearchSettings -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\COMMON FILES\SPIGOT\SEARCH SETTINGS\SEARCHSETTINGS.EXE (PUP.Dealio) -> Value: SEARCHSETTINGS.EXE -> Quarantined and deleted successfully.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
c:\program files\relevantknowledge (Spyware.MarketScore) -> Delete on reboot.
c:\program files\relevantknowledge\components (Spyware.MarketScore) -> Delete on reboot.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.

Infikované soubory:
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\program files\relevantknowledge\rlvknlg.exe (Adware.RelevantKnowledge) -> Delete on reboot.
c:\program files\application updater\applicationupdater.exe (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot.
c:\program files\CENZURA toolbar\IE\4.3\youtubedownloadertoolbarie.dll (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\common files\Spigot\search settings\searchsettings.exe (PUP.Dealio) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\chrome.manifest (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\install.rdf (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\nscf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlls64.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlph.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlservice.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlvknlg64.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlxf.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\nabídka start\Programy\relevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.

[sisik]

A tady je leg z Combofixu:

ComboFix 11-03-09.05 - Ondrasek 10.03.2011 21:57:40.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1919.1504 [GMT 1:00]
Spuštěný z: e:\stažené soubory\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ondrasek\Data aplikací\Local
c:\documents and settings\Ondrasek\Data aplikací\PriceGong
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\1.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\a.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\b.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\c.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\d.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\e.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\f.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\g.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\h.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\i.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\J.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\k.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\l.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\m.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\mru.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\n.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\o.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\p.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\q.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\r.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\s.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\t.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\u.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\v.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\w.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\x.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\y.xml
c:\documents and settings\Ondrasek\Data aplikací\PriceGong\Data\z.xml
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-10 do 2011-03-10 )))))))))))))))))))))))))))))))
.
.
2011-03-10 20:18 . 2011-03-10 20:18 -------- d-----w- c:\documents and settings\Ondrasek\Data aplikací\Malwarebytes
2011-03-10 20:18 . 2011-03-10 20:18 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-10 20:18 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-10 20:18 . 2011-03-10 20:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-10 20:18 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-07 17:38 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2011-03-07 17:38 . 2007-07-19 17:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2011-03-06 15:35 . 2011-03-06 15:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\regid.1986-12.com.adobe
2011-03-06 13:58 . 2011-03-06 14:41 1228384 ----a-w- C:\PremiereElements_9_LS15.exe
2011-03-06 13:52 . 2011-03-07 17:43 -------- d-----w- c:\program files\FreeTime
2011-02-28 19:59 . 2011-03-05 11:09 -------- d-----w- c:\documents and settings\Ondrasek\Local Settings\Data aplikací\Google
2011-02-17 14:16 . 2011-02-17 14:16 -------- d-----w- c:\documents and settings\Ondrasek\Data aplikací\Search Settings
2011-02-17 14:16 . 2011-03-10 20:45 -------- d-----w- c:\program files\Application Updater
2011-02-17 14:16 . 2011-02-17 14:16 -------- d-----w- c:\program files\CENZURA Toolbar
2011-02-12 18:48 . 2011-02-13 15:04 -------- d-----w- c:\program files\PokerStars.NET
2011-02-11 22:13 . 2011-02-11 22:13 -------- d-----w- c:\documents and settings\Ondrasek\Data aplikací\Ashampoo
2011-02-11 22:13 . 2011-02-11 22:13 -------- d-----w- c:\documents and settings\Ondrasek\Local Settings\Data aplikací\ashampoo
2011-02-11 22:13 . 2011-02-11 22:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ashampoo
2011-02-11 22:13 . 2011-02-11 22:13 -------- d-----w- c:\program files\Ashampoo
2011-02-09 21:32 . 2011-02-09 21:32 -------- d-----w- c:\documents and settings\Ondrasek\Local Settings\Data aplikací\HP
2011-02-09 21:32 . 2011-02-10 21:44 -------- d-----w- c:\documents and settings\Ondrasek\Local Settings\Data aplikací\ApplicationHistory
2011-02-09 13:53 . 2011-02-09 13:53 270848 -c----w- c:\windows\system32\dllcache\sbe.dll
2011-02-09 13:53 . 2011-02-09 13:53 186880 -c----w- c:\windows\system32\dllcache\encdec.dll
2011-02-09 09:08 . 2011-02-09 09:09 -------- d-----w- c:\program files\Common Files\HP
2011-02-09 09:07 . 2011-02-09 09:07 -------- d-----w- c:\program files\Hewlett-Packard
2011-02-09 09:07 . 2011-02-09 09:07 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2011-02-09 09:06 . 2011-02-09 09:06 -------- d-----w- c:\windows\system32\URTTEMP
2011-02-09 09:05 . 2008-04-13 18:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2011-02-09 09:05 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2011-02-09 09:04 . 2004-09-29 11:08 61440 ----a-w- c:\windows\system32\HPZinw12.exe
2011-02-09 09:04 . 2004-09-29 11:15 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2011-02-09 09:04 . 2004-09-29 11:14 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2011-02-09 09:04 . 2004-09-29 11:12 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2011-02-09 09:04 . 2004-09-29 11:09 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2011-02-09 09:04 . 2004-09-29 11:09 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2011-02-09 09:04 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2011-02-09 09:04 . 2011-02-09 09:10 -------- d-----w- c:\program files\HP
2011-02-09 09:02 . 2004-12-15 09:04 51120 ----a-w- c:\windows\system32\drivers\HPZid412.sys
2011-02-09 09:02 . 2004-12-15 09:04 21744 ----a-w- c:\windows\system32\drivers\HPZius12.sys
2011-02-09 09:02 . 2004-12-15 09:04 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
2011-02-09 09:02 . 2004-12-15 09:04 581632 ----a-w- c:\windows\system32\hpotscl.dll
2011-02-09 09:02 . 2004-12-15 09:04 278528 ----a-w- c:\windows\system32\hpgwiamd.dll
2011-02-09 09:02 . 2004-12-15 09:04 229376 ----a-w- c:\windows\system32\hpovst08.dll
2011-02-09 09:02 . 2004-12-15 09:04 274432 ----a-w- c:\windows\system32\HPZc3212.dll
2011-02-09 09:02 . 2004-12-15 09:04 139345 ----a-w- c:\windows\system32\hpzlnt12.dll
2011-02-09 09:02 . 2004-12-15 09:04 196608 ----a-w- c:\windows\system32\hpzcoi12.dll
2011-02-09 09:02 . 2004-12-15 09:04 393216 ----a-w- c:\windows\system32\hpzcon12.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2004-08-17 13:49 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-17 13:49 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2010-12-18 17:11 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2010-12-18 17:11 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-17 13:49 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-19 08:26 . 2011-01-19 08:26 86016 ----a-w- c:\windows\system32\frapsvid.dll
2011-01-13 08:47 . 2010-12-18 17:45 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-12-18 17:45 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-12-18 17:45 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-12-18 17:45 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-12-18 17:45 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-12-18 17:45 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-12-18 17:45 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-12-18 17:45 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-07 14:09 . 2004-08-17 13:48 290048 ----a-w- c:\windows\system32\atmfd.dll
2011-01-03 18:41 . 2011-01-03 18:41 388096 ----a-r- c:\documents and settings\Ondrasek\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-31 20:06 . 2010-12-18 17:45 38848 ----a-w- c:\windows\avastSS.scr
2010-12-31 14:04 . 2004-08-17 13:44 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-17 13:49 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 22:14 . 2004-08-17 13:49 668160 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 22:14 . 2004-08-03 20:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-12-20 22:14 . 2004-08-17 13:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-12-20 22:13 . 2004-08-17 13:44 370176 ----a-w- c:\windows\system32\html.iec
2010-12-20 19:06 . 2010-12-20 19:06 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-12-20 17:25 . 2004-08-17 13:49 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-18 18:24 . 2010-12-18 18:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-12-18 18:24 . 2010-12-18 18:24 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-12-18 18:01 . 2010-12-18 18:01 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 16262656]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Rychlé spuštění aplikace HP Image Zone.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk
backup=c:\windows\pss\Rychlé spuštění aplikace HP Image Zone.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-15 20:02 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
2010-07-10 12:56 1015808 ----a-w- c:\program files\Ares\Ares.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Badoo Desktop]
2010-10-29 12:55 983552 ----a-w- c:\documents and settings\All Users\Data aplikací\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-09-13 14:49 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1041:TCP"= 1041:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.12.2010 19:01 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [18.12.2010 18:45 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.12.2010 18:45 17744]
S3 ewdmaudn;ewdmaudn;\??\c:\docume~1\Ondrasek\LOCALS~1\Temp\ewdmaudn.sys --> c:\docume~1\Ondrasek\LOCALS~1\Temp\ewdmaudn.sys [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com?o=14597&l=dis
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath - c:\documents and settings\Ondrasek\Data aplikací\Mozilla\Firefox\Profiles\b3cst8di.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... 2475029&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - %profile%\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: MyAshampoo Community Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-10 22:00
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2011-03-10 22:01:47
ComboFix-quarantined-files.txt 2011-03-10 21:01
.
Před spuštěním: Volných bajtů: 51 812 388 864
Po spuštění: Volných bajtů: 55 733 415 936
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - D25F41EC8543FCA3E48446F7D982F9A3

[Žbeky]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll:

Driver::
ewdmaudn

File::
c:\docume~1\Ondrasek\LOCALS~1\Temp\ewdmaudn.sys

DDS::
uStart Page = hxxp://eu.ask.com?o=14597&l=dis

Firefox::
FF - ProfilePath - c:\documents and settings\Ondrasek\Data aplikací\Mozilla\Firefox\Profiles\b3cst8di.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... 2475029&q=
FF - Ext: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - %profile%\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: MyAshampoo Community Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu