Samovolně se vypisují znaky Vyřešeno

[credo]

Dobrý den, téměř denně se počítač (mám Windows 7) podivně chová - ve všech možných okéncích (např. okénko po kliknutí na Start, nebo okénko ve Firefoxu/MSIE pro vyhledávání, formulořová okénka na webech) samovolně a velmi rychle vypisují znaky, např. hvězdičky ***************************** nebo čtyřky 44444444444444444444444444.

Nejde to zastavit, ani vypsané znaky smazat, musím restartovat počítač. Pak je po zbbytek dne klid, ale následující den zase.

Samozřejmě mám podezření na virus, ale můj antivir Comodo nic nenašel, zkoušel jsem CCleaner, Emsisoft Emergency Kit, Norton Power Eraser, Ad-aware a různé free online skanery.

Čím to může být?



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:18:11, on 28.6.2011
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Software602\Print2PDF\Print2PDF.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\HijackThis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nmd.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Print2PDF Print Monitor] "C:\Program Files\Software602\Print2PDF\Print2PDF.exe" /server
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - Startup: cfp.lnk = C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
O4 - Global Startup: Canon LBP2900 Status Window.lnk = C:\Windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix:
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll PGPmapih.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: COMODO Internet Security Helper Service (cmdagent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 6611 bytes

[Reklama]

[memphisto]

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[credo]

Provedeno, pane. A něco to našlo.




Malwarebytes' Anti-Malware 1.51.0.1200
http://www.malwarebytes.org

Verze databáze: 6967

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

28.6.2011 16:29:32
mbam-log-2011-06-28 (16-29-27).txt

Typ: Rychlá kontrola
Kontrolované objekty: 152993
Uplynulý čas: 5 minut, 47 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 3
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\5GUTNY6MFK (Trojan.FakeAlert.SA) -> No action taken.
HKEY_CURRENT_USER\Software\R8388QA8U8 (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[memphisto]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[credo]

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Verze databáze: 6968

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

28.6.2011 19:33:49
mbam-log-2011-06-28 (19-33-49).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 453779
Uplynulý čas: 1 hodin, 1 minut, 10 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 3
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\5GUTNY6MFK (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\R8388QA8U8 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[credo]

ComboFix 11-06-27.04 - Uzivatel 28.06.2011 19:43:59.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2012.1274 [GMT 2:00]
Spuštěný z: c:\users\Uzivatel\Desktop\ComboFix.exe
AV: COMODO Antivirus *Enabled/Updated* {7554F4C5-5EC0-2FC6-8192-8DF831DBED51}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Uzivatel\AppData\Roaming\.#
c:\users\Uzivatel\AppData\Roaming\.#\MBX@C28@13F2790.###
c:\users\Uzivatel\AppData\Roaming\.#\MBX@C28@13F27C0.###
.
----- BITS: Možné infikované stránky -----
.
hxxp://apnmedia.ask.com
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-28 do 2011-06-28 )))))))))))))))))))))))))))))))
.
.
2011-06-28 17:55 . 2011-06-28 17:58 -------- d-----w- c:\users\Uzivatel\AppData\Local\temp
2011-06-28 17:55 . 2011-06-28 17:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-28 14:19 . 2011-06-28 14:19 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\Malwarebytes
2011-06-28 07:50 . 2011-06-28 07:56 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\.dsgui
2011-06-28 07:50 . 2011-06-28 07:50 -------- d-----w- c:\program files\dsgui
2011-06-26 17:54 . 2011-06-26 17:54 -------- d-----w- c:\users\Uzivatel\AppData\Local\ElevatedDiagnostics
2011-06-25 09:30 . 2011-06-25 09:30 -------- d-----w- c:\program files\Mozilla Thunderbird
2011-06-22 18:14 . 2011-06-22 18:14 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 18:14 . 2011-06-22 18:14 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 17:48 . 2011-06-22 17:48 -------- d-----w- c:\program files\Apple Software Update
2011-06-22 17:47 . 2011-06-22 17:48 -------- d-----w- c:\program files\iTunes
2011-06-22 17:47 . 2011-06-22 17:47 -------- d-----w- c:\program files\iPod
2011-06-21 15:26 . 2011-06-21 18:14 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\FileZilla
2011-06-21 15:25 . 2011-06-21 15:25 -------- d-----w- c:\program files\FileZilla FTP Client
2011-06-20 15:45 . 2011-06-20 15:45 -------- d-----w- c:\users\Uzivatel\AppData\Local\DDMSettings
2011-06-20 15:44 . 2011-06-21 15:47 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\DivX
2011-06-20 15:44 . 2011-06-20 15:44 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2011-06-20 15:43 . 2011-06-20 15:44 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-06-20 15:41 . 2011-06-20 15:44 -------- d-----w- c:\program files\DivX
2011-06-20 15:39 . 2011-06-20 15:44 -------- d-----w- c:\programdata\DivX
2011-06-15 23:22 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-15 23:22 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 23:22 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-15 22:44 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-15 22:44 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 22:44 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 22:44 . 2011-04-25 04:31 1290624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-15 22:44 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 22:44 . 2011-02-25 05:34 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-15 22:44 . 2011-05-03 04:30 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-15 22:44 . 2011-04-27 02:17 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 22:44 . 2011-04-27 02:17 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 22:44 . 2011-04-27 02:17 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\programdata\PDF Writer
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\PDF Writer
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\users\Uzivatel\AppData\Local\PDF Writer
2011-06-07 11:29 . 2011-06-07 11:29 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\gtk-2.0
2011-06-07 11:28 . 2011-06-07 11:28 -------- d-----w- c:\users\Uzivatel\.thumbnails
2011-06-07 11:24 . 2011-06-21 21:39 -------- d-----w- c:\users\Uzivatel\.gimp-2.6
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files\Mozilla Firefox\Plugins\nppdf32.dll
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-04 10:39 . 2011-06-25 15:10 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\CoreFTP
2011-06-04 10:39 . 2011-06-21 15:21 -------- d-----w- c:\program files\CoreFTP
2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-18 10:57 . 2011-05-17 15:22 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-29 07:11 . 2011-05-13 16:37 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-05-13 16:37 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-13 20:17 . 2011-05-13 19:37 148416 ----a-w- c:\windows\system32\PGPlspRollback.reg
2011-05-12 21:52 . 2011-05-12 21:52 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-05-10 13:49 . 2011-04-13 18:30 82400 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-05-08 19:23 . 2011-05-08 19:23 231248 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2011-05-08 10:53 . 2011-05-08 10:53 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-05-08 10:53 . 2011-05-08 10:53 161792 ----a-w- c:\windows\system32\msls31.dll
2011-05-08 10:53 . 2011-05-08 10:53 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-05-08 10:53 . 2011-05-08 10:53 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-05-08 10:53 . 2011-05-08 10:53 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-05-08 10:53 . 2011-05-08 10:53 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-05-08 10:53 . 2011-05-08 10:53 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-05-08 10:53 . 2011-05-08 10:53 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-05-08 10:53 . 2011-05-08 10:53 367104 ----a-w- c:\windows\system32\html.iec
2011-05-08 10:53 . 2011-05-08 10:53 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-05-08 10:53 . 2011-05-08 10:53 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-05-08 10:53 . 2011-05-08 10:53 152064 ----a-w- c:\windows\system32\wextract.exe
2011-05-08 10:53 . 2011-05-08 10:53 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-05-08 10:53 . 2011-05-08 10:53 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-05-08 10:53 . 2011-05-08 10:53 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-05-08 10:53 . 2011-05-08 10:53 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-05-08 10:53 . 2011-05-08 10:53 11776 ----a-w- c:\windows\system32\mshta.exe
2011-05-08 10:53 . 2011-05-08 10:53 101888 ----a-w- c:\windows\system32\admparse.dll
2011-05-08 10:53 . 2011-05-08 10:53 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-05-07 17:55 . 2011-05-07 17:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-06 09:24 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-02 18:36 . 2011-05-02 18:36 37592 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-02 18:36 . 2011-05-02 18:36 238960 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-02 18:36 . 2011-05-02 18:36 19088 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-02 18:36 . 2011-05-02 18:36 284744 ----a-w- c:\windows\system32\guard32.dll
2011-04-29 10:12 . 2011-05-12 21:36 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-04-27 13:47 . 2011-05-16 19:22 23376 ----a-w- c:\windows\system32\dopdfmn7.dll
2011-04-27 13:47 . 2011-05-16 19:22 20816 ----a-w- c:\windows\system32\dopdfmi7.dll
2011-04-22 19:14 . 2011-05-25 07:29 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-04-19 05:35 . 2011-04-19 05:35 687616 ----a-w- c:\windows\yowindow.scr
2011-04-18 07:15 . 2011-05-06 09:41 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E6641860-D4A3-4A3E-947C-0DD9EEA08F47}\mpengine.dll
2011-04-09 06:02 . 2011-05-11 09:20 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 09:20 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-12 19:45 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-06-22 18:14 . 2011-05-06 21:39 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHandlerAccessible]
@="{3DBF5F01-3287-46EB-82CF-45AA5C241162}"
[HKEY_CLASSES_ROOT\CLSID\{3DBF5F01-3287-46EB-82CF-45AA5C241162}]
2011-01-12 19:42 1056888 ----a-w- c:\windows\System32\PGPfsshl.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF30386.cfxxe" [X]
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-01-30 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-01-30 821144]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
c:\users\Uzivatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
cfp.lnk - c:\program files\COMODO\COMODO Internet Security\cfp.exe [2011-5-2 2552648]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP2900 Status Window.lnk - c:\windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE [2011-5-8 50848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll c:\windows\System32\PGPmapih.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Persistence"=c:\windows\system32\igfxpers.exe
"IgfxTray"=c:\windows\system32\igfxtray.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" -h
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ATP;Comodo EasyVPN Miniport Driver;c:\windows\system32\DRIVERS\cmdatp.sys [2010-12-13 17816]
R3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;c:\users\Uzivatel\AppData\Local\Temp\OnlineScanner\Anti-Virus\fsgk.sys [x]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-04-29 15232]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-06 1343400]
R4 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-21 814344]
R4 CrdphService;COMODO EasyVPN VNC Service;c:\program files\COMODO\EasyVPN\crdphService.exe [2010-11-23 495920]
R4 EasyVpnAdpt;COMODO EasyVPN Service;c:\program files\COMODO\EasyVPN\Vpnservice.exe [2010-12-14 119088]
R4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-05-16 2151128]
R4 Nomad;Connection Manager;c:\program files\Avanquest\Avanquest Connection Manager\NomadSvr.exe [2010-02-02 33536]
R4 PGP RDD Service;PGP RDD Service;c:\program files\PGP Corporation\PGP Desktop\RDDService.exe [2011-01-12 166520]
R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-04-19 993848]
R4 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 75353322;75353322 Boot Guard Driver;c:\windows\system32\DRIVERS\75353322.sys [2009-10-22 37392]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-04-29 64512]
S0 pgpfs;PGP File Sharing;c:\windows\System32\Drivers\PGPfsfd.sys [2011-01-12 136824]
S0 Pgpwdefs;Pgpwdefs;c:\windows\system32\DRIVERS\Pgpwdefs.sys [2011-01-12 13432]
S1 75353321;75353321;c:\windows\system32\DRIVERS\75353321.sys [2009-09-25 128016]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-05-02 19088]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-05-02 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-05-02 37592]
S2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-01-26 337512]
.
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\PGPlsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Uzivatel\AppData\Roaming\Mozilla\Firefox\Profiles\kq8bz45d.default\
FF - prefs.js: browser.startup.homepage - file:///C:/DISK/NastavenĂ­/start.html
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(644)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.EXE'(2416)
c:\windows\system32\guard32.dll
c:\windows\System32\PGPfsshl.dll
c:\windows\System32\wer.dll
.
Celkový čas: 2011-06-28 20:08:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-28 18:08
.
Před spuštěním: Volných bajtů: 140 892 516 352
Po spuštění: Volných bajtů: 140 716 716 032
.
- - End Of File - - 6814F16E5139E6BDCFB46576B65DA74E

[Žbeky]

Odinstaluj Lavasoft Ad-Watch a F-Secure

Používáš PGP?

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=-
"ConsentPromptBehaviorUser"=-
"EnableLUA"=-
"EnableUIADesktopToggle"=-
"PromptOnSecureDesktop"=-

DDS::
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local

Firefox::
FF - ProfilePath - c:\users\Uzivatel\AppData\Roaming\Mozilla\Firefox\Profiles\kq8bz45d.default\
FF - prefs.js: browser.startup.homepage - file:///C:/DISK/NastavenĂ/start.html

RegLock::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\PCW\Security]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[credo]

Zeptám se, jak odinstalovat samostatně Ad-Watch, aniž bych musel odinstalovat Ad-aware ?

F-Secure je jen prázdná složka, která se vytvořila po použití F-Secure Online Scanner, ale smazal jsem jí.

PGP se chystám používat, tak bych ho zatím na kompu ponechal, pokud něčemu nepřekáží.

[Žbeky]

Jasně, PGP jsem se jen ptal.

Odinstaluj celý Ad-Aware

[credo]

Učinil jsem, ale po procesu s CFScript.txt se žádný log nevytvořil, ani neuložil na C:

[Žbeky]

Y proběhl celý? Kdyžtak udělej scan bez skriptu

[credo]

ComboFix 11-06-28.04 - Uzivatel 28.06.2011 21:46:07.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2012.1227 [GMT 2:00]
Spuštěný z: c:\users\Uzivatel\Desktop\ComboFix.exe
AV: COMODO Antivirus *Enabled/Updated* {7554F4C5-5EC0-2FC6-8192-8DF831DBED51}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-28 do 2011-06-28 )))))))))))))))))))))))))))))))
.
.
2011-06-28 19:57 . 2011-06-28 19:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-28 17:55 . 2011-06-28 19:57 -------- d-----w- c:\users\Uzivatel\AppData\Local\temp
2011-06-28 14:19 . 2011-06-28 14:19 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\Malwarebytes
2011-06-28 07:50 . 2011-06-28 07:56 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\.dsgui
2011-06-28 07:50 . 2011-06-28 07:50 -------- d-----w- c:\program files\dsgui
2011-06-26 17:54 . 2011-06-26 17:54 -------- d-----w- c:\users\Uzivatel\AppData\Local\ElevatedDiagnostics
2011-06-25 09:30 . 2011-06-25 09:30 -------- d-----w- c:\program files\Mozilla Thunderbird
2011-06-22 18:14 . 2011-06-22 18:14 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 18:14 . 2011-06-22 18:14 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 17:48 . 2011-06-22 17:48 -------- d-----w- c:\program files\Apple Software Update
2011-06-22 17:47 . 2011-06-22 17:48 -------- d-----w- c:\program files\iTunes
2011-06-22 17:47 . 2011-06-22 17:47 -------- d-----w- c:\program files\iPod
2011-06-21 15:26 . 2011-06-21 18:14 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\FileZilla
2011-06-21 15:25 . 2011-06-21 15:25 -------- d-----w- c:\program files\FileZilla FTP Client
2011-06-20 15:45 . 2011-06-20 15:45 -------- d-----w- c:\users\Uzivatel\AppData\Local\DDMSettings
2011-06-20 15:44 . 2011-06-21 15:47 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\DivX
2011-06-20 15:44 . 2011-06-20 15:44 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2011-06-20 15:43 . 2011-06-20 15:44 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-06-20 15:41 . 2011-06-20 15:44 -------- d-----w- c:\program files\DivX
2011-06-20 15:39 . 2011-06-20 15:44 -------- d-----w- c:\programdata\DivX
2011-06-15 23:22 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-15 23:22 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 23:22 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-15 22:44 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-15 22:44 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 22:44 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 22:44 . 2011-04-25 04:31 1290624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-15 22:44 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 22:44 . 2011-02-25 05:34 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-15 22:44 . 2011-05-03 04:30 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-15 22:44 . 2011-04-27 02:17 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 22:44 . 2011-04-27 02:17 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 22:44 . 2011-04-27 02:17 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\programdata\PDF Writer
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\PDF Writer
2011-06-14 19:22 . 2011-06-14 19:22 -------- d-----w- c:\users\Uzivatel\AppData\Local\PDF Writer
2011-06-07 11:29 . 2011-06-07 11:29 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\gtk-2.0
2011-06-07 11:28 . 2011-06-07 11:28 -------- d-----w- c:\users\Uzivatel\.thumbnails
2011-06-07 11:24 . 2011-06-21 21:39 -------- d-----w- c:\users\Uzivatel\.gimp-2.6
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files\Mozilla Firefox\Plugins\nppdf32.dll
2011-06-06 10:55 . 2011-06-06 10:55 183696 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-04 10:39 . 2011-06-25 15:10 -------- d-----w- c:\users\Uzivatel\AppData\Roaming\CoreFTP
2011-06-04 10:39 . 2011-06-21 15:21 -------- d-----w- c:\program files\CoreFTP
2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-18 10:57 . 2011-05-17 15:22 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-29 07:11 . 2011-05-13 16:37 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-05-13 16:37 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-13 20:17 . 2011-05-13 19:37 148416 ----a-w- c:\windows\system32\PGPlspRollback.reg
2011-05-12 21:52 . 2011-05-12 21:52 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-05-10 13:49 . 2011-04-13 18:30 82400 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-05-08 19:23 . 2011-05-08 19:23 231248 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2011-05-08 10:53 . 2011-05-08 10:53 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-05-08 10:53 . 2011-05-08 10:53 161792 ----a-w- c:\windows\system32\msls31.dll
2011-05-08 10:53 . 2011-05-08 10:53 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-05-08 10:53 . 2011-05-08 10:53 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-05-08 10:53 . 2011-05-08 10:53 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-05-08 10:53 . 2011-05-08 10:53 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-05-08 10:53 . 2011-05-08 10:53 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-05-08 10:53 . 2011-05-08 10:53 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-05-08 10:53 . 2011-05-08 10:53 367104 ----a-w- c:\windows\system32\html.iec
2011-05-08 10:53 . 2011-05-08 10:53 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-05-08 10:53 . 2011-05-08 10:53 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-05-08 10:53 . 2011-05-08 10:53 152064 ----a-w- c:\windows\system32\wextract.exe
2011-05-08 10:53 . 2011-05-08 10:53 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-05-08 10:53 . 2011-05-08 10:53 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-05-08 10:53 . 2011-05-08 10:53 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-05-08 10:53 . 2011-05-08 10:53 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-05-08 10:53 . 2011-05-08 10:53 11776 ----a-w- c:\windows\system32\mshta.exe
2011-05-08 10:53 . 2011-05-08 10:53 101888 ----a-w- c:\windows\system32\admparse.dll
2011-05-08 10:53 . 2011-05-08 10:53 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-05-07 17:55 . 2011-05-07 17:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-06 09:24 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-02 18:36 . 2011-05-02 18:36 37592 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-02 18:36 . 2011-05-02 18:36 238960 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-02 18:36 . 2011-05-02 18:36 19088 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-02 18:36 . 2011-05-02 18:36 284744 ----a-w- c:\windows\system32\guard32.dll
2011-04-27 13:47 . 2011-05-16 19:22 23376 ----a-w- c:\windows\system32\dopdfmn7.dll
2011-04-27 13:47 . 2011-05-16 19:22 20816 ----a-w- c:\windows\system32\dopdfmi7.dll
2011-04-22 19:14 . 2011-05-25 07:29 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-04-19 05:35 . 2011-04-19 05:35 687616 ----a-w- c:\windows\yowindow.scr
2011-04-18 07:15 . 2011-05-06 09:41 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E6641860-D4A3-4A3E-947C-0DD9EEA08F47}\mpengine.dll
2011-04-09 06:02 . 2011-05-11 09:20 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 09:20 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-12 19:45 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-06-22 18:14 . 2011-05-06 21:39 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHandlerAccessible]
@="{3DBF5F01-3287-46EB-82CF-45AA5C241162}"
[HKEY_CLASSES_ROOT\CLSID\{3DBF5F01-3287-46EB-82CF-45AA5C241162}]
2011-01-12 19:42 1056888 ----a-w- c:\windows\System32\PGPfsshl.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-01-30 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-01-30 821144]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
c:\users\Uzivatel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
cfp.lnk - c:\program files\COMODO\COMODO Internet Security\cfp.exe [2011-5-2 2552648]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP2900 Status Window.lnk - c:\windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE [2011-5-8 50848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll c:\windows\System32\PGPmapih.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Persistence"=c:\windows\system32\igfxpers.exe
"IgfxTray"=c:\windows\system32\igfxtray.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" -h
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ATP;Comodo EasyVPN Miniport Driver;c:\windows\system32\DRIVERS\cmdatp.sys [2010-12-13 17816]
R3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;c:\users\Uzivatel\AppData\Local\Temp\OnlineScanner\Anti-Virus\fsgk.sys [x]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-06 1343400]
R4 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-21 814344]
R4 CrdphService;COMODO EasyVPN VNC Service;c:\program files\COMODO\EasyVPN\crdphService.exe [2010-11-23 495920]
R4 EasyVpnAdpt;COMODO EasyVPN Service;c:\program files\COMODO\EasyVPN\Vpnservice.exe [2010-12-14 119088]
R4 Nomad;Connection Manager;c:\program files\Avanquest\Avanquest Connection Manager\NomadSvr.exe [2010-02-02 33536]
R4 PGP RDD Service;PGP RDD Service;c:\program files\PGP Corporation\PGP Desktop\RDDService.exe [2011-01-12 166520]
R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-04-19 993848]
R4 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 75353322;75353322 Boot Guard Driver;c:\windows\system32\DRIVERS\75353322.sys [2009-10-22 37392]
S0 pgpfs;PGP File Sharing;c:\windows\System32\Drivers\PGPfsfd.sys [2011-01-12 136824]
S0 Pgpwdefs;Pgpwdefs;c:\windows\system32\DRIVERS\Pgpwdefs.sys [2011-01-12 13432]
S1 75353321;75353321;c:\windows\system32\DRIVERS\75353321.sys [2009-09-25 128016]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-05-02 19088]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-05-02 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-05-02 37592]
S2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-01-26 337512]
.
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\PGPlsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Uzivatel\AppData\Roaming\Mozilla\Firefox\Profiles\kq8bz45d.default\
FF - prefs.js: browser.startup.homepage - file:///C:/DISK/NastavenĂ­/start.html
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3729811209-4125857792-1357355276-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v40po\UserChoice]
@Denied: (2) (S-1-5-21-3729811209-4125857792-1357355276-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.v40po"
.
[HKEY_USERS\S-1-5-21-3729811209-4125857792-1357355276-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v40pp\UserChoice]
@Denied: (2) (S-1-5-21-3729811209-4125857792-1357355276-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.v40pp"
.
[HKEY_USERS\S-1-5-21-3729811209-4125857792-1357355276-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v40ppf\UserChoice]
@Denied: (2) (S-1-5-21-3729811209-4125857792-1357355276-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.v40ppf"
.
[HKEY_USERS\S-1-5-21-3729811209-4125857792-1357355276-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (S-1-5-21-3729811209-4125857792-1357355276-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.xmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(644)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(2944)
c:\windows\system32\guard32.dll
c:\windows\System32\PGPfsshl.dll
c:\windows\System32\wer.dll
.
Celkový čas: 2011-06-28 22:05:55
ComboFix-quarantined-files.txt 2011-06-28 20:05
.
Před spuštěním: Volných bajtů: 140 595 236 864
Po spuštění: Volných bajtů: 140 360 032 256
.
- - End Of File - - 1008CE4453D14E0A4CCE950DA9DA3F7E