PC-HELP.CZ

Prosím o kontrolu logu, Děkuji.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:25:53, on 26.2.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Xfire\Xfire.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com/?l=dis&o=14672
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [AutoKMS] C:\Windows\AutoKMS.exe
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\Windows\is-F7H2J.exe" /REG /REGSVRMODE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Korba\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [HKCU] C:\Users\Korba\AppData\Roaming\Help\svchost.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: ObjectDockShellExt - {1984D045-52CF-49cd-DB77-08F378FEA4DB} - C:\Program Files\Stardock\ObjectDockFree\ODMenu.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

--
End of file - 6663 bytes

Fixni:
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
- Pokud používáš Firefox, klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Chrome, nic dalšího nevybírej a dej Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(ZATÍM SÁM NIC NEMAŽ!).
Vlož sem pak obsah toho logu.

Zde přikládám kontrolu.

Malwarebytes Anti-Malware (PRO) 1.60.1.1000
www.malwarebytes.org

Verze databáze: v2012.02.25.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Mirek :: POKOJ-PC [administrátor]

Ochrana: Povolena

26.2.2012 15:21:58
mbam-log-2012-02-26 (15-28-52).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 230697
Uplynulý čas: 6 minut, 9 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 4
C:\Users\Korba\AppData\Local\Temp\WpeSpy.dll (HackTool.Sniffer.WpePro) -> Žádná instrukce nebyla provedena.
C:\Users\Korba\AppData\Roaming\logs.dat (Bifrose.Trace) -> Žádná instrukce nebyla provedena.
C:\Users\Korba\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Žádná instrukce nebyla provedena.
C:\Users\Korba\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Žádná instrukce nebyla provedena.

(konec)

Znovu spusť MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

ComboFix 12-02-25.02 - Mirek 26.02.2012 21:21:49.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2048.835 [GMT 1:00]
Spuštěný z: c:\users\Mirek\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Korba\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2B222318-6FD0-4609-817A-27240EDB2A27}.xps
c:\users\Korba\AppData\Roaming\Dropbox.exe
c:\users\Korba\AppData\Roaming\Microsoft\Windows\Templates\IedFm.exe.exe
c:\windows\isRS-000.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-26 do 2012-02-26 )))))))))))))))))))))))))))))))
.
.
2012-02-26 20:30 . 2012-02-26 20:31 -------- d-----w- c:\users\Korba\AppData\Local\temp
2012-02-26 20:30 . 2012-02-26 20:30 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-26 20:30 . 2012-02-26 20:30 -------- d-----w- c:\users\Rodiče\AppData\Local\temp
2012-02-26 20:30 . 2012-02-26 20:30 -------- d-----w- c:\users\Jarka\AppData\Local\temp
2012-02-26 20:30 . 2012-02-26 20:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-26 20:16 . 2012-02-26 20:16 54016 ----a-w- c:\windows\system32\drivers\nfjrpijd.sys
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Ahead
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Adobe
2012-02-26 14:44 . 2012-02-26 14:44 151552 ----a-w- c:\windows\system32\nvRegDev.dll
2012-02-26 14:44 . 2003-11-10 17:12 192512 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2012-02-26 14:44 . 2003-11-10 17:14 729088 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2012-02-26 14:44 . 2003-11-10 17:13 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2012-02-26 14:44 . 2003-11-10 17:12 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2012-02-26 14:44 . 2003-11-10 17:11 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2012-02-26 14:44 . 2012-02-26 14:44 311428 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2012-02-26 14:44 . 2012-02-26 14:44 188548 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2012-02-26 14:43 . 2012-02-26 15:17 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-02-26 14:42 . 2012-02-26 14:42 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3E65F9D-7C78-4C32-86A2-0AAAF451E63E}\offreg.dll
2012-02-26 14:39 . 2012-02-26 14:39 -------- d-----w- c:\program files\Adobe Media Player
2012-02-26 14:37 . 2012-02-26 14:37 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-02-26 14:32 . 2012-02-26 15:40 -------- d-----w- c:\users\Korba\AppData\Local\Adobe
2012-02-26 10:10 . 2012-02-26 10:10 -------- d-----w- c:\program files\Cheat Engine 6.1
2012-02-25 18:38 . 2012-02-25 18:38 -------- d-----w- c:\program files\RocketDock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\ODUI
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\Stardock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Roaming\Stardock
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\users\Korba\AppData\Roaming\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\programdata\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:26 -------- d-----w- c:\program files\Screaming Bee
2012-02-24 19:37 . 2012-02-20 00:05 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3E65F9D-7C78-4C32-86A2-0AAAF451E63E}\mpengine.dll
2012-02-24 17:52 . 2012-02-24 17:54 -------- d-----w- c:\program files\Google
2012-02-21 20:38 . 2012-02-21 20:53 -------- d-----w- c:\users\Korba\AppData\Roaming\TeamViewer
2012-02-21 20:37 . 2012-02-21 20:37 -------- d-----w- c:\program files\TeamViewer
2012-02-19 21:04 . 2009-04-06 08:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2012-02-19 21:04 . 2009-04-06 08:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2012-02-19 20:43 . 2012-02-19 20:43 -------- d-----w- c:\program files\NCsoft
2012-02-19 10:39 . 2012-02-19 10:39 1060864 ----a-w- c:\windows\system32\mfc71.dll
2012-02-19 10:36 . 2012-02-19 10:38 -------- d-----w- c:\users\Korba\AppData\Local\Rockstar Games
2012-02-19 10:34 . 2012-02-19 10:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-02-19 10:09 . 2012-02-19 10:11 -------- d-----w- c:\program files\Rockstar Games
2012-02-19 10:06 . 2012-02-19 10:06 -------- d-----w- c:\windows\system32\xlive
2012-02-19 10:06 . 2012-02-19 10:07 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2012-02-16 17:19 . 2012-02-16 17:19 -------- d-----w- c:\users\Korba\AppData\Local\BigHugeEngine
2012-02-16 16:01 . 2012-02-16 16:01 -------- d-----w- c:\users\Korba\AppData\Local\CrashRpt
2012-02-16 16:00 . 2012-02-16 16:03 -------- d-----w- C:\KAG
2012-02-15 20:29 . 2012-02-15 20:29 -------- d-----w- c:\program files\Recuva
2012-02-15 20:00 . 2012-02-15 20:00 -------- d-----w- c:\program files\GamePark
2012-02-15 17:07 . 2012-02-15 17:07 615936 ----a-w- c:\windows\AutoKMS.exe
2012-02-15 12:01 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-15 12:01 . 2012-01-04 08:58 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-15 12:01 . 2011-12-16 07:52 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-15 12:00 . 2012-01-14 03:35 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-02-10 22:38 . 2012-02-10 22:38 42392 ----a-w- c:\windows\system32\xfcodec.dll
2012-02-10 21:25 . 2012-02-10 21:25 -------- d-----w- c:\programdata\McAfee
2012-02-10 20:54 . 2012-02-23 18:11 -------- d-----w- c:\program files\Common Files\Steam
2012-02-10 20:54 . 2012-02-26 18:33 -------- d-----w- c:\program files\Steam
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\users\Korba\AppData\Local\APN
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\program files\DsNET Corp
2012-02-03 19:24 . 2012-02-03 19:24 -------- d-----w- c:\program files\NEXON
2012-02-03 18:39 . 2012-02-03 18:39 -------- d-----w- c:\program files\The KMPlayer
2012-02-03 18:38 . 2012-02-03 19:18 -------- d-----w- C:\Download
2012-02-03 18:38 . 2012-02-03 18:38 235 ----a-w- c:\windows\system32\nxEuUninstall.bat
2012-02-03 18:38 . 2012-02-03 18:38 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2012-02-03 14:02 . 2012-02-21 18:31 -------- d-----w- C:\Nexon
2012-02-03 14:02 . 2012-02-19 21:15 -------- d-----w- c:\programdata\NexonUS
2012-02-03 12:41 . 2012-02-03 12:41 -------- d-----w- c:\program files\Pando Networks
2012-02-02 14:47 . 2012-02-12 14:48 -------- d-----w- c:\program files\Counter-Strike Source
2012-01-30 13:39 . 2012-01-30 13:40 -------- d-----w- c:\windows\WindowsMobile
2012-01-29 11:45 . 2012-01-29 13:09 -------- d-----w- c:\users\Korba\AppData\Roaming\wargaming.net
2012-01-29 11:26 . 2012-01-29 11:26 -------- d-----w- C:\Games
2012-01-28 12:37 . 2012-01-28 12:37 -------- d-----w- c:\users\Korba\AppData\Roaming\VitySoft
2012-01-28 10:57 . 2012-01-28 10:57 -------- d-----w- c:\users\Korba\AppData\Local\GHISLER
2012-01-28 10:56 . 2012-02-24 19:29 -------- d-----w- c:\users\Korba\AppData\Roaming\GHISLER
2012-01-28 10:56 . 2012-01-28 10:57 -------- d-----w- C:\totalcmd
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-26 19:30 . 2012-01-07 13:18 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-02-26 19:30 . 2012-01-07 14:04 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-02-26 19:30 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-02-26 15:53 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-02-10 21:26 . 2012-01-20 16:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2012-01-06 23:02 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-15 10:31 . 2012-01-15 10:31 21419 ----a-w- c:\windows\system32\drivers\AegisP.sys
2012-01-11 14:16 . 2012-01-11 14:16 239168 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-01-08 19:23 . 2012-01-07 18:04 17488 ----a-w- c:\windows\etdrv.sys
2012-01-08 19:22 . 2012-01-07 18:00 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-01-08 19:22 . 2012-01-07 17:57 17488 ----a-w- c:\windows\gdrv.sys
2012-01-08 12:02 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraiins.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraidco.dll
2012-01-07 20:57 . 2012-01-07 20:57 215656 ----a-w- c:\windows\system32\drivers\nvstor32.sys
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-01-07 13:56 . 2012-01-07 13:17 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-01-07 13:18 . 2012-01-07 13:18 22328 ----a-w- c:\users\Korba\AppData\Roaming\PnkBstrK.sys
2012-01-07 13:04 . 2012-01-07 13:04 428088 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-01-07 10:59 . 2012-01-07 10:59 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-01-07 10:59 . 2012-01-07 10:59 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-01-07 10:59 . 2012-01-07 10:59 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-01-07 10:59 . 2012-01-07 10:59 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-07 10:59 . 2012-01-07 10:59 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-01-07 10:59 . 2012-01-07 10:59 367104 ----a-w- c:\windows\system32\html.iec
2012-01-07 10:59 . 2012-01-07 10:59 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-01-07 10:59 . 2012-01-07 10:59 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-07 10:59 . 2012-01-07 10:59 161792 ----a-w- c:\windows\system32\msls31.dll
2012-01-07 10:59 . 2012-01-07 10:59 152064 ----a-w- c:\windows\system32\wextract.exe
2012-01-07 10:59 . 2012-01-07 10:59 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-01-07 10:59 . 2012-01-07 10:59 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-07 10:59 . 2012-01-07 10:59 11776 ----a-w- c:\windows\system32\mshta.exe
2012-01-07 10:59 . 2012-01-07 10:59 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-07 10:59 . 2012-01-07 10:59 101888 ----a-w- c:\windows\system32\admparse.dll
2011-12-10 14:24 . 2012-01-10 20:34 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-21 07:39 . 2012-01-15 15:52 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"Steam"="c:\program files\Steam\Steam.exe" [2012-02-10 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-08-26 10828392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"AutoKMS"="c:\windows\AutoKMS.exe" [2012-02-15 615936]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
.
c:\users\Korba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDockFree\ObjectDock.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AmIcoSinglun]
2010-05-03 12:56 237568 ----a-w- c:\program files\AmIcoSingLun\AmIcoSinglun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2008-11-14 13:35 305064 ----a-r- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 AODDriver;AODDriver; [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2012-01-08 17488]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-08-21 645120]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-07 1343400]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-01-11 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-05-03 27136]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-07-01 34896]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001Core.job
- c:\users\Korba\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-06 22:29]
.
2012-02-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001UA.job
- c:\users\Korba\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-06 22:29]
.
2012-02-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005Core.job
- c:\users\Jarka\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 19:20]
.
2012-02-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005UA.job
- c:\users\Jarka\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 19:20]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Korba\AppData\Roaming\Mozilla\Firefox\Profiles\qdopfqwa.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://eu.ask.com/?l=dis&o=14672
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SharedTaskScheduler-{1984D045-52CF-49cd-DB77-08F378FEA4DB} - c:\program files\Stardock\ObjectDockFree\ODMenu.dll
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-02-26 21:33:29
ComboFix-quarantined-files.txt 2012-02-26 20:33
.
Před spuštěním: Volných bajtů: 45 902 491 648
Po spuštění: Volných bajtů: 46 168 756 224
.
- - End Of File - - 751042C4EC5326655596C813FF2048F6







Malwarebytes Anti-Malware (PRO) 1.60.1.1000
www.malwarebytes.org

Verze databáze: v2012.02.25.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Mirek :: POKOJ-PC [administrátor]

Ochrana: Povolena

26.2.2012 21:09:46
mbam-log-2012-02-26 (21-09-46).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 231167
Uplynulý čas: 6 minut, 34 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 4
C:\Users\Korba\AppData\Local\Temp\WpeSpy.dll (HackTool.Sniffer.WpePro) -> Umístnění do karantény a smazání se zdařilo.
C:\Users\Korba\AppData\Roaming\logs.dat (Bifrose.Trace) -> Umístnění do karantény a smazání se zdařilo.
C:\Users\Korba\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Umístnění do karantény a smazání se zdařilo.
C:\Users\Korba\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Umístnění do karantény a smazání se zdařilo.

(konec)

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:24:42, on 27.2.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Korba\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Korba\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

--
End of file - 5496 bytes



ComboFix 12-02-25.02 - Mirek 27.02.2012 10:06:29.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2048.1177 [GMT 1:00]
Spuštěný z: c:\users\Korba\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Korba\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\AutoKMS.exe"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001UA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\McAfee
c:\windows\AutoKMS.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1001UA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2899535948-485185325-1835827269-1005UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-27 do 2012-02-27 )))))))))))))))))))))))))))))))
.
.
2012-02-27 09:16 . 2012-02-27 09:18 -------- d-----w- c:\users\Korba\AppData\Local\temp
2012-02-27 09:16 . 2012-02-27 09:16 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-27 09:16 . 2012-02-27 09:16 -------- d-----w- c:\users\Rodiče\AppData\Local\temp
2012-02-27 09:16 . 2012-02-27 09:16 -------- d-----w- c:\users\Jarka\AppData\Local\temp
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Ahead
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Adobe
2012-02-26 14:44 . 2012-02-26 14:44 151552 ----a-w- c:\windows\system32\nvRegDev.dll
2012-02-26 14:44 . 2003-11-10 17:12 192512 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2012-02-26 14:44 . 2003-11-10 17:14 729088 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2012-02-26 14:44 . 2003-11-10 17:13 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2012-02-26 14:44 . 2003-11-10 17:12 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2012-02-26 14:44 . 2003-11-10 17:11 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2012-02-26 14:44 . 2012-02-26 14:44 311428 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2012-02-26 14:44 . 2012-02-26 14:44 188548 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2012-02-26 14:43 . 2012-02-26 15:17 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-02-26 14:39 . 2012-02-26 14:39 -------- d-----w- c:\program files\Adobe Media Player
2012-02-26 14:37 . 2012-02-26 14:37 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-02-26 14:32 . 2012-02-26 15:40 -------- d-----w- c:\users\Korba\AppData\Local\Adobe
2012-02-26 10:10 . 2012-02-26 10:10 -------- d-----w- c:\program files\Cheat Engine 6.1
2012-02-25 18:38 . 2012-02-25 18:38 -------- d-----w- c:\program files\RocketDock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\ODUI
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\Stardock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Roaming\Stardock
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\users\Korba\AppData\Roaming\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\programdata\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:26 -------- d-----w- c:\program files\Screaming Bee
2012-02-24 19:37 . 2012-02-20 00:05 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3E65F9D-7C78-4C32-86A2-0AAAF451E63E}\mpengine.dll
2012-02-24 17:52 . 2012-02-24 17:54 -------- d-----w- c:\program files\Google
2012-02-21 20:38 . 2012-02-21 20:53 -------- d-----w- c:\users\Korba\AppData\Roaming\TeamViewer
2012-02-21 20:37 . 2012-02-21 20:37 -------- d-----w- c:\program files\TeamViewer
2012-02-19 21:04 . 2009-04-06 08:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2012-02-19 21:04 . 2009-04-06 08:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2012-02-19 20:43 . 2012-02-19 20:43 -------- d-----w- c:\program files\NCsoft
2012-02-19 10:39 . 2012-02-19 10:39 1060864 ----a-w- c:\windows\system32\mfc71.dll
2012-02-19 10:36 . 2012-02-19 10:38 -------- d-----w- c:\users\Korba\AppData\Local\Rockstar Games
2012-02-19 10:34 . 2012-02-19 10:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-02-19 10:09 . 2012-02-19 10:11 -------- d-----w- c:\program files\Rockstar Games
2012-02-19 10:06 . 2012-02-19 10:06 -------- d-----w- c:\windows\system32\xlive
2012-02-19 10:06 . 2012-02-19 10:07 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2012-02-16 17:19 . 2012-02-16 17:19 -------- d-----w- c:\users\Korba\AppData\Local\BigHugeEngine
2012-02-16 16:01 . 2012-02-16 16:01 -------- d-----w- c:\users\Korba\AppData\Local\CrashRpt
2012-02-16 16:00 . 2012-02-16 16:03 -------- d-----w- C:\KAG
2012-02-15 20:29 . 2012-02-15 20:29 -------- d-----w- c:\program files\Recuva
2012-02-15 20:00 . 2012-02-15 20:00 -------- d-----w- c:\program files\GamePark
2012-02-15 12:01 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-15 12:01 . 2012-01-04 08:58 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-15 12:01 . 2011-12-16 07:52 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-15 12:00 . 2012-01-14 03:35 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-02-10 22:38 . 2012-02-10 22:38 42392 ----a-w- c:\windows\system32\xfcodec.dll
2012-02-10 20:54 . 2012-02-23 18:11 -------- d-----w- c:\program files\Common Files\Steam
2012-02-10 20:54 . 2012-02-27 09:05 -------- d-----w- c:\program files\Steam
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\users\Korba\AppData\Local\APN
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\program files\DsNET Corp
2012-02-03 19:24 . 2012-02-03 19:24 -------- d-----w- c:\program files\NEXON
2012-02-03 18:39 . 2012-02-03 18:39 -------- d-----w- c:\program files\The KMPlayer
2012-02-03 18:38 . 2012-02-03 19:18 -------- d-----w- C:\Download
2012-02-03 18:38 . 2012-02-03 18:38 235 ----a-w- c:\windows\system32\nxEuUninstall.bat
2012-02-03 18:38 . 2012-02-03 18:38 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2012-02-03 14:02 . 2012-02-21 18:31 -------- d-----w- C:\Nexon
2012-02-03 14:02 . 2012-02-19 21:15 -------- d-----w- c:\programdata\NexonUS
2012-02-03 12:41 . 2012-02-03 12:41 -------- d-----w- c:\program files\Pando Networks
2012-02-02 14:47 . 2012-02-12 14:48 -------- d-----w- c:\program files\Counter-Strike Source
2012-01-30 13:39 . 2012-01-30 13:40 -------- d-----w- c:\windows\WindowsMobile
2012-01-29 11:45 . 2012-01-29 13:09 -------- d-----w- c:\users\Korba\AppData\Roaming\wargaming.net
2012-01-29 11:26 . 2012-01-29 11:26 -------- d-----w- C:\Games
2012-01-28 12:37 . 2012-01-28 12:37 -------- d-----w- c:\users\Korba\AppData\Roaming\VitySoft
2012-01-28 10:57 . 2012-01-28 10:57 -------- d-----w- c:\users\Korba\AppData\Local\GHISLER
2012-01-28 10:56 . 2012-02-24 19:29 -------- d-----w- c:\users\Korba\AppData\Roaming\GHISLER
2012-01-28 10:56 . 2012-01-28 10:57 -------- d-----w- C:\totalcmd
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2012-01-28 10:56 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-26 22:57 . 2012-01-07 13:18 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-02-26 22:57 . 2012-01-07 14:04 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-02-26 22:57 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-02-26 22:27 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-02-10 21:26 . 2012-01-20 16:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2012-01-06 23:02 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-15 10:31 . 2012-01-15 10:31 21419 ----a-w- c:\windows\system32\drivers\AegisP.sys
2012-01-11 14:16 . 2012-01-11 14:16 239168 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-01-08 19:23 . 2012-01-07 18:04 17488 ----a-w- c:\windows\etdrv.sys
2012-01-08 19:22 . 2012-01-07 18:00 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-01-08 19:22 . 2012-01-07 17:57 17488 ----a-w- c:\windows\gdrv.sys
2012-01-08 12:02 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraiins.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraidco.dll
2012-01-07 20:57 . 2012-01-07 20:57 215656 ----a-w- c:\windows\system32\drivers\nvstor32.sys
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-01-07 13:56 . 2012-01-07 13:17 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-01-07 13:18 . 2012-01-07 13:18 22328 ----a-w- c:\users\Korba\AppData\Roaming\PnkBstrK.sys
2012-01-07 13:04 . 2012-01-07 13:04 428088 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-01-07 10:59 . 2012-01-07 10:59 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-01-07 10:59 . 2012-01-07 10:59 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-01-07 10:59 . 2012-01-07 10:59 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-01-07 10:59 . 2012-01-07 10:59 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-07 10:59 . 2012-01-07 10:59 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-01-07 10:59 . 2012-01-07 10:59 367104 ----a-w- c:\windows\system32\html.iec
2012-01-07 10:59 . 2012-01-07 10:59 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-01-07 10:59 . 2012-01-07 10:59 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-07 10:59 . 2012-01-07 10:59 161792 ----a-w- c:\windows\system32\msls31.dll
2012-01-07 10:59 . 2012-01-07 10:59 152064 ----a-w- c:\windows\system32\wextract.exe
2012-01-07 10:59 . 2012-01-07 10:59 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-01-07 10:59 . 2012-01-07 10:59 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-07 10:59 . 2012-01-07 10:59 11776 ----a-w- c:\windows\system32\mshta.exe
2012-01-07 10:59 . 2012-01-07 10:59 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-07 10:59 . 2012-01-07 10:59 101888 ----a-w- c:\windows\system32\admparse.dll
2011-12-10 14:24 . 2012-01-10 20:34 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-21 07:39 . 2012-01-15 15:52 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"Steam"="c:\program files\Steam\Steam.exe" [2012-02-10 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-08-26 10828392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
.
c:\users\Korba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDockFree\ObjectDock.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AmIcoSinglun]
2010-05-03 12:56 237568 ----a-w- c:\program files\AmIcoSingLun\AmIcoSinglun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2008-11-14 13:35 305064 ----a-r- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 AODDriver;AODDriver; [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2012-01-08 17488]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-08-21 645120]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-07 1343400]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-01-11 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-05-03 27136]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-07-01 34896]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Korba\AppData\Roaming\Mozilla\Firefox\Profiles\qdopfqwa.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-AutoKMS - c:\windows\AutoKMS.exe
.
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-02-27 10:22:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-27 09:22
ComboFix2.txt 2012-02-26 20:33
.
Před spuštěním: Volných bajtů: 45 970 460 672
Po spuštění: Volných bajtů: 45 899 616 256
.
- - End Of File - - 86F6A95042A8F079582E338E981BC72A

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

ComboFix 12-02-25.02 - Korba 27.02.2012 23:29:23.3.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2048.1360 [GMT 1:00]
Spuštěný z: c:\users\Mirek\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Korba\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\EagleXNt.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Korba\AppData\Local\assembly\tmp
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAGLEXNT
-------\Service_EagleXNt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-27 do 2012-02-27 )))))))))))))))))))))))))))))))
.
.
2012-02-27 22:42 . 2012-02-27 22:42 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-27 22:42 . 2012-02-27 22:42 -------- d-----w- c:\users\Rodiče\AppData\Local\temp
2012-02-27 22:42 . 2012-02-27 22:42 -------- d-----w- c:\users\Jarka\AppData\Local\temp
2012-02-27 22:42 . 2012-02-27 22:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-27 22:07 . 2012-02-27 22:07 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3E65F9D-7C78-4C32-86A2-0AAAF451E63E}\offreg.dll
2012-02-27 21:59 . 2012-02-27 22:39 -------- d-----w- c:\users\Korba\AppData\Local\assembly
2012-02-27 09:16 . 2012-02-27 22:44 -------- d-----w- c:\users\Korba\AppData\Local\temp
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Ahead
2012-02-26 16:05 . 2012-02-26 16:05 -------- d-----w- c:\users\Rodiče\AppData\Local\Adobe
2012-02-26 14:44 . 2012-02-26 14:44 151552 ----a-w- c:\windows\system32\nvRegDev.dll
2012-02-26 14:44 . 2003-11-10 17:12 192512 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2012-02-26 14:44 . 2003-11-10 17:14 729088 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2012-02-26 14:44 . 2003-11-10 17:13 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2012-02-26 14:44 . 2003-11-10 17:12 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2012-02-26 14:44 . 2003-11-10 17:11 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2012-02-26 14:44 . 2012-02-26 14:44 311428 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2012-02-26 14:44 . 2012-02-26 14:44 188548 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2012-02-26 14:43 . 2012-02-26 15:17 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-02-26 14:39 . 2012-02-26 14:39 -------- d-----w- c:\program files\Adobe Media Player
2012-02-26 14:37 . 2012-02-26 14:37 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-02-26 14:32 . 2012-02-27 10:56 -------- d-----w- c:\users\Korba\AppData\Local\Adobe
2012-02-26 10:10 . 2012-02-26 10:10 -------- d-----w- c:\program files\Cheat Engine 6.1
2012-02-25 18:38 . 2012-02-25 18:38 -------- d-----w- c:\program files\RocketDock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\ODUI
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Local\Stardock
2012-02-25 18:30 . 2012-02-25 18:30 -------- d-----w- c:\users\Korba\AppData\Roaming\Stardock
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\users\Korba\AppData\Roaming\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:27 -------- d-----w- c:\programdata\Screaming Bee
2012-02-25 11:26 . 2012-02-25 11:26 -------- d-----w- c:\program files\Screaming Bee
2012-02-24 19:37 . 2012-02-20 00:05 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3E65F9D-7C78-4C32-86A2-0AAAF451E63E}\mpengine.dll
2012-02-24 17:52 . 2012-02-24 17:54 -------- d-----w- c:\program files\Google
2012-02-21 20:38 . 2012-02-21 20:53 -------- d-----w- c:\users\Korba\AppData\Roaming\TeamViewer
2012-02-21 20:37 . 2012-02-21 20:37 -------- d-----w- c:\program files\TeamViewer
2012-02-19 21:04 . 2009-04-06 08:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2012-02-19 21:04 . 2009-04-06 08:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2012-02-19 20:43 . 2012-02-27 22:00 -------- d-----w- c:\program files\NCsoft
2012-02-19 10:39 . 2012-02-19 10:39 1060864 ----a-w- c:\windows\system32\mfc71.dll
2012-02-19 10:36 . 2012-02-19 10:38 -------- d-----w- c:\users\Korba\AppData\Local\Rockstar Games
2012-02-19 10:34 . 2012-02-19 10:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-02-19 10:09 . 2012-02-19 10:11 -------- d-----w- c:\program files\Rockstar Games
2012-02-19 10:06 . 2012-02-19 10:06 -------- d-----w- c:\windows\system32\xlive
2012-02-19 10:06 . 2012-02-19 10:07 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2012-02-16 17:19 . 2012-02-16 17:19 -------- d-----w- c:\users\Korba\AppData\Local\BigHugeEngine
2012-02-16 16:01 . 2012-02-16 16:01 -------- d-----w- c:\users\Korba\AppData\Local\CrashRpt
2012-02-16 16:00 . 2012-02-16 16:03 -------- d-----w- C:\KAG
2012-02-15 20:29 . 2012-02-15 20:29 -------- d-----w- c:\program files\Recuva
2012-02-15 20:00 . 2012-02-15 20:00 -------- d-----w- c:\program files\GamePark
2012-02-15 12:01 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-15 12:01 . 2012-01-04 08:58 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-15 12:01 . 2011-12-16 07:52 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-15 12:00 . 2012-01-14 03:35 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-02-10 22:38 . 2012-02-10 22:38 42392 ----a-w- c:\windows\system32\xfcodec.dll
2012-02-10 20:54 . 2012-02-23 18:11 -------- d-----w- c:\program files\Common Files\Steam
2012-02-10 20:54 . 2012-02-27 19:21 -------- d-----w- c:\program files\Steam
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\users\Korba\AppData\Local\APN
2012-02-06 20:26 . 2012-02-06 20:26 -------- d-----w- c:\program files\DsNET Corp
2012-02-03 19:24 . 2012-02-03 19:24 -------- d-----w- c:\program files\NEXON
2012-02-03 18:39 . 2012-02-03 18:39 -------- d-----w- c:\program files\The KMPlayer
2012-02-03 18:38 . 2012-02-03 19:18 -------- d-----w- C:\Download
2012-02-03 18:38 . 2012-02-03 18:38 235 ----a-w- c:\windows\system32\nxEuUninstall.bat
2012-02-03 18:38 . 2012-02-03 18:38 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2012-02-03 14:02 . 2012-02-21 18:31 -------- d-----w- C:\Nexon
2012-02-03 14:02 . 2012-02-19 21:15 -------- d-----w- c:\programdata\NexonUS
2012-02-03 12:41 . 2012-02-03 12:41 -------- d-----w- c:\program files\Pando Networks
2012-02-02 14:47 . 2012-02-12 14:48 -------- d-----w- c:\program files\Counter-Strike Source
2012-01-30 13:39 . 2012-01-30 13:40 -------- d-----w- c:\windows\WindowsMobile
2012-01-29 11:45 . 2012-01-29 13:09 -------- d-----w- c:\users\Korba\AppData\Roaming\wargaming.net
2012-01-29 11:26 . 2012-01-29 11:26 -------- d-----w- C:\Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-27 22:07 . 2012-01-07 13:18 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-02-27 22:07 . 2012-01-07 14:04 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-02-27 22:07 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-02-27 20:52 . 2012-01-07 13:17 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-02-10 21:26 . 2012-01-20 16:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2012-01-06 23:02 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-15 10:31 . 2012-01-15 10:31 21419 ----a-w- c:\windows\system32\drivers\AegisP.sys
2012-01-11 14:16 . 2012-01-11 14:16 239168 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-01-08 19:23 . 2012-01-07 18:04 17488 ----a-w- c:\windows\etdrv.sys
2012-01-08 19:22 . 2012-01-07 18:00 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-01-08 19:22 . 2012-01-07 17:57 17488 ----a-w- c:\windows\gdrv.sys
2012-01-08 12:02 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraiins.dll
2012-01-07 20:57 . 2012-01-07 20:57 372840 ----a-w- c:\windows\system32\nvraidco.dll
2012-01-07 20:57 . 2012-01-07 20:57 215656 ----a-w- c:\windows\system32\drivers\nvstor32.sys
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-01-07 20:57 . 2012-01-07 20:57 15464 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-01-07 20:57 . 2012-01-07 20:57 14952 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-01-07 20:57 . 2012-01-07 20:57 18024 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-01-07 20:57 . 2012-01-07 20:57 17512 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-01-07 20:57 . 2012-01-07 20:57 17000 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-01-07 13:56 . 2012-01-07 13:17 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-01-07 13:18 . 2012-01-07 13:18 22328 ----a-w- c:\users\Korba\AppData\Roaming\PnkBstrK.sys
2012-01-07 13:04 . 2012-01-07 13:04 428088 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-01-07 10:59 . 2012-01-07 10:59 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-01-07 10:59 . 2012-01-07 10:59 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-07 10:59 . 2012-01-07 10:59 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-01-07 10:59 . 2012-01-07 10:59 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-01-07 10:59 . 2012-01-07 10:59 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-07 10:59 . 2012-01-07 10:59 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-01-07 10:59 . 2012-01-07 10:59 367104 ----a-w- c:\windows\system32\html.iec
2012-01-07 10:59 . 2012-01-07 10:59 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-01-07 10:59 . 2012-01-07 10:59 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-07 10:59 . 2012-01-07 10:59 161792 ----a-w- c:\windows\system32\msls31.dll
2012-01-07 10:59 . 2012-01-07 10:59 152064 ----a-w- c:\windows\system32\wextract.exe
2012-01-07 10:59 . 2012-01-07 10:59 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-01-07 10:59 . 2012-01-07 10:59 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-07 10:59 . 2012-01-07 10:59 11776 ----a-w- c:\windows\system32\mshta.exe
2012-01-07 10:59 . 2012-01-07 10:59 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-07 10:59 . 2012-01-07 10:59 101888 ----a-w- c:\windows\system32\admparse.dll
2011-12-10 14:24 . 2012-01-10 20:34 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-21 07:39 . 2012-01-15 15:52 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"Steam"="c:\program files\Steam\Steam.exe" [2012-02-10 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-08-26 10828392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
.
c:\users\Korba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDockFree\ObjectDock.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AmIcoSinglun]
2010-05-03 12:56 237568 ----a-w- c:\program files\AmIcoSingLun\AmIcoSinglun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2008-11-14 13:35 305064 ----a-r- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 AODDriver;AODDriver; [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2012-01-08 17488]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-08-21 645120]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-07 1343400]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-01-11 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 55128]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-05-03 27136]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-07-01 34896]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Korba\AppData\Roaming\Mozilla\Firefox\Profiles\qdopfqwa.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-PlayNC Launcher - (no file)
.
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-02-27 23:50:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-27 22:50
ComboFix2.txt 2012-02-27 09:22
ComboFix3.txt 2012-02-26 20:33
.
Před spuštěním: Volných bajtů: 34 509 127 680
Po spuštění: Volných bajtů: 37 560 201 216
.
- - End Of File - - 30FE17C67670A6767F84EDA0E9BDBD5F

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod



ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.


Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.