Preventivní kontrola (mbam čistý)

[quinter]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:06:11, on 3.4.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Users\Tony\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tony\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tony\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tony\AppData\Local\Google\Chrome\Application\chrome.exe
D:\Programy\uTorrent\uTorrent.exe
C:\Users\Tony\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tony\Desktop\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Tony\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - D:\Programy\QIP\QIP\qip.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D64A5-DCE2-47E7-81BC-1B0F3ABBF2BB}: NameServer = 213.180.32.2,213.180.33.225
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Služba Windows Media Player Network Sharing (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6530 bytes

[Reklama]

[memphisto]

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[quinter]

ComboFix 11-04-07.07 - Tony 08.04.2011 9:00.9.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.4061.3064 [GMT 2:00]
Spuštěný z: c:\users\Tony\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-08 do 2011-04-08 )))))))))))))))))))))))))))))))
.
.
2011-04-08 07:05 . 2011-04-08 07:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-25 07:48 . 2011-04-08 06:54 4484 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-03-19 13:45 . 2011-03-26 11:13 -------- d-----w- c:\programdata\Solidshield
2011-03-19 13:36 . 2011-03-19 13:36 -------- d-----w- c:\users\Tony\AppData\Roaming\PunkBuster
2011-03-18 16:52 . 2010-12-23 06:07 1118720 ----a-w- c:\windows\system32\sbe.dll
2011-03-18 16:52 . 2010-12-23 06:07 961024 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-18 16:52 . 2010-12-23 06:07 723968 ----a-w- c:\windows\system32\EncDec.dll
2011-03-18 16:52 . 2010-12-23 06:02 259072 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-18 16:52 . 2010-12-23 05:28 850432 ----a-w- c:\windows\SysWow64\sbe.dll
2011-03-18 16:52 . 2010-12-23 05:28 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
2011-03-18 16:52 . 2010-12-23 05:28 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-03-18 16:52 . 2010-12-23 05:24 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
2011-03-18 16:52 . 2010-12-18 06:12 3138048 ----a-w- c:\windows\system32\mstscax.dll
2011-03-18 16:52 . 2010-12-18 06:08 1097216 ----a-w- c:\windows\system32\mstsc.exe
2011-03-18 16:52 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\SysWow64\mstscax.dll
2011-03-18 16:52 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\SysWow64\mstsc.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-19 13:37 . 2009-12-22 00:44 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-03-19 13:36 . 2009-12-22 00:44 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-03-19 12:09 . 2009-12-22 00:44 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-02-24 17:56 . 2011-02-24 17:57 695675 ----a-w- c:\windows\unins000.exe
2011-02-04 12:29 . 2009-12-22 00:44 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-01-30 09:49 . 2011-01-30 09:49 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-01-20 09:39 . 2011-01-23 16:06 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D4C0339A-31B6-4D7E-896D-88F3C59CB09F}\mpengine.dll
2011-01-19 08:26 . 2011-01-19 08:26 86016 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-01-19 08:26 . 2011-01-19 08:26 84992 ----a-w- c:\windows\system32\frapsv64.dll
2011-01-18 17:37 . 2011-01-18 17:37 6288 ----a-w- c:\windows\SysWow64\ealregsnapshot1.reg
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [2008-09-17 12744]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\DRIVERS\hidusbf.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-12-13 135336]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.com/
uLocal Page = c:\windows\SYSTEM32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Tony\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: {B15D64A5-DCE2-47E7-81BC-1B0F3ABBF2BB} = 213.180.32.2,213.180.33.225
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-HSON - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
HKLM-Run-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4154602735-317559753-901735074-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D88B2C64-B12F-8690-6132-451BF5CC1CD8}*]
@Allowed: (Read) (RestrictedCode)
"jadnecnfkgmnjnoladko"=hex:62,61,70,6f,00,33
"jadnecnfkgmnjnoladgo"=hex:62,61,67,6f,00,33
"iadmamkpeihddibjhg"=hex:6b,61,6f,6f,70,6b,6b,6a,6b,63,69,6d,6c,68,61,65,6c,70,
64,68,62,69,00,00
.
[HKEY_USERS\S-1-5-21-4154602735-317559753-901735074-1000\Software\SecuROM\License information*]
"datasecu"=hex:b4,4f,dd,0b,43,46,9f,3f,6c,b0,61,88,eb,e3,1d,8e,fd,fe,03,2b,7d,
43,55,89,4f,e2,87,3f,16,57,0c,58,90,c3,73,40,77,8b,bb,5d,20,2a,b9,c9,9a,e0,\
"rkeysecu"=hex:f1,76,b4,09,94,41,7b,7c,1e,39,19,54,bf,19,6a,cc
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="01DF18302C1134048DD3A716B9B14EA06426B7B4BF8F94964E5E08D0DAA0C36AB5F01A48E46EE107D43558F550145D6DB761AAA9CBBC7CEF8716BC2040BF9677B1FE29201343A065D605F097C5F68BF70885B84B57D36FC85BA6E02101FA8752C7346C6C40960192D98B325329D0152B341E5FBE945D76A65B7ED2E0968B8DB9DC7C3B4247718524B9D6906A5A9D29172AF9510D89648DB22ECAA0504A2D908E6C88239CD8E0A4D5E43A3601905C6CEE6EACF52312F827BA0B038EC5BD20F1D8845063D9FB76FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D9DB7CE019D40AA5CBA7FD869164D6794B7CF4EAA46FBBB29B5C1BB8E4A6CE00E59E4F7EA76B9C9B0FA87A8279BE2099554942564E6AE79BAC366141F033404BFD597DFE08D873A9C21F374F558E140637370514805ED019D5137E830E3133A2DBA3F536E295B564552784C2472E50FF03F8904E29CE6E9AAF294404EE3BE037EAC13CEC2DE169FC5DEC5419EBC189C6954280286DBAC21BDB2FDB3C9B0512CE1C16E5FD0F8FA6C3C8AAE7698BC03E27C44B8264327326538101B71B8ABCA5C890550A84DF3B0E44B0D2A260AAD1AB2DD134CDB7597D2CAFEFBB53D73E60C8B2BF55B64338243091B93569A2E7EB0AC463A98A6B675CA39F95C3A6B97AC5C077F0656DABF8921A8D43D713503D0FDC86F27759967423C6B150B3C6706F9666FC41EAC6D76229E6A279D606ACBFB9ED11939DF5F2CB1AC73C35771AF647D36B8BC996C0E9B99F348453D2A42128993E609C779B4ED2B04B2770333D51C1DC1AC2D46C9C43BF2BA906698F9D79EB9C179841B076B57C99162AB42FE0059F0DC67DFE61A2CA2E272E2C31F23DD01FC71D058EFF1E859DC850EDA41F7E80D4643DAA133D874E35280B61C3695168C7B4D0854F645A4A7E8F594069CE25F6E1C92CA445626DF56DFA9D534346B5AD78E680ECC5534AD3BA45CABB2E62AC4F3284D4F1EEEC2C6125C1CDDCFE4DF173F45B4A597A411A4507B155969A65C105D52D956098F9793F64DE3403C89D2CAE1628C6590F1573FE58C62F936552A4B2AB703A161C0ADC626ECF7C246D5490C225BAA3798BC2247402D693DAAE169141F28F6C20A7CB5718628AD80C071698127DCB05C137C3397E763B427D92C161D46A9C72668B1023D41A0BFE4837880E75C4323646797EF252AEAAF105E0C4B2D6D726D86E5C308E3C52CCFB368FBFC10F0A2E938016E5FF11534AC22D2CBCC1EA4F040746F0AE435C5D3DF81CDFEF4DD5840D091CF4E3098FEE1E1DDD9A780DDC1C50055F74E5615B6D4D73817F89DC84918098047FE33C5FECAE69716536E70DC43CD62F4503FF8D32182172AD7555F3E572766DE385C3C707C3BF633F3C6"
"OODEFRAG14.00.00.01PROFESSIONAL"="0F4D02330B013A488595D04CDB53A9A45B919ED87EF3717BC70568A84F829CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555BA7FD869164D6794BA7FD869164D6794656865088A56E9C2DF2EC65BFE3F5F6B8B89B90FDCC6AFEDB3D47A1104F3579D8B0587D245C9F140F4CCAD2FD273AE349B59E5CE048611235B13FE23DECC8A41F8F61CF201A8DC252CFB8172497CCCA5F50B306F5E30A9CD4A05D18B773A2160885777870640E068C324A21A1EC8105DDB79A6603CF28DD6E596CFD1524A0B4AE24263D0AD23ED62CA326AC11F0B02DFE302CF340142810B6AB6CBA289D26BB689591FB666252154A699A227AEB7DE93F68823A5A6550299645A094F4AEA99BCCF41DBC1B3DFD05D114F8BAF470A19C452F20B8EB7A7BB1839F8C0CCD46F225CDDA1BF9FA9310407954CD6DFF081D622882CE86E5577917E1E8C20337E01C3742FA664A3F3397A39950FABE4CDDCF03F00A3116BB3C81A299D954940B182F14C92045943D05D2144C499258B0F26759471CA4BCB9BE12158979850D4EA9B540DAD6A1F9791469ED92DEE53C67C25A47BEB18D2FBE8CEA3B1BD9DBEF4BBBBC643F6162D5F9EE1CB90AB9C38AEF0E7F4B4CE07588B0BDD54BB982E8FCBC88E58DFB941EBFBEF61B2E0702DCA7DDD41116452967F2E07A29AE380DBB6A3CC8CCC3A972D3A7394B9162C80B47713C348D38F00C8E0BC75F390FAA5B818ED13EA9A8A049E696FAF24E9B3B3469BF03B55D0243324883382EE05B30BDD0C417E26706EC45FC03F761D571EB7FC8A3FEF084D6FA0B375AF6EEE792986E660540400A9E777B979D233E6B8F48D778C47A041C1A64D061D770C1A25D544725606AB7B5DDA0B804240C506A0A60AD55BF99F28DCE0912EE6F2C55772194125A1561560D0914407BBC31EC3D306D53DA5E856267F979CC12FAC96D0013AD1256C696FBB0039B9A6FC3844AC4AC96D59904BBE6A40ACEFDB44D51076A1DF1C20538901DC1B64583B112251922F8C21D5317BE7666762619C6CC055FA5B171BC368A223D88586DEA6F226F30B64CB16E69279F55072DF99A35EE61E55E84F9C45AF46C207D5FAE14C180D6F6E7EEAC5BE34679EA21431989A47E339C039DD455BA1A8E00459FCC896E3C6985AC5AE7C990A8CAF9A30C52EA946F504BC6EFA0A42AB23932F0EB04EEFB2645A30B6C3D9B4F9D3863B61700102EE83740DDF42B63A30B2832FA719844AD09BB31401375552DFCC964AF5690BD4CA1392379636E98582F7ED688E20CD9A80C6B46F0B7B35360AA8E7526E4B1AD7D4517908D1B8956CECB8A389DD14E15977638670EC66972ABBBE95A000154E487C0DDB0E8393823A2B5C0C0364A5CC016193618771B3EC7D2B0BCD48942C1F"
.
Celkový čas: 2011-04-08 09:07:49
ComboFix-quarantined-files.txt 2011-04-08 07:07
.
Před spuštěním: Volných bajtů: 220 413 280 256
Po spuštění: Volných bajtů: 220 334 256 128
.
- - End Of File - - 5F0D88AEB30F35E88F867245F4F6F45F

[jaro3]

Jen dotaz , kdy jsi přesně stahoval ten Combofix?

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

RegNull::
[HKEY_USERS\S-1-5-21-4154602735-317559753-901735074-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D88B2C64-B12F-8690-6132-451BF5CC1CD8}*]

RegLock::
[HKEY_USERS\S-1-5-21-4154602735-317559753-901735074-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D88B2C64-B12F-8690-6132-451BF5CC1CD8}*]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.

[quinter]

ComboFix 11-04-07.08 - Tony 08.04.2011 10:55:04.10.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.4061.2990 [GMT 2:00]
Spuštěný z: c:\users\Tony\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Tony\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-08 do 2011-04-08 )))))))))))))))))))))))))))))))
.
.
2011-04-08 08:58 . 2011-04-08 08:58 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-04-08 08:58 . 2011-04-08 08:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-08 08:58 . 2011-04-08 08:58 -------- d-----w- c:\users\AppData\AppData\Local\temp
2011-04-08 08:58 . 2011-04-08 08:58 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-03-25 07:48 . 2011-04-08 06:54 4484 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-03-19 13:45 . 2011-03-26 11:13 -------- d-----w- c:\programdata\Solidshield
2011-03-19 13:36 . 2011-03-19 13:36 -------- d-----w- c:\users\Tony\AppData\Roaming\PunkBuster
2011-03-18 16:52 . 2010-12-23 06:07 1118720 ----a-w- c:\windows\system32\sbe.dll
2011-03-18 16:52 . 2010-12-23 06:07 961024 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-18 16:52 . 2010-12-23 06:07 723968 ----a-w- c:\windows\system32\EncDec.dll
2011-03-18 16:52 . 2010-12-23 06:02 259072 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-18 16:52 . 2010-12-23 05:28 850432 ----a-w- c:\windows\SysWow64\sbe.dll
2011-03-18 16:52 . 2010-12-23 05:28 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
2011-03-18 16:52 . 2010-12-23 05:28 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-03-18 16:52 . 2010-12-23 05:24 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
2011-03-18 16:52 . 2010-12-18 06:12 3138048 ----a-w- c:\windows\system32\mstscax.dll
2011-03-18 16:52 . 2010-12-18 06:08 1097216 ----a-w- c:\windows\system32\mstsc.exe
2011-03-18 16:52 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\SysWow64\mstscax.dll
2011-03-18 16:52 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\SysWow64\mstsc.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-19 13:37 . 2009-12-22 00:44 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-03-19 13:36 . 2009-12-22 00:44 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-03-19 12:09 . 2009-12-22 00:44 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-02-24 17:56 . 2011-02-24 17:57 695675 ----a-w- c:\windows\unins000.exe
2011-02-04 12:29 . 2009-12-22 00:44 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-01-30 09:49 . 2011-01-30 09:49 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-01-20 09:39 . 2011-01-23 16:06 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D4C0339A-31B6-4D7E-896D-88F3C59CB09F}\mpengine.dll
2011-01-19 08:26 . 2011-01-19 08:26 86016 ----a-w- c:\windows\SysWow64\frapsvid.dll
2011-01-19 08:26 . 2011-01-19 08:26 84992 ----a-w- c:\windows\system32\frapsv64.dll
2011-01-18 17:37 . 2011-01-18 17:37 6288 ----a-w- c:\windows\SysWow64\ealregsnapshot1.reg
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-08_07.05.11 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-12-20 16:11 . 2011-04-08 07:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-12-20 16:11 . 2011-04-08 08:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-12-20 16:11 . 2011-04-08 08:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-12-20 16:11 . 2011-04-08 07:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [2008-09-17 12744]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\DRIVERS\hidusbf.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-12-13 135336]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" [BU]
"HSON"="%ProgramFiles%\TOSHIBA\TBS\HSON.exe" [BU]
"00TCrdMain"="%ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.com/
uLocal Page = c:\windows\SYSTEM32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Tony\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: {B15D64A5-DCE2-47E7-81BC-1B0F3ABBF2BB} = 213.180.32.2,213.180.33.225
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4154602735-317559753-901735074-1000\Software\SecuROM\License information*]
"datasecu"=hex:b4,4f,dd,0b,43,46,9f,3f,6c,b0,61,88,eb,e3,1d,8e,fd,fe,03,2b,7d,
43,55,89,4f,e2,87,3f,16,57,0c,58,90,c3,73,40,77,8b,bb,5d,20,2a,b9,c9,9a,e0,\
"rkeysecu"=hex:f1,76,b4,09,94,41,7b,7c,1e,39,19,54,bf,19,6a,cc
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="01DF18302C1134048DD3A716B9B14EA06426B7B4BF8F94964E5E08D0DAA0C36AB5F01A48E46EE107D43558F550145D6DB761AAA9CBBC7CEF8716BC2040BF9677B1FE29201343A065D605F097C5F68BF70885B84B57D36FC85BA6E02101FA8752C7346C6C40960192D98B325329D0152B341E5FBE945D76A65B7ED2E0968B8DB9DC7C3B4247718524B9D6906A5A9D29172AF9510D89648DB22ECAA0504A2D908E6C88239CD8E0A4D5E43A3601905C6CEE6EACF52312F827BA0B038EC5BD20F1D8845063D9FB76FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D9DB7CE019D40AA5CBA7FD869164D6794B7CF4EAA46FBBB29B5C1BB8E4A6CE00E59E4F7EA76B9C9B0FA87A8279BE2099554942564E6AE79BAC366141F033404BFD597DFE08D873A9C21F374F558E140637370514805ED019D5137E830E3133A2DBA3F536E295B564552784C2472E50FF03F8904E29CE6E9AAF294404EE3BE037EAC13CEC2DE169FC5DEC5419EBC189C6954280286DBAC21BDB2FDB3C9B0512CE1C16E5FD0F8FA6C3C8AAE7698BC03E27C44B8264327326538101B71B8ABCA5C890550A84DF3B0E44B0D2A260AAD1AB2DD134CDB7597D2CAFEFBB53D73E60C8B2BF55B64338243091B93569A2E7EB0AC463A98A6B675CA39F95C3A6B97AC5C077F0656DABF8921A8D43D713503D0FDC86F27759967423C6B150B3C6706F9666FC41EAC6D76229E6A279D606ACBFB9ED11939DF5F2CB1AC73C35771AF647D36B8BC996C0E9B99F348453D2A42128993E609C779B4ED2B04B2770333D51C1DC1AC2D46C9C43BF2BA906698F9D79EB9C179841B076B57C99162AB42FE0059F0DC67DFE61A2CA2E272E2C31F23DD01FC71D058EFF1E859DC850EDA41F7E80D4643DAA133D874E35280B61C3695168C7B4D0854F645A4A7E8F594069CE25F6E1C92CA445626DF56DFA9D534346B5AD78E680ECC5534AD3BA45CABB2E62AC4F3284D4F1EEEC2C6125C1CDDCFE4DF173F45B4A597A411A4507B155969A65C105D52D956098F9793F64DE3403C89D2CAE1628C6590F1573FE58C62F936552A4B2AB703A161C0ADC626ECF7C246D5490C225BAA3798BC2247402D693DAAE169141F28F6C20A7CB5718628AD80C071698127DCB05C137C3397E763B427D92C161D46A9C72668B1023D41A0BFE4837880E75C4323646797EF252AEAAF105E0C4B2D6D726D86E5C308E3C52CCFB368FBFC10F0A2E938016E5FF11534AC22D2CBCC1EA4F040746F0AE435C5D3DF81CDFEF4DD5840D091CF4E3098FEE1E1DDD9A780DDC1C50055F74E5615B6D4D73817F89DC84918098047FE33C5FECAE69716536E70DC43CD62F4503FF8D32182172AD7555F3E572766DE385C3C707C3BF633F3C6"
"OODEFRAG14.00.00.01PROFESSIONAL"="0F4D02330B013A488595D04CDB53A9A45B919ED87EF3717BC70568A84F829CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555BA7FD869164D6794BA7FD869164D6794656865088A56E9C2DF2EC65BFE3F5F6B8B89B90FDCC6AFEDB3D47A1104F3579D8B0587D245C9F140F4CCAD2FD273AE349B59E5CE048611235B13FE23DECC8A41F8F61CF201A8DC252CFB8172497CCCA5F50B306F5E30A9CD4A05D18B773A2160885777870640E068C324A21A1EC8105DDB79A6603CF28DD6E596CFD1524A0B4AE24263D0AD23ED62CA326AC11F0B02DFE302CF340142810B6AB6CBA289D26BB689591FB666252154A699A227AEB7DE93F68823A5A6550299645A094F4AEA99BCCF41DBC1B3DFD05D114F8BAF470A19C452F20B8EB7A7BB1839F8C0CCD46F225CDDA1BF9FA9310407954CD6DFF081D622882CE86E5577917E1E8C20337E01C3742FA664A3F3397A39950FABE4CDDCF03F00A3116BB3C81A299D954940B182F14C92045943D05D2144C499258B0F26759471CA4BCB9BE12158979850D4EA9B540DAD6A1F9791469ED92DEE53C67C25A47BEB18D2FBE8CEA3B1BD9DBEF4BBBBC643F6162D5F9EE1CB90AB9C38AEF0E7F4B4CE07588B0BDD54BB982E8FCBC88E58DFB941EBFBEF61B2E0702DCA7DDD41116452967F2E07A29AE380DBB6A3CC8CCC3A972D3A7394B9162C80B47713C348D38F00C8E0BC75F390FAA5B818ED13EA9A8A049E696FAF24E9B3B3469BF03B55D0243324883382EE05B30BDD0C417E26706EC45FC03F761D571EB7FC8A3FEF084D6FA0B375AF6EEE792986E660540400A9E777B979D233E6B8F48D778C47A041C1A64D061D770C1A25D544725606AB7B5DDA0B804240C506A0A60AD55BF99F28DCE0912EE6F2C55772194125A1561560D0914407BBC31EC3D306D53DA5E856267F979CC12FAC96D0013AD1256C696FBB0039B9A6FC3844AC4AC96D59904BBE6A40ACEFDB44D51076A1DF1C20538901DC1B64583B112251922F8C21D5317BE7666762619C6CC055FA5B171BC368A223D88586DEA6F226F30B64CB16E69279F55072DF99A35EE61E55E84F9C45AF46C207D5FAE14C180D6F6E7EEAC5BE34679EA21431989A47E339C039DD455BA1A8E00459FCC896E3C6985AC5AE7C990A8CAF9A30C52EA946F504BC6EFA0A42AB23932F0EB04EEFB2645A30B6C3D9B4F9D3863B61700102EE83740DDF42B63A30B2832FA719844AD09BB31401375552DFCC964AF5690BD4CA1392379636E98582F7ED688E20CD9A80C6B46F0B7B35360AA8E7526E4B1AD7D4517908D1B8956CECB8A389DD14E15977638670EC66972ABBBE95A000154E487C0DDB0E8393823A2B5C0C0364A5CC016193618771B3EC7D2B0BCD48942C1F"
.
Celkový čas: 2011-04-08 11:00:22
ComboFix-quarantined-files.txt 2011-04-08 09:00
ComboFix2.txt 2011-04-08 07:07
.
Před spuštěním: Volných bajtů: 220 211 646 464
Po spuštění: Volných bajtů: 220 130 746 368
.
- - End Of File - - B186AFD734D88DF2EFAC13D71EBDE28D

[quinter]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:04:59, on 8.4.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Users\Tony\Desktop\Programy\čištění PC\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Tony\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - D:\Programy\QIP\QIP\qip.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D64A5-DCE2-47E7-81BC-1B0F3ABBF2BB}: NameServer = 213.180.32.2,213.180.33.225
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Služba Windows Media Player Network Sharing (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6430 bytes

[quinter]

PC se po aplikaci skriptu nerestartoval
A Combofix jsem stahoval dnes ráno kolem 9. hodiny

[jaro3]

Dík za info , tedy Combofix stažen dnes v 9:00..

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.


Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod: viewtopic.php?f=70&t=5119

Kód: Vybrat vše

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.

[quinter]

Pročištěno Ccleanerem, odkaz na T-Cleaner NEFUNKČNÍ

[jaro3]

pardon...


http://www.edisk.cz/stahni/29485/T-Clea ... 8.5KB.html