Pravidelné restartování ntb Vyřešeno

[tanner]

Zdravím, včera cca po dvou hodin hraní wowka se mi restartnul ntb, žádná modrá obrazovka a nic, prostě restart. Řekl jsem si, že bych mohl mít nějakou havěť v PC. Jenže najednou byl Avast odinstalovanej. Zkusil jsem AVG free edition a ten mi našel v pc nějakej vir, oddělal jsem ho a řekl si, že to by mohlo být ono. Jenže pak se mi PC restartnul ještě 2x, takže nevím. Dneska, při sledování seriálu další restart. Teploty jsou ok... prosím o kontrolu logu.



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:33:57, on 2.9.2011
Platform: Windows 7 SP1, v.721 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17105)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Users\Ranndy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ranndy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ranndy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ranndy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Ranndy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\HIjackthis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yandex.ru/?clid=208262
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (file missing)
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7970 bytes

[Reklama]

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yandex.ru/?clid=208262
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - (no file)
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

[tanner]

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Verze databáze: 7638

Windows 6.1.7601 Service Pack 1, v.721
Internet Explorer 8.0.7601.17105

2.9.2011 22:17:34
mbam-log-2011-09-02 (22-17-34).txt

Typ: Rychlá kontrola
Kontrolované objekty: 182816
Uplynulý čas: 1 minut, 53 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[tanner]

Hej zatím díky moc, pc se zatím nerestartlo (i když to nejsou 2 hodiny, ale mám z toho dobrý pocit ) ten log z combofixu sem hodím zítra, jstem strašně unavenej ze školy.

[jaro3]

Fajn , tedy , kdyby to bylo OK , tak zatím ten Combofix dělat nemusíš..zatím..

[tanner]

tak ráno jsem měl ntb zaplej cca 2 a půl hodky ( bez restartu ) teď po 2 a půl hodinách restart... přikládám log z Combofixu


ComboFix 11-09-02.04 - Ranndy 03.09.2011 15:37:50.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8173.6880 [GMT 2:00]
Spuštěný z: c:\downloady\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\muzapp.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-03 do 2011-09-03 )))))))))))))))))))))))))))))))
.
.
2011-09-03 13:41 . 2011-09-03 13:41 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-09-03 13:41 . 2011-09-03 13:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-02 20:14 . 2011-09-02 20:14 -------- d-----w- c:\users\Ranndy\AppData\Roaming\Malwarebytes
2011-09-02 20:14 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-09-02 20:14 . 2011-09-02 20:14 -------- d-----w- c:\programdata\Malwarebytes
2011-09-02 20:14 . 2011-09-02 20:14 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-09-02 20:14 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-02 15:33 . 2011-09-02 15:33 388096 ----a-r- c:\users\Ranndy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-01 20:50 . 2011-09-01 20:50 -------- d-----w- C:\$AVG
2011-09-01 20:29 . 2011-09-01 20:29 -------- d-----w- c:\users\Ranndy\AppData\Roaming\AVG10
2011-09-01 20:28 . 2011-09-01 20:29 -------- d-----w- c:\programdata\AVG Security Toolbar
2011-09-01 20:28 . 2011-09-01 20:28 -------- d-----w- c:\windows\SysWow64\drivers\AVG
2011-09-01 20:28 . 2011-09-03 07:53 -------- d-----w- c:\windows\system32\drivers\AVG
2011-09-01 20:28 . 2011-09-01 20:29 -------- d-----w- c:\programdata\AVG10
2011-09-01 20:27 . 2011-09-01 20:27 -------- d-----w- c:\program files (x86)\AVG
2011-09-01 20:17 . 2011-09-01 20:17 -------- d--h--w- c:\programdata\Common Files
2011-09-01 20:17 . 2011-09-01 20:29 -------- d-----w- c:\programdata\MFAData
2011-09-01 16:12 . 2011-09-01 16:12 -------- d-----w- c:\users\Ranndy\AppData\Roaming\Win7codecs
2011-08-31 20:19 . 2011-08-19 14:33 27992 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-08-31 20:18 . 2010-11-26 16:02 17720 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-08-27 18:54 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2011-08-27 18:53 . 2011-08-27 18:55 -------- d-----w- c:\program files (x86)\The Logo Creator v5
2011-08-22 13:52 . 2011-08-22 13:52 -------- d-----w- c:\users\Ranndy\AppData\Roaming\XMedia Recode
2011-08-22 13:38 . 2011-08-22 13:38 -------- d-----w- c:\program files (x86)\XMedia Recode
2011-08-19 11:25 . 2011-08-19 11:25 -------- d-----w- c:\windows\SysWow64\Wat
2011-08-19 11:25 . 2011-08-19 11:25 -------- d-----w- c:\windows\system32\Wat
2011-08-18 10:05 . 2011-08-18 10:05 -------- d-----w- c:\program files (x86)\CrystalDiskInfo
2011-08-11 13:27 . 2011-08-22 20:02 -------- d-----w- c:\users\Ranndy\riotsGamesLogs
2011-08-11 13:12 . 2011-08-11 13:12 -------- d-----w- c:\users\Ranndy\AppData\Roaming\LolClient
2011-08-11 10:21 . 2008-07-12 06:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2011-08-11 10:21 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2011-08-11 10:21 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2011-08-11 08:52 . 2011-08-27 17:48 -------- d-----w- c:\users\Ranndy\AppData\Local\PMB Files
2011-08-11 08:52 . 2011-08-27 17:48 -------- d-----w- c:\programdata\PMB Files
2011-08-11 08:52 . 2011-08-11 08:52 -------- d-----w- c:\program files (x86)\Pando Networks
2011-08-09 19:13 . 2011-08-09 19:13 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-08-09 18:54 . 2011-08-09 18:54 -------- d-----w- c:\users\Ranndy\AppData\Local\PunkBuster
2011-08-09 08:18 . 2011-08-09 08:18 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-09 08:18 . 2011-08-27 18:54 -------- d-----w- c:\windows\SysWow64\Macromed
2011-08-07 12:54 . 2011-08-07 12:54 -------- d-----w- C:\Temp
2011-08-07 12:25 . 2011-08-07 12:25 -------- d-----w- c:\users\Ranndy\AppData\Local\Samsung
2011-08-07 12:24 . 2011-07-20 07:45 36328 ----a-w- c:\windows\system32\drivers\ssadadb.sys
2011-08-07 12:24 . 2011-07-20 07:45 1917416 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll
2011-08-07 12:24 . 2011-07-20 07:45 1917416 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll
2011-08-07 12:24 . 2011-07-20 07:45 177640 ----a-w- c:\windows\system32\drivers\ssadmdm.sys
2011-08-07 12:24 . 2011-07-20 07:45 16872 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys
2011-08-07 12:24 . 2011-07-20 07:45 157672 ----a-w- c:\windows\system32\drivers\ssadbus.sys
2011-08-07 12:24 . 2011-07-20 07:45 13800 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys
2011-08-07 12:24 . 2011-07-20 07:45 13800 ----a-w- c:\windows\system32\drivers\ssadwh.sys
2011-08-07 12:24 . 2011-07-20 07:45 13288 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys
2011-08-07 12:24 . 2011-07-20 07:45 13288 ----a-w- c:\windows\system32\drivers\ssadcm.sys
2011-08-07 12:24 . 2011-07-20 07:45 146920 ----a-w- c:\windows\system32\drivers\ssadserd.sys
2011-08-07 12:21 . 2011-08-07 12:21 -------- d-----w- c:\users\Ranndy\AppData\Local\Downloaded Installations
2011-08-07 09:58 . 2011-08-07 09:58 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-08-05 14:33 . 2011-08-05 14:59 -------- d-----w- c:\programdata\Uniblue
2011-08-05 10:27 . 2011-08-16 13:55 -------- d-----w- c:\users\Ranndy\AppData\Roaming\AIMP
2011-08-05 10:26 . 2011-08-05 10:26 -------- d-----w- c:\program files (x86)\AIMP2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-19 11:26 . 2011-07-05 17:10 13824 ----a-w- c:\windows\SysWow64\slwga.dll
2011-08-19 11:26 . 2011-07-05 17:10 14848 ----a-w- c:\windows\system32\slwga.dll
2011-08-19 11:25 . 2011-07-05 17:10 419840 ----a-w- c:\windows\system32\systemcpl.dll
2011-08-19 11:25 . 2011-07-05 17:10 833024 ----a-w- c:\windows\SysWow64\user32.dll
2011-08-19 11:25 . 2011-07-05 17:10 1008640 ----a-w- c:\windows\system32\user32.dll
2011-08-09 19:13 . 2011-07-08 13:23 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-08-09 19:13 . 2011-07-08 13:23 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-08-09 19:08 . 2011-07-08 13:23 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-08-03 11:50 . 2011-07-05 18:18 8355944 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-08-03 11:50 . 2011-07-05 17:02 2758760 ----a-w- c:\windows\system32\nvapi64.dll
2011-08-03 11:50 . 2011-07-05 17:02 12636776 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-08-03 11:50 . 2011-04-07 21:19 980072 ----a-w- c:\windows\system32\nvvsvc.exe
2011-08-03 11:50 . 2011-04-07 21:19 61544 ----a-w- c:\windows\system32\nvshext.dll
2011-08-03 11:50 . 2011-04-07 21:19 335976 ----a-w- c:\windows\system32\nvhotkey.dll
2011-08-03 11:50 . 2011-04-07 21:19 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-08-03 11:50 . 2011-04-07 21:19 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:50 . 2011-04-07 21:19 836200 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2011-08-03 11:50 . 2011-04-07 21:19 6136936 ----a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:50 . 2011-04-07 21:18 3021416 ----a-w- c:\windows\system32\nvsvc64.dll
2011-08-03 01:31 . 2011-08-03 01:31 311912 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2011-07-26 15:26 . 2011-07-26 15:26 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2011-07-26 15:26 . 2011-07-26 15:26 325552 ----a-w- c:\windows\MASetupCaller.dll
2011-07-26 15:26 . 2011-07-26 15:26 30568 ----a-w- c:\windows\MusiccityDownload.exe
2011-07-26 15:26 . 2011-07-26 15:26 974848 ----a-w- c:\windows\SysWow64\cis-2.4.dll
2011-07-26 15:26 . 2011-07-26 15:26 81920 ----a-w- c:\windows\SysWow64\issacapi_bs-2.3.dll
2011-07-26 15:26 . 2011-07-26 15:26 65536 ----a-w- c:\windows\SysWow64\issacapi_pe-2.3.dll
2011-07-26 15:26 . 2011-07-26 15:26 57344 ----a-w- c:\windows\SysWow64\MTXSYNCICON.dll
2011-07-26 15:26 . 2011-07-26 15:26 57344 ----a-w- c:\windows\SysWow64\MK_Lyric.dll
2011-07-26 15:26 . 2011-07-26 15:26 57344 ----a-w- c:\windows\SysWow64\issacapi_se-2.3.dll
2011-07-26 15:26 . 2011-07-26 15:26 569344 ----a-w- c:\windows\SysWow64\muzdecode.ax
2011-07-26 15:26 . 2011-07-26 15:26 491520 ----a-w- c:\windows\SysWow64\muzapp.dll
2011-07-26 15:26 . 2011-07-26 15:26 49152 ----a-w- c:\windows\SysWow64\MaJGUILib.dll
2011-07-26 15:26 . 2011-07-26 15:26 45056 ----a-w- c:\windows\SysWow64\MaXMLProto.dll
2011-07-26 15:26 . 2011-07-26 15:26 45056 ----a-w- c:\windows\SysWow64\MACXMLProto.dll
2011-07-26 15:26 . 2011-07-26 15:26 40960 ----a-w- c:\windows\SysWow64\MTTELECHIP.dll
2011-07-26 15:26 . 2011-07-26 15:26 40960 ----a-w- c:\windows\SysWow64\MAMACExtract.dll
2011-07-26 15:26 . 2011-07-26 15:26 352256 ----a-w- c:\windows\SysWow64\MSLUR71.dll
2011-07-26 15:26 . 2011-07-26 15:26 258048 ----a-w- c:\windows\SysWow64\muzoggsp.ax
2011-07-26 15:26 . 2011-07-26 15:26 245760 ----a-w- c:\windows\SysWow64\MSCLib.dll
2011-07-26 15:26 . 2011-07-26 15:26 24576 ----a-w- c:\windows\SysWow64\MASetupCleaner.exe
2011-07-26 15:26 . 2011-07-26 15:26 200704 ----a-w- c:\windows\SysWow64\muzwmts.dll
2011-07-26 15:26 . 2011-07-26 15:26 155648 ----a-w- c:\windows\SysWow64\MSFLib.dll
2011-07-26 15:26 . 2011-07-26 15:26 143360 ----a-w- c:\windows\SysWow64\3DAudio.ax
2011-07-26 15:26 . 2011-07-26 15:26 135168 ----a-w- c:\windows\SysWow64\muzaf1.dll
2011-07-26 15:26 . 2011-07-26 15:26 131072 ----a-w- c:\windows\SysWow64\muzmpgsp.ax
2011-07-26 15:26 . 2011-07-26 15:26 122880 ----a-w- c:\windows\SysWow64\muzeffect.ax
2011-07-26 15:26 . 2011-07-26 15:26 118784 ----a-w- c:\windows\SysWow64\MaDRM.dll
2011-07-26 15:26 . 2011-07-26 15:26 110592 ----a-w- c:\windows\SysWow64\muzmp4sp.ax
2011-07-09 17:57 . 2011-07-08 11:29 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-07-09 17:57 . 2011-07-08 11:29 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-07-09 17:57 . 2011-07-08 11:29 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-07-09 17:57 . 2011-07-08 11:29 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-07-05 18:15 . 2011-07-05 18:15 961024 ----a-w- c:\windows\system32\CPFilters.dll
2011-07-05 18:15 . 2011-07-05 18:15 850944 ----a-w- c:\windows\SysWow64\sbe.dll
2011-07-05 18:15 . 2011-07-05 18:15 723968 ----a-w- c:\windows\system32\EncDec.dll
2011-07-05 18:15 . 2011-07-05 18:15 642560 ----a-w- c:\windows\SysWow64\CPFilters.dll
2011-07-05 18:15 . 2011-07-05 18:15 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-07-05 18:15 . 2011-07-05 18:15 258560 ----a-w- c:\windows\system32\mpg2splt.ax
2011-07-05 18:15 . 2011-07-05 18:15 200192 ----a-w- c:\windows\SysWow64\mpg2splt.ax
2011-07-05 18:15 . 2011-07-05 18:15 1119232 ----a-w- c:\windows\system32\sbe.dll
2011-07-05 18:15 . 2011-07-05 18:15 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-05 18:15 . 2011-07-05 18:15 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-05 18:15 . 2011-07-05 18:15 46080 ----a-w- c:\windows\system32\atmlib.dll
2011-07-05 18:15 . 2011-07-05 18:15 366080 ----a-w- c:\windows\system32\atmfd.dll
2011-07-05 18:15 . 2011-07-05 18:15 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-07-05 18:15 . 2011-07-05 18:15 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
2011-07-05 18:15 . 2011-07-05 18:15 720896 ----a-w- c:\windows\system32\odbc32.dll
2011-07-05 18:15 . 2011-07-05 18:15 573440 ----a-w- c:\windows\SysWow64\odbc32.dll
2011-07-05 18:06 . 2011-07-05 18:06 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-07-05 17:27 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll
2011-07-05 17:27 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-07-04 11:43 . 2011-07-08 12:22 40112 ------w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-07-08 12:22 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-07-08 12:22 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-07-08 12:22 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-07-08 12:22 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2011-07-08 12:22 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-07-08 12:22 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2011-07-08 12:22 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-20 06:57 . 2011-07-10 17:54 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C28CAD29-D537-44C9-B544-E7E76BCE7B06}\mpengine.dll
2011-06-20 05:10 . 2011-06-20 05:10 3888128 ----a-w- c:\windows\SysWow64\x264vfw.dll
2011-06-17 07:34 . 2011-06-17 07:34 73728 ----a-w- c:\windows\SysWow64\xvid.ax
2011-06-17 07:26 . 2011-06-17 07:26 243200 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2011-06-17 07:17 . 2011-06-17 07:17 650752 ----a-w- c:\windows\SysWow64\xvidcore.dll
2011-06-14 22:08 . 2011-06-14 22:08 1264128 ----a-w- c:\windows\SysWow64\VSFilter.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-09-30 . B8C1054621A01EA1B548AC08E75F69F3 . 1008640 . . [6.1.7601.17105] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17105_none_2b6a3a4e83f3123d\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2011-08-19 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17105] .. c:\windows\system32\user32.dll
.
[-] 2011-08-19 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17105] .. c:\windows\SysWOW64\user32.dll
[7] 2010-09-29 . 629238E7A48A921DC55177B54D1A86C1 . 833024 . . [6.1.7601.17105] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17105_none_35bee4a0b853d438\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-07-26 08:15 2532680 ----a-w- c:\program files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" /nogui
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-04-18 7398752]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-07-26 1025352]
R3 connctfy;Connectify Service;c:\windows\system32\DRIVERS\connctfy.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files (x86)\IObit\Advanced SystemCare 4\ASCService.exe [2011-04-21 352656]
R4 Connectify;Connectify;c:\program files (x86)\Connectify\Connectifyd.exe [2011-03-09 892992]
R4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888]
R4 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R4 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\DRIVERS\risdsne64.sys [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-10-27 1974080]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S3 connctfyMP;connctfyMP;c:\windows\system32\DRIVERS\connctfy.sys [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-21 10775584]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-06-21 2040352]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_moh.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-09-03 15:43:39
ComboFix-quarantined-files.txt 2011-09-03 13:43
.
Před spuštěním: Volných bajtů: 395 776 958 464
Po spuštění: Volných bajtů: 395 423 326 208
.
- - End Of File - - 62A64B4527F6A0D5A8D2EA96E9CC2381

[bledulka]

Otestuj na www.virustotal.com
c:\windows\system32\user32.dll

[tanner]

nic..:(

btw: zkoušel jsem bon obnovení systému, ale hlásí to pořád chybu s tím, že mám zaplej antivir ( i když teda žádnej nemám )

[bledulka]

Vidím v logu AVG, takže antivir máš.

Start - ovládací panely - systém
-klikněte na kartu upřesnit - uplně dole na tlačítko Nastavení
-vyškrtněte políčko automaticky restartovat

-po naběhnutí systému by se měla objevit místo restartu modrá obrazovka. Opište si tam chyby, jako např STOP: 00000X565 atd a vložte je sem.
- pak restartujte a jděte do nouzového režimu , podívejte se, jestli se ve složce C:\WINDOWS\Minidump
nejsou nějaké soubory, pokud ano, dejte je do zipu a pošlete na http://www.leteckaposta.cz, link vložte zde.

[tanner]

ok, takže čekám na restart...

Ten AVG jsem si odinstaloval až po logu.

[bledulka]

Ok