Babičce se na fb objevil vir. Bohužel udělala vše podle "návodu", tedy proklikala, co se jí nabízelo údajně od správců fb. Prosím o kontrolu, jestli se jí tam něco nedostalo. Děkuji
Logfile of random's system information tool 1.10 (written by random/random)
Run by Uživatel at 2017-09-09 12:39:45
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 120 GB (79%) free of 153 GB
Total RAM: 2013 MB (33% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:40:45, on 9.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16737)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\ico.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\wincmd\TOTALCMD.EXE
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC74E8F2-6223-4CBD-AC4F-B29A82697137}: NameServer = 10.72.250.10,81.90.168.3
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: aswbIDSAgent - AVAST Software s.r.o. - C:\Program Files\AVAST Software\Avast\aswidsagent.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
--
End of file - 4108 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-07-12 774440]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568]
"Mouse Suite 98 Daemon"=C:\Windows\system32\ICO.EXE [2004-07-14 57344]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvLaunch.exe [2017-07-29 213832]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner.exe [2017-08-03 7680216]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2017-08-25 27832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221
"NoSimpleNetIDList"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2017-09-09 12:39:33 ----D---- C:\ProgramData\SWCUTemp
2017-09-08 19:52:14 ----D---- C:\ProgramData\AppData
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files\Skype
======List of files/folders modified in the last 1 month======
2017-09-09 12:39:51 ----D---- C:\Program Files\trend micro
2017-09-09 12:39:36 ----D---- C:\Windows\Temp
2017-09-09 12:39:33 ----HD---- C:\ProgramData
2017-09-09 12:38:38 ----D---- C:\Windows\system32\config
2017-09-09 12:37:42 ----D---- C:\Users\Uživatel\AppData\Roaming\Skype
2017-09-09 00:22:44 ----D---- C:\Windows\Logs
2017-09-09 00:22:43 ----SHD---- C:\System Volume Information
2017-09-08 22:48:32 ----D---- C:\Windows\tracing
2017-09-08 19:13:01 ----D---- C:\Windows\System32
2017-09-08 11:47:17 ----D---- C:\Windows\system32\drivers
2017-09-07 16:29:01 ----D---- C:\Windows\Prefetch
2017-09-05 16:28:25 ----SHD---- C:\Windows\Installer
2017-09-05 16:28:25 ----D---- C:\ProgramData\Skype
2017-09-05 16:28:20 ----RD---- C:\Program Files\Skype
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files
2017-08-19 19:58:57 ----D---- C:\Windows\system32\catroot2
2017-08-11 16:54:18 ----D---- C:\Windows\system32\Tasks
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 aswbidsh;aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [2017-07-29 157416]
R0 aswblog;aswblog; C:\Windows\system32\drivers\aswblogx.sys [2017-07-29 276736]
R0 aswbuniv;aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [2017-07-29 50384]
R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2017-07-12 70840]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2017-07-12 296312]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswbidsdriver;aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [2017-07-29 267008]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2017-07-12 39752]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2017-07-12 99536]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2017-08-09 774320]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2017-07-12 496976]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2017-08-09 123928]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2017-07-12 147688]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 usbcamcl;Driver for usbcamcl Device; C:\Windows\system32\DRIVERS\usbcamcl.sys [2011-08-18 28416]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 aswHwid;aswHwid; C:\Windows\system32\drivers\aswHwid.sys [2017-07-12 42824]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2017-07-29 263312]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 aswbIDSAgent;aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [2017-07-29 5815840]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2017-07-18 317408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-08-09 272384]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service; C:\Windows\system32\IEEtwCollector.exe [2016-03-31 102912]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2017-04-21 47224]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Vir na fb
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 118254
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Vir na fb
Zdravím!
Spusťte tuto utilitu:
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Vir na fb
# AdwCleaner 7.0.2.1 - Logfile created on Sun Sep 24 17:38:36 2017
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Home Premium (X86)
# Mode: clean
# Support: https://www.malwarebytes.com/support
***** [ Services ] *****
No malicious services deleted.
***** [ Folders ] *****
No malicious folders deleted.
***** [ Files ] *****
No malicious files deleted.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks deleted.
***** [ Registry ] *****
No malicious registry entries deleted.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries deleted.
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries deleted.
*************************
::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0
*************************
C:/AdwCleaner/AdwCleaner[S0].txt - [952 B] - [2017/9/24 17:38:15]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Home Premium (X86)
# Mode: clean
# Support: https://www.malwarebytes.com/support
***** [ Services ] *****
No malicious services deleted.
***** [ Folders ] *****
No malicious folders deleted.
***** [ Files ] *****
No malicious files deleted.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks deleted.
***** [ Registry ] *****
No malicious registry entries deleted.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries deleted.
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries deleted.
*************************
::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0
*************************
C:/AdwCleaner/AdwCleaner[S0].txt - [952 B] - [2017/9/24 17:38:15]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########
-
Rudy
- Site Admin
- Příspěvky: 118254
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Vir na fb
Toto je OK. Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.:commands
[Purity]
[Emptytemp]
[Emptyflash]
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Vir na fb
All processes killed
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: Uživatel
->Temp folder emptied: 107086049 bytes
->Temporary Internet Files folder emptied: 179596640 bytes
->FireFox cache emptied: 13512660 bytes
->Google Chrome cache emptied: 463976573 bytes
->Flash cache emptied: 1780 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 83384756 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 31197619 bytes
RecycleBin emptied: 1601764343 bytes
Total Files Cleaned = 2 366,00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Public
User: Uživatel
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.1.21.0 log created on 09272017_173711
Files moved on Reboot...
File move failed. C:\Windows\temp\_avast_\AvLock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160421151333.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160421151348.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160509065431.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160509065450.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143230.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143231.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143339.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160920124636.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160920124638.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316122957.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316122958.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316123014.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316124920.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316124924.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170405112933.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170405112944.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160129.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160130.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160141.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170531132900.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170531132901.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170712133319.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170712133336.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170729193840.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170729193851.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170811165353.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170811165355.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130302.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130303.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130314.log scheduled to be moved on reboot.
Registry entries deleted on Reboot...
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: Uživatel
->Temp folder emptied: 107086049 bytes
->Temporary Internet Files folder emptied: 179596640 bytes
->FireFox cache emptied: 13512660 bytes
->Google Chrome cache emptied: 463976573 bytes
->Flash cache emptied: 1780 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 83384756 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 31197619 bytes
RecycleBin emptied: 1601764343 bytes
Total Files Cleaned = 2 366,00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Public
User: Uživatel
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.1.21.0 log created on 09272017_173711
Files moved on Reboot...
File move failed. C:\Windows\temp\_avast_\AvLock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160421151333.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160421151348.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160509065431.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160509065450.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143230.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143231.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160910143339.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160920124636.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20160920124638.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316122957.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316122958.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316123014.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316124920.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170316124924.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170405112933.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170405112944.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160129.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160130.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170509160141.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170531132900.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170531132901.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170712133319.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170712133336.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170729193840.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170729193851.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170811165353.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170811165355.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130302.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130303.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\SafeZone Installer\safezone_installer_20170917130314.log scheduled to be moved on reboot.
Registry entries deleted on Reboot...
Re: Vir na fb
Logfile of random's system information tool 1.10 (written by random/random)
Run by Uživatel at 2017-09-27 17:42:43
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 122 GB (80%) free of 153 GB
Total RAM: 2013 MB (56% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:43:27, on 27.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16737)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\ico.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC74E8F2-6223-4CBD-AC4F-B29A82697137}: NameServer = 10.72.250.10,81.90.168.3
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: aswbIDSAgent - AVAST Software s.r.o. - C:\Program Files\AVAST Software\Avast\aswidsagent.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
--
End of file - 3724 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-09-17 800976]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568]
"Mouse Suite 98 Daemon"=C:\Windows\system32\ICO.EXE [2004-07-14 57344]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvLaunch.exe [2017-09-17 239856]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner.exe [2017-09-23 7685808]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2017-08-25 27832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221
"NoSimpleNetIDList"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2017-09-27 17:37:11 ----D---- C:\_OTM
2017-09-24 19:36:35 ----D---- C:\AdwCleaner
2017-09-17 08:16:32 ----A---- C:\Windows\system32\aswBoot.exe
2017-09-13 10:13:29 ----SHD---- C:\Config.Msi
2017-09-13 08:52:57 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 08:52:56 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 08:52:56 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 08:52:55 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 08:52:55 ----A---- C:\Windows\system32\ntkrnlpa.exe
2017-09-13 08:52:54 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 08:52:54 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 08:52:54 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 08:52:52 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\cic.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\smss.exe
2017-09-13 08:52:51 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 08:52:51 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 08:52:50 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 08:52:50 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 08:52:49 ----A---- C:\Windows\system32\adtschema.dll
2017-09-08 19:52:14 ----D---- C:\ProgramData\AppData
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files\Skype
======List of files/folders modified in the last 1 month======
2017-09-27 17:42:45 ----D---- C:\Program Files\trend micro
2017-09-27 17:42:00 ----D---- C:\Windows\Temp
2017-09-27 17:41:10 ----D---- C:\Users\Uživatel\AppData\Roaming\Skype
2017-09-27 17:39:35 ----HD---- C:\ProgramData
2017-09-27 17:38:59 ----D---- C:\Windows
2017-09-27 17:30:36 ----D---- C:\Windows\system32\config
2017-09-27 17:24:03 ----D---- C:\Windows\Logs
2017-09-27 17:23:19 ----SHD---- C:\System Volume Information
2017-09-27 12:25:01 ----D---- C:\Windows\system32\drivers
2017-09-24 16:11:26 ----D---- C:\Windows\tracing
2017-09-23 06:50:44 ----D---- C:\Program Files\CCleaner
2017-09-22 14:16:27 ----D---- C:\Windows\Prefetch
2017-09-19 00:06:47 ----D---- C:\Windows\system32\catroot2
2017-09-17 13:03:29 ----D---- C:\Windows\system32\Tasks
2017-09-17 13:02:40 ----D---- C:\Program Files\Common Files\AV
2017-09-17 08:16:32 ----D---- C:\Windows\System32
2017-09-13 18:43:25 ----D---- C:\Windows\rescache
2017-09-13 18:19:04 ----D---- C:\Windows\Microsoft.NET
2017-09-13 18:15:39 ----RSD---- C:\Windows\assembly
2017-09-13 10:43:29 ----D---- C:\Windows\inf
2017-09-13 10:43:29 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-13 10:37:12 ----D---- C:\Windows\winsxs
2017-09-13 10:35:04 ----D---- C:\Windows\system32\cs-CZ
2017-09-13 10:35:03 ----D---- C:\Windows\system32\en-US
2017-09-13 10:15:59 ----SHD---- C:\Windows\Installer
2017-09-13 10:13:04 ----D---- C:\Windows\system32\MRT
2017-09-13 10:11:04 ----AC---- C:\Windows\system32\MRT.exe
2017-09-13 08:50:59 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2017-09-13 08:50:53 ----D---- C:\Windows\system32\Macromed
2017-09-05 16:28:25 ----D---- C:\ProgramData\Skype
2017-09-05 16:28:20 ----RD---- C:\Program Files\Skype
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 aswbidsh;aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [2017-09-17 157416]
R0 aswblog;aswblog; C:\Windows\system32\drivers\aswblogx.sys [2017-09-17 276736]
R0 aswbuniv;aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [2017-09-17 50384]
R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2017-09-17 70864]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2017-09-25 296192]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswbidsdriver;aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [2017-09-17 267520]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2017-09-17 39784]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2017-09-17 99568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2017-09-17 773800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2017-09-17 500136]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2017-09-17 124952]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2017-09-18 148232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 usbcamcl;Driver for usbcamcl Device; C:\Windows\system32\DRIVERS\usbcamcl.sys [2011-08-18 28416]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 aswHwid;aswHwid; C:\Windows\system32\drivers\aswHwid.sys [2017-09-17 42856]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2017-09-17 275208]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 aswbIDSAgent;aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [2017-09-17 5830352]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2017-07-18 317408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-13 272384]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service; C:\Windows\system32\IEEtwCollector.exe [2016-03-31 102912]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2017-04-21 47224]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
-----------------EOF-----------------
Run by Uživatel at 2017-09-27 17:42:43
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 122 GB (80%) free of 153 GB
Total RAM: 2013 MB (56% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:43:27, on 27.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16737)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\ico.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC74E8F2-6223-4CBD-AC4F-B29A82697137}: NameServer = 10.72.250.10,81.90.168.3
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: aswbIDSAgent - AVAST Software s.r.o. - C:\Program Files\AVAST Software\Avast\aswidsagent.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
--
End of file - 3724 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-09-17 800976]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568]
"Mouse Suite 98 Daemon"=C:\Windows\system32\ICO.EXE [2004-07-14 57344]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvLaunch.exe [2017-09-17 239856]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner.exe [2017-09-23 7685808]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2017-08-25 27832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221
"NoSimpleNetIDList"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2017-09-27 17:37:11 ----D---- C:\_OTM
2017-09-24 19:36:35 ----D---- C:\AdwCleaner
2017-09-17 08:16:32 ----A---- C:\Windows\system32\aswBoot.exe
2017-09-13 10:13:29 ----SHD---- C:\Config.Msi
2017-09-13 08:52:57 ----A---- C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 08:52:56 ----A---- C:\Windows\system32\win32k.sys
2017-09-13 08:52:56 ----A---- C:\Windows\system32\shell32.dll
2017-09-13 08:52:55 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-09-13 08:52:55 ----A---- C:\Windows\system32\ntkrnlpa.exe
2017-09-13 08:52:54 ----A---- C:\Windows\system32\mmcndmgr.dll
2017-09-13 08:52:54 ----A---- C:\Windows\system32\mmc.exe
2017-09-13 08:52:54 ----A---- C:\Windows\system32\localspl.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\Wldap32.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\win32spl.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\usp10.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\ntprint.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\ntdll.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\nsisvc.dll
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\netbt.sys
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-09-13 08:52:53 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\winnsi.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\shdocvw.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\ole32.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\ntprint.exe
2017-09-13 08:52:52 ----A---- C:\Windows\system32\nsi.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\mmcshext.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\mmcbase.dll
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\srv.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\drivers\nsiproxy.sys
2017-09-13 08:52:52 ----A---- C:\Windows\system32\cic.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\winsrv.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\srcore.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\smss.exe
2017-09-13 08:52:51 ----A---- C:\Windows\system32\rpcss.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\rpcrt4.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\netbtugc.exe
2017-09-13 08:52:51 ----A---- C:\Windows\system32\msv1_0.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\lsasrv.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\KernelBase.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\kerberos.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\inetpp.dll
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-09-13 08:52:51 ----A---- C:\Windows\system32\advapi32.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 08:52:50 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\wpnpinst.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\wdigest.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\TSpkg.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\sspisrv.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\sspicli.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\srclient.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\schannel.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\secur32.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\rstrui.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\rpchttp.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\ncrypt.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\lsass.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\kernel32.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\inetppui.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\ExplorerFrame.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-09-13 08:52:50 ----A---- C:\Windows\system32\drivers\appid.sys
2017-09-13 08:52:50 ----A---- C:\Windows\system32\csrsrv.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\cryptbase.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\credssp.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\conhost.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\comcat.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\bcrypt.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\auditpol.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidsvc.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 08:52:50 ----A---- C:\Windows\system32\appidapi.dll
2017-09-13 08:52:50 ----A---- C:\Windows\system32\apisetschema.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 08:52:49 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\oleres.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\msobjs.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\msaudite.dll
2017-09-13 08:52:49 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 08:52:49 ----A---- C:\Windows\system32\adtschema.dll
2017-09-08 19:52:14 ----D---- C:\ProgramData\AppData
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files\Skype
======List of files/folders modified in the last 1 month======
2017-09-27 17:42:45 ----D---- C:\Program Files\trend micro
2017-09-27 17:42:00 ----D---- C:\Windows\Temp
2017-09-27 17:41:10 ----D---- C:\Users\Uživatel\AppData\Roaming\Skype
2017-09-27 17:39:35 ----HD---- C:\ProgramData
2017-09-27 17:38:59 ----D---- C:\Windows
2017-09-27 17:30:36 ----D---- C:\Windows\system32\config
2017-09-27 17:24:03 ----D---- C:\Windows\Logs
2017-09-27 17:23:19 ----SHD---- C:\System Volume Information
2017-09-27 12:25:01 ----D---- C:\Windows\system32\drivers
2017-09-24 16:11:26 ----D---- C:\Windows\tracing
2017-09-23 06:50:44 ----D---- C:\Program Files\CCleaner
2017-09-22 14:16:27 ----D---- C:\Windows\Prefetch
2017-09-19 00:06:47 ----D---- C:\Windows\system32\catroot2
2017-09-17 13:03:29 ----D---- C:\Windows\system32\Tasks
2017-09-17 13:02:40 ----D---- C:\Program Files\Common Files\AV
2017-09-17 08:16:32 ----D---- C:\Windows\System32
2017-09-13 18:43:25 ----D---- C:\Windows\rescache
2017-09-13 18:19:04 ----D---- C:\Windows\Microsoft.NET
2017-09-13 18:15:39 ----RSD---- C:\Windows\assembly
2017-09-13 10:43:29 ----D---- C:\Windows\inf
2017-09-13 10:43:29 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-13 10:37:12 ----D---- C:\Windows\winsxs
2017-09-13 10:35:04 ----D---- C:\Windows\system32\cs-CZ
2017-09-13 10:35:03 ----D---- C:\Windows\system32\en-US
2017-09-13 10:15:59 ----SHD---- C:\Windows\Installer
2017-09-13 10:13:04 ----D---- C:\Windows\system32\MRT
2017-09-13 10:11:04 ----AC---- C:\Windows\system32\MRT.exe
2017-09-13 08:50:59 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2017-09-13 08:50:53 ----D---- C:\Windows\system32\Macromed
2017-09-05 16:28:25 ----D---- C:\ProgramData\Skype
2017-09-05 16:28:20 ----RD---- C:\Program Files\Skype
2017-09-05 16:28:20 ----D---- C:\Program Files\Common Files
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 aswbidsh;aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [2017-09-17 157416]
R0 aswblog;aswblog; C:\Windows\system32\drivers\aswblogx.sys [2017-09-17 276736]
R0 aswbuniv;aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [2017-09-17 50384]
R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2017-09-17 70864]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2017-09-25 296192]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswbidsdriver;aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [2017-09-17 267520]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2017-09-17 39784]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2017-09-17 99568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2017-09-17 773800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2017-09-17 500136]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2017-09-17 124952]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2017-09-18 148232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 usbcamcl;Driver for usbcamcl Device; C:\Windows\system32\DRIVERS\usbcamcl.sys [2011-08-18 28416]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 aswHwid;aswHwid; C:\Windows\system32\drivers\aswHwid.sys [2017-09-17 42856]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2017-09-17 275208]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 aswbIDSAgent;aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [2017-09-17 5830352]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2017-07-18 317408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-13 272384]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-11-06 107848]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service; C:\Windows\system32\IEEtwCollector.exe [2016-03-31 102912]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2017-04-21 47224]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
-----------------EOF-----------------
-
Rudy
- Site Admin
- Příspěvky: 118254
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Vir na fb
V pořádku, log by již měl být OK.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
Rudy
- Site Admin
- Příspěvky: 118254
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Vir na fb
Nemáte zač! 
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?