Security Shield - vir zablokuje MSE a PC (Vyřešeno)

Zpráva

MrPierc · #1 Příspěvek od **MrPierc** » 26 črc 2012 21:05

Dobrý den, z ničeho nic na mě vyskočil nějaký nový antivir, zablokoval Microsoft Security Essential a nešlo na nic spustit. Jakmile jsem zapnul IE, Firefox nebo jen Total Commander, hned ho to vypnulo. Musel jsem spustit nouzový režim ve Win 7 a nainstalovat CCleaner. Pročistil, ale nyní stejne nejde zapnout MSE antivir a nelze najít přes Windows nové aktualizace systému. Internet už naštěstí jde.

Prosím o radu, co smazat!

Přikládám screen z Windows hledání updatů - nelze zapnout aktualizace a ani antivir.

Přikládám log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by MrPierc at 2012-07-26 22:00:17
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 38 GB (38%) free of 100 GB
Total RAM: 16367 MB (87% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:00:20, on 26.7.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Logitech\G930\G930.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files (x86)\Mumble\mumble.exe
C:\Windows\SysWOW64\DllHost.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Program Files\trend micro\MrPierc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Logitech G930] C:\Program Files (x86)\Logitech\G930\G930.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\RunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Smart TimeLock Service (Smart TimeLock) - Gigabyte Technology CO., LTD. - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9244 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\srvany.exe
C:\Windows\KMService.exe
\??\C:\Windows\system32\conhost.exe "422854408-151081989627518961-69795682911004612691493939932-921658207-1415190065
C:\Windows\SysWOW64\PnkBstrA.exe
"c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe"
"C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-2bcebc6f-d337-4cc2-a41f-30f7ec13f6db -SystemEventPortName:HostProcess-2239c5e8-c74a-4243-990c-df9797a7a2df -IoCancelEventPortName:HostProcess-a2b8649a-62af-42e1-89bf-723c9720f86b -NonStateChangingEventPortName:HostProcess-95ddad42-5283-4708-b144-db3c4501207e -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c65b9d6b-5157-4c95-9307-d86367999913
RPMDaemon.exe
"C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe" -m
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Logitech\G930\G930.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Opera\opera.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
"C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe"
"C:\Program Files (x86)\Mumble\mumble.exe"
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\totalcmd\TOTALCMD.EXE"
"C:\Windows\SysWOW64\svchost.exe" -g no -t 3 -o http://google-updaete.com:8344/ -u kmknkmgoc -p y
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2680.12f80c60.25710271 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 2680 "\\.\pipe\gecko-crash-server-pipe.2680" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe" --proxy-stub-channel=Flash3020.69DEEE30.41 --host-broker-channel=Flash3020.69DEEE30.18467 --host-pid=3020 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe" --channel=3300.006BF740.590407383 --proxy-stub-channel=Flash3020.69DEEE30.41 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll" --host-npapi-version=27 --type=renderer
"F:\Download_web\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\MrPierc\AppData\Roaming\Mozilla\Firefox\Profiles\oa60nmup.default

prefs.js - "browser.startup.homepage" - "http://www.google.cz"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... ource=2&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.3.300.265 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4]
"Description"=ESN Sonar browser plugin
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.122.0]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.4.1]
"Description"=
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.3.300.265 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\MrPierc\AppData\Roaming\Mozilla\Firefox\Profiles\oa60nmup.default\searchplugins\
askcom.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45d30484-7ded-43d9-957a-d2fd1f046511}]
GBHO.BHO - C:\Windows\system32\mscoree.dll [2010-11-05 444752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-04-04 453504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-04-04 157576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1d09c093-f71e-43c3-b948-19316cbd695e} - Smart Recovery 2 - C:\Windows\system32\mscoree.dll [2010-11-05 444752]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-01-04 11772520]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 1271168]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RPMKickstart"=C:\Program Files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe [2010-08-23 2552320]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"=Cmd.exe /c start AMD Accelerated Video Transcoding device initialization /min C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe aml []
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-17 252296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"Logitech G930"=C:\Program Files (x86)\Logitech\G930\G930.exe [2011-03-23 1516888]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-06-11 641704]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"EasyTuneVI"=C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [2007-07-26 20480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.FFDS"=ff_vfw.dll
"VIDC.LAGS"=lagarith.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-07-26 22:00:17 ----D---- C:\rsit
2012-07-26 22:00:17 ----D---- C:\Program Files\trend micro
2012-07-26 21:48:22 ----D---- C:\Program Files (x86)\CCleaner
2012-07-26 21:42:35 ----A---- C:\Windows\SYSWOW64\ghgh.txt
2012-07-14 20:48:46 ----D---- C:\Users\MrPierc\AppData\Roaming\Mumble
2012-07-14 20:48:18 ----D---- C:\Program Files (x86)\Mumble
2012-07-12 17:08:14 ----D---- C:\Program Files (x86)\JetAudio
2012-07-12 16:50:58 ----A---- C:\Windows\system32\unrar.dll
2012-07-12 16:50:58 ----A---- C:\Windows\system32\lagarith.dll
2012-07-12 16:50:56 ----A---- C:\Windows\system32\ff_vfw.dll
2012-07-12 16:50:55 ----D---- C:\Program Files\K-Lite Codec Pack x64
2012-07-11 11:01:20 ----A---- C:\Windows\system32\win32k.sys
2012-07-11 10:58:41 ----A---- C:\Windows\SYSWOW64\url.dll
2012-07-11 10:58:41 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-07-11 10:58:41 ----A---- C:\Windows\system32\url.dll
2012-07-11 10:58:41 ----A---- C:\Windows\system32\mshtmled.dll
2012-07-11 10:58:40 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-07-11 10:58:40 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-07-11 10:58:40 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-07-11 10:58:40 ----A---- C:\Windows\system32\urlmon.dll
2012-07-11 10:58:40 ----A---- C:\Windows\system32\ieui.dll
2012-07-11 10:58:40 ----A---- C:\Windows\system32\iertutil.dll
2012-07-11 10:58:39 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-07-11 10:58:39 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2012-07-11 10:58:39 ----A---- C:\Windows\system32\wininet.dll
2012-07-11 10:58:39 ----A---- C:\Windows\system32\jsproxy.dll
2012-07-11 10:58:39 ----A---- C:\Windows\system32\ieUnatt.exe
2012-07-11 10:58:38 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-07-11 10:58:38 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-07-11 10:58:38 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-07-11 10:58:38 ----A---- C:\Windows\system32\jscript9.dll
2012-07-11 10:58:38 ----A---- C:\Windows\system32\jscript.dll
2012-07-11 10:58:37 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-07-11 10:58:36 ----A---- C:\Windows\system32\mshtml.dll
2012-07-11 10:58:36 ----A---- C:\Windows\system32\ieframe.dll
2012-07-11 10:58:35 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-07-11 06:53:53 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2012-07-11 06:53:53 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2012-07-11 06:53:53 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2012-07-11 06:53:53 ----A---- C:\Windows\system32\msxml6.dll
2012-07-11 06:53:53 ----A---- C:\Windows\system32\msxml3r.dll
2012-07-11 06:53:53 ----A---- C:\Windows\system32\msxml3.dll
2012-07-11 06:53:52 ----A---- C:\Windows\system32\shell32.dll
2012-07-11 06:53:51 ----A---- C:\Windows\SYSWOW64\shell32.dll
2012-07-11 06:53:50 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2012-07-11 06:53:50 ----A---- C:\Windows\SYSWOW64\schannel.dll
2012-07-11 06:53:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2012-07-11 06:53:50 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2012-07-11 06:53:50 ----A---- C:\Windows\system32\schannel.dll
2012-07-11 06:53:50 ----A---- C:\Windows\system32\ncrypt.dll
2012-07-11 06:53:50 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-07-11 06:53:50 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-07-11 06:53:50 ----A---- C:\Windows\system32\drivers\cng.sys
2012-07-11 06:53:49 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2012-07-11 06:53:48 ----A---- C:\Windows\system32\cdosys.dll
2012-07-10 11:15:22 ----D---- C:\ProgramData\ATI
2012-07-10 10:33:48 ----D---- C:\Program Files (x86)\AMD APP
2012-07-09 19:13:29 ----D---- C:\Ubisoft
2012-07-08 09:22:27 ----D---- C:\Users\MrPierc\AppData\Roaming\Publish Providers
2012-07-08 09:16:53 ----D---- C:\ProgramData\Sony
2012-07-08 09:16:53 ----D---- C:\Program Files\Sony
2012-07-08 09:16:53 ----D---- C:\Program Files (x86)\Sony
2012-07-08 09:16:13 ----D---- C:\Users\MrPierc\AppData\Roaming\Sony
2012-07-08 08:26:20 ----A---- C:\WaxCrash.txt
2012-07-08 08:23:51 ----D---- C:\Program Files (x86)\Sonic Foundry
2012-07-08 08:23:51 ----D---- C:\Program Files (x86)\Pure Motion
2012-07-07 22:23:48 ----A---- C:\Windows\SYSWOW64\pncrt.dll
2012-07-07 22:23:29 ----D---- C:\Program Files (x86)\FreeTime
2012-07-07 08:49:33 ----D---- C:\Program Files (x86)\Conduit
2012-07-07 08:48:59 ----D---- C:\Program Files (x86)\uTorrent
2012-07-07 08:48:21 ----D---- C:\Users\MrPierc\AppData\Roaming\uTorrent
2012-07-01 07:41:33 ----D---- C:\Windows\SYSWOW64\Adobe
2012-06-28 15:26:33 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2012-06-28 15:26:33 ----A---- C:\Windows\system32\qdvd.dll
2012-06-27 18:12:18 ----D---- C:\Users\MrPierc\AppData\Roaming\Mozilla
2012-06-27 18:12:07 ----D---- C:\ProgramData\Mozilla
2012-06-27 18:12:07 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2012-06-27 18:12:05 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-06-27 17:59:27 ----D---- C:\ProgramData\CorelDRAW Graphics Suite X5
2012-06-27 17:57:33 ----D---- C:\ProgramData\Protexis
2012-06-27 17:57:32 ----D---- C:\Users\MrPierc\AppData\Roaming\Corel
2012-06-27 17:54:19 ----D---- C:\Program Files (x86)\Microsoft SDKs
2012-06-27 17:54:18 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 9.0
2012-06-27 17:53:44 ----D---- C:\ProgramData\Corel
2012-06-27 17:52:12 ----D---- C:\Program Files (x86)\Corel

======List of files/folders modified in the last 1 month======

2012-07-26 22:00:20 ----D---- C:\Windows\Prefetch
2012-07-26 22:00:17 ----RD---- C:\Program Files
2012-07-26 21:57:13 ----D---- C:\Users\MrPierc\AppData\Roaming\Media Player Classic
2012-07-26 21:57:10 ----D---- C:\Windows\Panther
2012-07-26 21:57:10 ----D---- C:\Windows\inf
2012-07-26 21:57:08 ----D---- C:\Windows\SoftwareDistribution
2012-07-26 21:57:08 ----D---- C:\Windows\Logs
2012-07-26 21:57:08 ----D---- C:\Windows
2012-07-26 21:56:30 ----D---- C:\Windows\System32
2012-07-26 21:56:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-07-26 21:56:08 ----RD---- C:\Program Files (x86)
2012-07-26 21:55:07 ----D---- C:\Windows\system32\Tasks
2012-07-26 21:52:38 ----A---- C:\Windows\SYSWOW64\log.txt
2012-07-26 21:51:37 ----D---- C:\Windows\Temp
2012-07-26 21:50:55 ----D---- C:\Windows\SysWOW64
2012-07-26 21:49:06 ----D---- C:\Windows\debug
2012-07-26 21:30:18 ----D---- C:\Windows\system32\config
2012-07-26 21:30:00 ----SHD---- C:\Windows\Installer
2012-07-25 17:39:19 ----SHD---- C:\System Volume Information
2012-07-25 07:54:41 ----D---- C:\Windows\system32\catroot2
2012-07-23 21:24:27 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2012-07-19 14:10:55 ----SD---- C:\Users\MrPierc\AppData\Roaming\Microsoft
2012-07-12 18:04:20 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-07-12 17:09:22 ----D---- C:\Users\MrPierc\AppData\Roaming\COWON
2012-07-12 17:08:15 ----D---- C:\Program Files (x86)\Common Files
2012-07-12 17:08:13 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-07-11 11:28:15 ----D---- C:\Windows\winsxs
2012-07-11 11:26:52 ----D---- C:\Windows\SYSWOW64\migration
2012-07-11 11:26:52 ----D---- C:\Windows\system32\migration
2012-07-11 11:26:52 ----D---- C:\Windows\system32\drivers
2012-07-11 11:26:52 ----D---- C:\Program Files\Internet Explorer
2012-07-11 11:26:52 ----D---- C:\Program Files (x86)\Internet Explorer
2012-07-11 11:01:26 ----D---- C:\Windows\system32\catroot
2012-07-11 11:00:36 ----D---- C:\ProgramData\Microsoft Help
2012-07-11 10:59:24 ----A---- C:\Windows\system32\MRT.exe
2012-07-10 11:15:22 ----HD---- C:\ProgramData
2012-07-10 10:33:33 ----D---- C:\Program Files\ATI Technologies
2012-07-10 10:32:25 ----D---- C:\Windows\system32\DriverStore
2012-07-08 08:23:51 ----D---- C:\Program Files (x86)\Adobe
2012-07-07 13:32:32 ----D---- C:\ProgramData\EA Logs
2012-07-05 23:03:38 ----D---- C:\Windows\system32\wdi
2012-07-04 07:17:25 ----D---- C:\Windows\system32\LogFiles
2012-07-03 08:28:45 ----SD---- C:\ProgramData\Microsoft
2012-07-01 07:41:59 ----D---- C:\Windows\Downloaded Program Files
2012-06-28 15:51:02 ----D---- C:\Windows\Microsoft.NET
2012-06-28 06:20:23 ----D---- C:\Program Files (x86)\Battlelog Web Plugins
2012-06-27 18:47:50 ----RSD---- C:\Windows\assembly
2012-06-27 17:53:51 ----RSD---- C:\Windows\Fonts
2012-06-27 09:02:03 ----D---- C:\Windows\rescache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-03-20 203888]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-06-11 10248192]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-06-11 367616]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver; C:\Windows\System32\Drivers\EtronHub3.sys [2011-01-26 39808]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver; C:\Windows\System32\Drivers\EtronXHCI.sys [2011-01-26 64256]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2012-07-26 25640]
R3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2012-07-26 30528]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-01-04 2697448]
R3 LADF_BakerCOnly;BakerC Filter Driver; C:\Windows\system32\DRIVERS\ladfBakerCamd64.sys [2011-03-18 410184]
R3 LADF_BakerROnly;BakerR Filter Driver; C:\Windows\system32\DRIVERS\ladfBakerRamd64.sys [2011-03-18 335688]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-24 412264]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-06-11 239616]
R2 KMService;KMService; C:\Windows\syswow64\srvany.exe [2012-05-20 8192]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-10-05 325656]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-05-28 76888]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [2010-03-10 189728]
R2 Smart TimeLock;Smart TimeLock Service; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-19 113120]
S3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-05-21 1255736]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 26 črc 2012 21:22

Zdravim a pekny vecer preji

Stahnete RKill http://download.bleepingcomputer.com/gr ... /rkill.exe

Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

MrPierc · #3 Příspěvek od **MrPierc** » 26 črc 2012 21:32

Děkuji za rychlou reakci! Hned to jdu zkusit!!!

#4 Příspěvek od **vyosek** » 26 črc 2012 21:35

OK, neni zac, RKill by mel udelat tez log, ten mi sem prosim dejte

MrPierc · #5 Příspěvek od **MrPierc** » 26 črc 2012 21:44

Rád bych postupoval dle Vámi uvedeného návodu, ale ihned po spuštění Rkill to napíše, že se to do 1 minuty restartuje a poté se to samo restartuje aniž bych něco zmáčknul.

Zasílám Rkill log:

Rkill by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/download/rkill/

Program started at: 07/26/2012 10:41:00 PM in x64 mode.
Windows Version: Windows 7

Checking for Windows services to stop.

* No malware services found to stop.

Checking for processes to terminate.

* C:\Windows\system32\services.exe (PID: 576) [WD-HEUR]

1 proccess terminated!

Checking Registry for malware related settings.

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks.

* No issues found.

Restarting Explorer.exe in order to apply changes.

Program finished at: 07/26/2012 10:41:13 PM
Execution time: 0 hours(s), 0 minute(s), and 13 seconds(s)

#6 Příspěvek od **vyosek** » 26 črc 2012 21:45

Pokracujte tedy ComboFixem

MrPierc · #7 Příspěvek od **MrPierc** » 26 črc 2012 21:59

Tak zasílám log z ComboFix:

ComboFix 12-07-27.02 - MrPierc 26.07.2012 22:52:33.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.16367.14563 [GMT 2:00]
Spuštěný z: c:\users\MrPierc\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\L\00000004.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\00000004.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\00000008.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\000000cb.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\80000000.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\80000032.@
c:\windows\Installer\{b27c532f-aa16-392e-4867-7b14529034d6}\U\80000064.@
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
Nakažená kopie c:\windows\system32\services.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\32788r22fwjfw\HarddiskVolumeShadowCopy3_!Windows!System32!services.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-26 do 2012-07-26 )))))))))))))))))))))))))))))))
.
.
2012-07-26 20:55 . 2012-07-26 20:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-26 20:15 . 2012-07-26 20:15 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Malwarebytes
2012-07-26 20:15 . 2012-07-26 20:15 -------- d-----w- c:\programdata\Malwarebytes
2012-07-26 20:00 . 2012-07-26 20:00 -------- d-----w- C:\rsit
2012-07-26 20:00 . 2012-07-26 20:00 -------- d-----w- c:\program files\trend micro
2012-07-26 19:48 . 2012-07-26 19:55 -------- d-----w- c:\program files (x86)\CCleaner
2012-07-26 19:47 . 2012-07-26 19:47 -------- d-----w- c:\users\MrPierc\AppData\Local\ElevatedDiagnostics
2012-07-26 16:18 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA10A1EC-9D13-492B-ACA3-A6017D04E8FD}\mpengine.dll
2012-07-25 15:39 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-14 20:27 . 2012-07-14 20:59 -------- d-----w- c:\users\MrPierc\AppData\Local\ESN Sonar
2012-07-14 18:59 . 2012-07-14 18:59 -------- d-----w- c:\users\MrPierc\AppData\Local\Mumble
2012-07-14 18:48 . 2012-07-26 20:19 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Mumble
2012-07-14 18:48 . 2012-07-14 19:10 -------- d-----w- c:\program files (x86)\Mumble
2012-07-12 15:08 . 2012-07-12 15:11 -------- d-----w- c:\program files (x86)\Common Files\COWON
2012-07-12 15:08 . 2012-07-12 15:11 -------- d-----w- c:\program files (x86)\JetAudio
2012-07-12 14:50 . 2012-06-09 17:21 206336 ----a-w- c:\windows\system32\unrar.dll
2012-07-12 14:50 . 2011-12-07 17:37 148992 ----a-w- c:\windows\system32\lagarith.dll
2012-07-12 14:50 . 2012-07-11 18:00 92160 ----a-w- c:\windows\system32\ff_vfw.dll
2012-07-12 14:50 . 2012-07-12 14:50 -------- d-----w- c:\program files\K-Lite Codec Pack x64
2012-07-11 09:01 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 04:53 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-07-10 09:15 . 2012-07-10 09:15 -------- d-----w- c:\programdata\ATI
2012-07-10 08:33 . 2012-07-10 08:33 -------- d-----w- c:\program files (x86)\AMD APP
2012-07-09 17:13 . 2012-07-09 17:13 -------- d-----w- C:\Ubisoft
2012-07-09 17:13 . 2012-07-11 18:53 -------- d-----w- c:\users\MrPierc\AppData\Local\Deployment
2012-07-09 17:13 . 2012-07-09 17:13 -------- d-----w- c:\users\MrPierc\AppData\Local\Apps
2012-07-08 07:22 . 2012-07-08 07:22 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Publish Providers
2012-07-08 07:16 . 2012-07-08 07:20 -------- d-----w- c:\users\MrPierc\AppData\Local\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\programdata\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\program files\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\program files (x86)\Sony
2012-07-08 07:16 . 2012-07-08 13:25 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Sony
2012-07-08 06:23 . 2012-07-08 06:23 -------- d-----w- c:\program files (x86)\Sonic Foundry
2012-07-08 06:23 . 2012-07-08 06:23 -------- d-----w- c:\program files (x86)\Pure Motion
2012-07-07 20:23 . 2012-07-07 20:23 -------- d-----w- c:\program files (x86)\FreeTime
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\users\MrPierc\AppData\Local\Google
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\users\MrPierc\AppData\Local\CRE
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\program files (x86)\Conduit
2012-07-07 06:49 . 2012-07-26 19:56 -------- d-----w- c:\users\MrPierc\AppData\Local\Conduit
2012-07-07 06:48 . 2012-07-08 06:09 -------- d-----w- c:\program files (x86)\uTorrent
2012-07-07 06:48 . 2012-07-26 19:57 -------- d-----w- c:\users\MrPierc\AppData\Roaming\uTorrent
2012-07-04 05:19 . 2012-05-20 16:08 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F55B79DE-6710-4DC8-AAA3-AB5C2E284DE7}\gapaengine.dll
2012-07-01 05:41 . 2012-07-01 05:41 -------- d-----w- c:\windows\SysWow64\Adobe
2012-06-28 13:26 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-06-28 13:26 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-06-27 16:14 . 2012-06-27 16:14 -------- d-----w- c:\users\MrPierc\AppData\Local\Macromedia
2012-06-27 16:12 . 2012-06-27 16:12 -------- d-----w- c:\users\MrPierc\AppData\Local\Mozilla
2012-06-27 16:12 . 2012-07-20 06:21 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-06-27 15:59 . 2012-06-27 15:59 -------- d-----w- c:\program files (x86)\Common Files\Corel
2012-06-27 15:57 . 2012-06-27 15:57 -------- d-----w- c:\programdata\Protexis
2012-06-27 15:57 . 2012-06-27 15:57 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Corel
2012-06-27 15:54 . 2012-06-27 15:54 -------- d-----w- c:\program files (x86)\Microsoft SDKs
2012-06-27 15:54 . 2012-06-27 15:54 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2012-06-27 15:53 . 2012-06-27 15:53 -------- d-----w- c:\program files (x86)\Common Files\Protexis
2012-06-27 15:53 . 2012-06-27 15:57 -------- d-----w- c:\programdata\Corel
2012-06-27 15:52 . 2012-06-27 15:52 -------- d-----w- c:\program files (x86)\Corel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-26 20:56 . 2012-05-20 15:14 25640 ----a-w- c:\windows\gdrv.sys
2012-07-26 20:51 . 2012-05-20 15:14 30528 ----a-w- c:\windows\GVTDrv64.sys
2012-07-26 20:03 . 2012-05-20 15:54 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-26 20:03 . 2012-05-20 15:54 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-23 19:24 . 2012-05-26 20:39 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-07-23 19:24 . 2012-05-25 15:24 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-07-23 19:21 . 2012-05-25 15:24 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-07-11 08:59 . 2012-05-21 14:55 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-11 18:59 . 2012-06-11 18:59 10248192 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-06-11 18:35 . 2012-06-11 18:35 70144 ----a-w- c:\windows\system32\coinst_8.98.dll
2012-06-11 18:29 . 2012-06-11 18:29 24826368 ----a-w- c:\windows\system32\atio6axx.dll
2012-06-11 18:00 . 2012-06-11 18:00 20467712 ----a-w- c:\windows\SysWow64\atioglxx.dll
2012-06-11 17:25 . 2012-06-11 17:25 163840 ----a-w- c:\windows\system32\atiapfxx.exe
2012-06-11 17:24 . 2012-04-06 02:21 924160 ----a-w- c:\windows\SysWow64\aticfx32.dll
2012-06-11 17:23 . 2012-02-15 03:17 1090560 ----a-w- c:\windows\system32\aticfx64.dll
2012-06-11 17:20 . 2012-04-06 02:16 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-06-11 17:19 . 2012-06-11 17:19 532992 ----a-w- c:\windows\system32\atieclxx.exe
2012-06-11 17:19 . 2012-06-11 17:19 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2012-06-11 17:17 . 2012-06-11 17:17 120320 ----a-w- c:\windows\system32\atitmm64.dll
2012-06-11 17:17 . 2012-06-11 17:17 21504 ----a-w- c:\windows\system32\atimuixx.dll
2012-06-11 17:17 . 2012-06-11 17:17 59392 ----a-w- c:\windows\system32\atiedu64.dll
2012-06-11 17:17 . 2012-06-11 17:17 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2012-06-11 17:16 . 2012-04-06 02:13 6301696 ----a-w- c:\windows\SysWow64\atidxx32.dll
2012-06-11 17:01 . 2012-02-15 02:52 6914560 ----a-w- c:\windows\system32\atidxx64.dll
2012-06-11 16:51 . 2012-04-06 01:34 4246528 ----a-w- c:\windows\system32\atiumd6a.dll
2012-06-11 16:45 . 2012-06-11 16:45 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2012-06-11 16:45 . 2012-06-11 16:45 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2012-06-11 16:45 . 2012-06-11 16:45 5480448 ----a-w- c:\windows\SysWow64\atiumdag.dll
2012-06-11 16:45 . 2012-06-11 16:45 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2012-06-11 16:45 . 2012-06-11 16:45 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2012-06-11 16:45 . 2012-06-11 16:45 15703040 ----a-w- c:\windows\system32\aticaldd64.dll
2012-06-11 16:43 . 2012-06-11 16:43 4729344 ----a-w- c:\windows\SysWow64\atiumdva.dll
2012-06-11 16:40 . 2012-06-11 16:40 13277696 ----a-w- c:\windows\SysWow64\aticaldd.dll
2012-06-11 16:36 . 2012-04-06 01:23 6605824 ----a-w- c:\windows\system32\atiumd64.dll
2012-06-11 16:27 . 2012-04-06 01:11 539136 ----a-w- c:\windows\system32\atiadlxx.dll
2012-06-11 16:26 . 2012-02-15 02:13 368640 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2012-06-11 16:26 . 2012-06-11 16:26 17920 ----a-w- c:\windows\system32\atig6pxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 41984 ----a-w- c:\windows\system32\atig6txx.dll
2012-06-11 16:26 . 2012-06-11 16:26 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 367616 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-06-11 16:25 . 2012-02-15 02:12 54784 ----a-w- c:\windows\system32\atiuxp64.dll
2012-06-11 16:25 . 2012-04-06 01:09 42496 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2012-06-11 16:25 . 2012-04-06 01:09 45056 ----a-w- c:\windows\system32\atiu9p64.dll
2012-06-11 16:24 . 2012-06-11 16:24 32768 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2012-06-11 16:24 . 2012-06-11 16:24 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\atimpc64.dll
2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\amdpcom64.dll
2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll
2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2012-06-11 11:50 . 2012-06-11 11:50 187392 ----a-w- c:\windows\system32\clinfo.exe
2012-06-11 11:50 . 2012-06-11 11:50 75264 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-06-11 11:50 . 2012-06-11 11:50 65024 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-06-11 11:50 . 2012-06-11 11:50 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-06-11 11:50 . 2012-06-11 11:50 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-06-11 11:50 . 2012-06-11 11:50 16457728 ----a-w- c:\windows\system32\amdocl64.dll
2012-06-11 11:49 . 2012-06-11 11:49 13008896 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-06-02 22:19 . 2012-06-26 15:08 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-26 15:08 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-26 15:08 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-26 15:08 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-26 15:08 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-26 15:08 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-26 15:08 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-26 15:08 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-26 15:08 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 05:45 . 2012-07-11 04:53 340992 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 04:40 . 2012-07-11 04:53 225280 ----a-w- c:\windows\SysWow64\schannel.dll
2012-05-28 19:50 . 2012-05-25 15:24 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-05-21 18:15 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-05-21 18:15 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-05-20 19:40 . 2012-05-20 19:41 8192 ----a-w- c:\windows\SysWow64\srvany.exe
2012-05-20 16:44 . 2012-05-20 16:44 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-05-20 16:44 . 2012-05-20 16:44 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-05-20 16:44 . 2012-05-20 16:44 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-05-20 16:44 . 2012-05-20 16:44 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-05-20 16:44 . 2012-05-20 16:44 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-05-20 16:44 . 2012-05-20 16:44 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-05-20 16:44 . 2012-05-20 16:44 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-05-20 16:44 . 2012-05-20 16:44 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-05-20 16:44 . 2012-05-20 16:44 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-05-20 16:44 . 2012-05-20 16:44 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-05-20 16:44 . 2012-05-20 16:44 65024 ----a-w- c:\windows\system32\pngfilt.dll
2012-05-20 16:44 . 2012-05-20 16:44 55296 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-05-20 16:44 . 2012-05-20 16:44 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-05-20 16:44 . 2012-05-20 16:44 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-05-20 16:44 . 2012-05-20 16:44 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-05-20 16:44 . 2012-05-20 16:44 267776 ----a-w- c:\windows\system32\ieaksie.dll
2012-05-20 16:44 . 2012-05-20 16:44 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-05-20 16:44 . 2012-05-20 16:44 222208 ----a-w- c:\windows\system32\msls31.dll
2012-05-20 16:44 . 2012-05-20 16:44 197120 ----a-w- c:\windows\system32\msrating.dll
2012-05-20 16:44 . 2012-05-20 16:44 163840 ----a-w- c:\windows\system32\ieakui.dll
2012-05-20 16:44 . 2012-05-20 16:44 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-05-20 16:44 . 2012-05-20 16:44 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-05-20 16:44 . 2012-05-20 16:44 149504 ----a-w- c:\windows\system32\occache.dll
2012-05-20 16:44 . 2012-05-20 16:44 145920 ----a-w- c:\windows\system32\iepeers.dll
2012-05-20 16:44 . 2012-05-20 16:44 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-05-20 16:44 . 2012-05-20 16:44 12288 ----a-w- c:\windows\system32\mshta.exe
2012-05-20 16:44 . 2012-05-20 16:44 11776 ----a-w- c:\windows\SysWow64\mshta.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Logitech G930"="c:\program files (x86)\Logitech\G930\G930.exe" [2011-03-23 1516888]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"EasyTuneVI"="c:\program files (x86)\GIGABYTE\ET6\ETCall.exe" [2007-07-26 20480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-26 250056]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-19 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-05-21 1255736]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-11 239616]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-06-11 10248192]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-06-11 367616]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-01-26 39808]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-01-26 64256]
S3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-07-26 30528]
S3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys [2011-03-18 410184]
S3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys [2011-03-18 335688]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-24 412264]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 20:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45d30484-7ded-43d9-957a-d2fd1f046511}]
2010-11-05 01:57 444752 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1d09c093-f71e-43c3-b948-19316cbd695e}"= "mscoree.dll" [2010-11-05 444752]
.
[HKEY_CLASSES_ROOT\CLSID\{1d09c093-f71e-43c3-b948-19316cbd695e}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RPMKickstart"="c:\program files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe" [2010-08-23 2552320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\MrPierc\AppData\Roaming\Mozilla\Firefox\Profiles\oa60nmup.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
SafeBoot-MsMpSvc
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\GIGABYTE\ET6\GUI.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Logitech\G930\LU\LULnchr.exe
c:\program files (x86)\Logitech\G930\LU\LogitechUpdate.exe
.
**************************************************************************
.
Celkový čas: 2012-07-26 22:58:39 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-07-26 20:58
.
Před spuštěním: Volných bajtů: 40 147 197 952
Po spuštění: Volných bajtů: 39 982 383 104
.
- - End Of File - - 7761C9B84F30F8F432FBA490E56C21A4

MrPierc · #8 Příspěvek od **MrPierc** » 27 črc 2012 07:26

Odinstaloval jsem Microsoft Security Essential a nyní lze přes Win7 nalézt aktualizace, ale nelze je nainstalovat. Nelze ani nainstalovat MSE. Mám tedy dle logu něco smazat?

#9 Příspěvek od **vyosek** » 27 črc 2012 08:50

Stahnete SytemLook http://images.malwareremoval.com/jpshor ... ok_x64.exe a ulozte jej na plochu

Do okna vlozte skript nize
Kód: Vybrat vše
```
:service
BITS
eventlog
```
Kliknete na Look
Tlacitko Look se zmeni na Scanning a zsedne
Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"Adobe ARM"=-

File::
c:\windows\Tasks\Adobe Flash Player Updater.job

Firefox::
FF - ProfilePath - c:\users\MrPierc\AppData\Roaming\Mozilla\Firefox\Profiles\oa60nmup.default\
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... ource=2&q=

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

MrPierc · #10 Příspěvek od **MrPierc** » 27 črc 2012 09:21

Taky tady zatím posílám SystemLook log:

SystemLook 30.07.11 by jpshortstuff
Log created at 10:20 on 27/07/2012 by MrPierc
Administrator - Elevation successful

========== service ==========

BITS - Unable to open Service Handle.

eventlog
Protokol událostí systému Windows
"Tato služba spravuje události a protokoly událostí. Podporuje protokolování událostí, vytváření dotazů na události, odběr událostí, archivaci protokolů událostí a správu metadat událostí. Může zobrazit události ve formátu XML i ve formátu prostého textu. Při zastavení této služby může dojít k ohrožení zabezpečení a spolehlivosti systému."
Current Status: Started
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Group: Event Log
SafeBoot: Minimal Network
Dependencies:
(none)
Dependant Services:
->Sběr událostí systému Windows (Wecsvc) (Stopped)
->Plánovač úloh (Schedule) (Started)

-= EOF =-

ComboFix Log:

ComboFix 12-07-27.02 - MrPierc 27.07.2012 10:28:41.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.16367.14375 [GMT 2:00]
Spuštěný z: c:\users\MrPierc\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MrPierc\Desktop\CFScript.txt.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\Adobe Flash Player Updater.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-27 do 2012-07-27 )))))))))))))))))))))))))))))))
.
.
2012-07-27 08:30 . 2012-07-27 08:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-26 20:15 . 2012-07-26 20:15 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Malwarebytes
2012-07-26 20:15 . 2012-07-26 20:15 -------- d-----w- c:\programdata\Malwarebytes
2012-07-26 20:00 . 2012-07-26 20:00 -------- d-----w- C:\rsit
2012-07-26 20:00 . 2012-07-26 20:00 -------- d-----w- c:\program files\trend micro
2012-07-26 19:48 . 2012-07-26 19:55 -------- d-----w- c:\program files (x86)\CCleaner
2012-07-26 19:47 . 2012-07-26 19:47 -------- d-----w- c:\users\MrPierc\AppData\Local\ElevatedDiagnostics
2012-07-14 20:27 . 2012-07-14 20:59 -------- d-----w- c:\users\MrPierc\AppData\Local\ESN Sonar
2012-07-14 18:59 . 2012-07-14 18:59 -------- d-----w- c:\users\MrPierc\AppData\Local\Mumble
2012-07-14 18:48 . 2012-07-26 20:19 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Mumble
2012-07-14 18:48 . 2012-07-14 19:10 -------- d-----w- c:\program files (x86)\Mumble
2012-07-12 15:08 . 2012-07-12 15:11 -------- d-----w- c:\program files (x86)\Common Files\COWON
2012-07-12 15:08 . 2012-07-12 15:11 -------- d-----w- c:\program files (x86)\JetAudio
2012-07-12 14:50 . 2012-06-09 17:21 206336 ----a-w- c:\windows\system32\unrar.dll
2012-07-12 14:50 . 2011-12-07 17:37 148992 ----a-w- c:\windows\system32\lagarith.dll
2012-07-12 14:50 . 2012-07-11 18:00 92160 ----a-w- c:\windows\system32\ff_vfw.dll
2012-07-12 14:50 . 2012-07-12 14:50 -------- d-----w- c:\program files\K-Lite Codec Pack x64
2012-07-11 09:01 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 04:53 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-07-10 09:15 . 2012-07-10 09:15 -------- d-----w- c:\programdata\ATI
2012-07-10 08:33 . 2012-07-10 08:33 -------- d-----w- c:\program files (x86)\AMD APP
2012-07-09 17:13 . 2012-07-09 17:13 -------- d-----w- C:\Ubisoft
2012-07-09 17:13 . 2012-07-27 06:00 -------- d-----w- c:\users\MrPierc\AppData\Local\Deployment
2012-07-09 17:13 . 2012-07-09 17:13 -------- d-----w- c:\users\MrPierc\AppData\Local\Apps
2012-07-08 07:22 . 2012-07-08 07:22 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Publish Providers
2012-07-08 07:16 . 2012-07-08 07:20 -------- d-----w- c:\users\MrPierc\AppData\Local\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\programdata\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\program files\Sony
2012-07-08 07:16 . 2012-07-08 07:16 -------- d-----w- c:\program files (x86)\Sony
2012-07-08 07:16 . 2012-07-08 13:25 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Sony
2012-07-08 06:23 . 2012-07-08 06:23 -------- d-----w- c:\program files (x86)\Sonic Foundry
2012-07-08 06:23 . 2012-07-08 06:23 -------- d-----w- c:\program files (x86)\Pure Motion
2012-07-07 20:23 . 2012-07-07 20:23 -------- d-----w- c:\program files (x86)\FreeTime
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\users\MrPierc\AppData\Local\Google
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\users\MrPierc\AppData\Local\CRE
2012-07-07 06:49 . 2012-07-07 06:49 -------- d-----w- c:\program files (x86)\Conduit
2012-07-07 06:49 . 2012-07-26 19:56 -------- d-----w- c:\users\MrPierc\AppData\Local\Conduit
2012-07-07 06:48 . 2012-07-08 06:09 -------- d-----w- c:\program files (x86)\uTorrent
2012-07-07 06:48 . 2012-07-27 08:28 -------- d-----w- c:\users\MrPierc\AppData\Roaming\uTorrent
2012-07-01 05:41 . 2012-07-01 05:41 -------- d-----w- c:\windows\SysWow64\Adobe
2012-06-28 13:26 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-06-28 13:26 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-06-27 16:14 . 2012-06-27 16:14 -------- d-----w- c:\users\MrPierc\AppData\Local\Macromedia
2012-06-27 16:12 . 2012-06-27 16:12 -------- d-----w- c:\users\MrPierc\AppData\Local\Mozilla
2012-06-27 16:12 . 2012-07-20 06:21 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-06-27 15:59 . 2012-06-27 15:59 -------- d-----w- c:\program files (x86)\Common Files\Corel
2012-06-27 15:57 . 2012-06-27 15:57 -------- d-----w- c:\programdata\Protexis
2012-06-27 15:57 . 2012-06-27 15:57 -------- d-----w- c:\users\MrPierc\AppData\Roaming\Corel
2012-06-27 15:54 . 2012-06-27 15:54 -------- d-----w- c:\program files (x86)\Microsoft SDKs
2012-06-27 15:54 . 2012-06-27 15:54 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2012-06-27 15:53 . 2012-06-27 15:53 -------- d-----w- c:\program files (x86)\Common Files\Protexis
2012-06-27 15:53 . 2012-06-27 15:57 -------- d-----w- c:\programdata\Corel
2012-06-27 15:52 . 2012-06-27 15:52 -------- d-----w- c:\program files (x86)\Corel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-27 08:32 . 2012-05-20 15:14 25640 ----a-w- c:\windows\gdrv.sys
2012-07-27 06:21 . 2012-05-20 15:14 30528 ----a-w- c:\windows\GVTDrv64.sys
2012-07-27 06:03 . 2012-05-20 15:54 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-27 06:03 . 2012-05-20 15:54 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-23 19:24 . 2012-05-26 20:39 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-07-23 19:24 . 2012-05-25 15:24 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-07-23 19:21 . 2012-05-25 15:24 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-07-11 08:59 . 2012-05-21 14:55 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-11 18:59 . 2012-06-11 18:59 10248192 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-06-11 18:35 . 2012-06-11 18:35 70144 ----a-w- c:\windows\system32\coinst_8.98.dll
2012-06-11 18:29 . 2012-06-11 18:29 24826368 ----a-w- c:\windows\system32\atio6axx.dll
2012-06-11 18:00 . 2012-06-11 18:00 20467712 ----a-w- c:\windows\SysWow64\atioglxx.dll
2012-06-11 17:25 . 2012-06-11 17:25 163840 ----a-w- c:\windows\system32\atiapfxx.exe
2012-06-11 17:24 . 2012-04-06 02:21 924160 ----a-w- c:\windows\SysWow64\aticfx32.dll
2012-06-11 17:23 . 2012-02-15 03:17 1090560 ----a-w- c:\windows\system32\aticfx64.dll
2012-06-11 17:20 . 2012-04-06 02:16 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-06-11 17:19 . 2012-06-11 17:19 532992 ----a-w- c:\windows\system32\atieclxx.exe
2012-06-11 17:19 . 2012-06-11 17:19 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2012-06-11 17:17 . 2012-06-11 17:17 120320 ----a-w- c:\windows\system32\atitmm64.dll
2012-06-11 17:17 . 2012-06-11 17:17 21504 ----a-w- c:\windows\system32\atimuixx.dll
2012-06-11 17:17 . 2012-06-11 17:17 59392 ----a-w- c:\windows\system32\atiedu64.dll
2012-06-11 17:17 . 2012-06-11 17:17 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2012-06-11 17:16 . 2012-04-06 02:13 6301696 ----a-w- c:\windows\SysWow64\atidxx32.dll
2012-06-11 17:01 . 2012-02-15 02:52 6914560 ----a-w- c:\windows\system32\atidxx64.dll
2012-06-11 16:51 . 2012-04-06 01:34 4246528 ----a-w- c:\windows\system32\atiumd6a.dll
2012-06-11 16:45 . 2012-06-11 16:45 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2012-06-11 16:45 . 2012-06-11 16:45 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2012-06-11 16:45 . 2012-06-11 16:45 5480448 ----a-w- c:\windows\SysWow64\atiumdag.dll
2012-06-11 16:45 . 2012-06-11 16:45 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2012-06-11 16:45 . 2012-06-11 16:45 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2012-06-11 16:45 . 2012-06-11 16:45 15703040 ----a-w- c:\windows\system32\aticaldd64.dll
2012-06-11 16:43 . 2012-06-11 16:43 4729344 ----a-w- c:\windows\SysWow64\atiumdva.dll
2012-06-11 16:40 . 2012-06-11 16:40 13277696 ----a-w- c:\windows\SysWow64\aticaldd.dll
2012-06-11 16:36 . 2012-04-06 01:23 6605824 ----a-w- c:\windows\system32\atiumd64.dll
2012-06-11 16:27 . 2012-04-06 01:11 539136 ----a-w- c:\windows\system32\atiadlxx.dll
2012-06-11 16:26 . 2012-02-15 02:13 368640 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2012-06-11 16:26 . 2012-06-11 16:26 17920 ----a-w- c:\windows\system32\atig6pxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 41984 ----a-w- c:\windows\system32\atig6txx.dll
2012-06-11 16:26 . 2012-06-11 16:26 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll
2012-06-11 16:26 . 2012-06-11 16:26 367616 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-06-11 16:25 . 2012-02-15 02:12 54784 ----a-w- c:\windows\system32\atiuxp64.dll
2012-06-11 16:25 . 2012-04-06 01:09 42496 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2012-06-11 16:25 . 2012-04-06 01:09 45056 ----a-w- c:\windows\system32\atiu9p64.dll
2012-06-11 16:24 . 2012-06-11 16:24 32768 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2012-06-11 16:24 . 2012-06-11 16:24 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\atimpc64.dll
2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\amdpcom64.dll
2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll
2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2012-06-11 11:50 . 2012-06-11 11:50 187392 ----a-w- c:\windows\system32\clinfo.exe
2012-06-11 11:50 . 2012-06-11 11:50 75264 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-06-11 11:50 . 2012-06-11 11:50 65024 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-06-11 11:50 . 2012-06-11 11:50 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-06-11 11:50 . 2012-06-11 11:50 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-06-11 11:50 . 2012-06-11 11:50 16457728 ----a-w- c:\windows\system32\amdocl64.dll
2012-06-11 11:49 . 2012-06-11 11:49 13008896 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-06-02 22:19 . 2012-06-26 15:08 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-26 15:08 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-26 15:08 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-26 15:08 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-26 15:08 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-26 15:08 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-26 15:08 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-26 15:08 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-26 15:08 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 05:45 . 2012-07-11 04:53 340992 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 04:40 . 2012-07-11 04:53 225280 ----a-w- c:\windows\SysWow64\schannel.dll
2012-05-28 19:50 . 2012-05-25 15:24 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-05-21 18:15 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-05-21 18:15 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-05-20 19:40 . 2012-05-20 19:41 8192 ----a-w- c:\windows\SysWow64\srvany.exe
2012-05-20 16:44 . 2012-05-20 16:44 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-05-20 16:44 . 2012-05-20 16:44 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-05-20 16:44 . 2012-05-20 16:44 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-05-20 16:44 . 2012-05-20 16:44 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-05-20 16:44 . 2012-05-20 16:44 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-05-20 16:44 . 2012-05-20 16:44 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-05-20 16:44 . 2012-05-20 16:44 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-05-20 16:44 . 2012-05-20 16:44 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-05-20 16:44 . 2012-05-20 16:44 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-05-20 16:44 . 2012-05-20 16:44 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-05-20 16:44 . 2012-05-20 16:44 65024 ----a-w- c:\windows\system32\pngfilt.dll
2012-05-20 16:44 . 2012-05-20 16:44 55296 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-05-20 16:44 . 2012-05-20 16:44 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-05-20 16:44 . 2012-05-20 16:44 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-05-20 16:44 . 2012-05-20 16:44 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-05-20 16:44 . 2012-05-20 16:44 267776 ----a-w- c:\windows\system32\ieaksie.dll
2012-05-20 16:44 . 2012-05-20 16:44 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-05-20 16:44 . 2012-05-20 16:44 222208 ----a-w- c:\windows\system32\msls31.dll
2012-05-20 16:44 . 2012-05-20 16:44 197120 ----a-w- c:\windows\system32\msrating.dll
2012-05-20 16:44 . 2012-05-20 16:44 163840 ----a-w- c:\windows\system32\ieakui.dll
2012-05-20 16:44 . 2012-05-20 16:44 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-05-20 16:44 . 2012-05-20 16:44 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-05-20 16:44 . 2012-05-20 16:44 149504 ----a-w- c:\windows\system32\occache.dll
2012-05-20 16:44 . 2012-05-20 16:44 145920 ----a-w- c:\windows\system32\iepeers.dll
2012-05-20 16:44 . 2012-05-20 16:44 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-05-20 16:44 . 2012-05-20 16:44 12288 ----a-w- c:\windows\system32\mshta.exe
2012-05-20 16:44 . 2012-05-20 16:44 11776 ----a-w- c:\windows\SysWow64\mshta.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-26_20.56.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-07-26 20:03 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-07-27 06:03 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-07-27 06:03 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-26 20:03 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-27 06:03 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-26 20:03 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-05-20 15:34 . 2012-07-27 06:23 57014 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-27 06:23 32338 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2012-05-20 15:00 . 2012-07-26 20:03 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-05-20 15:00 . 2012-07-27 06:46 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2012-05-20 15:00 . 2012-07-26 20:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2012-05-20 15:00 . 2012-07-27 06:46 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-26 20:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-27 06:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-05-20 15:34 . 2012-07-27 06:23 8152 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-828861725-3807086355-1025742366-1000_UserData.bin
- 2012-07-26 20:55 . 2012-07-26 20:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-27 08:31 . 2012-07-27 08:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-27 06:03 . 2012-07-27 06:03 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_268_Plugin.exe
- 2012-05-20 15:54 . 2012-07-26 20:03 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-05-20 15:54 . 2012-07-27 06:03 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2009-07-14 02:36 . 2012-07-27 06:26 615810 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2012-07-27 06:26 631054 c:\windows\system32\perfh005.dat
+ 2009-07-14 02:36 . 2012-07-27 06:26 106190 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2012-07-27 06:26 121708 c:\windows\system32\perfc005.dat
+ 2012-07-27 06:03 . 2012-07-27 06:03 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_268_Plugin.exe
+ 2009-07-14 04:46 . 2012-07-27 06:19 102664 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2012-05-20 16:03 . 2012-07-26 20:50 617360 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2012-05-20 16:03 . 2012-07-27 08:30 617360 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2009-07-14 05:01 . 2012-07-26 20:55 395460 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-07-27 08:30 395460 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-07-27 06:03 . 2012-07-27 06:03 9465032 c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll
+ 2012-07-27 06:03 . 2012-07-27 06:03 1536712 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_268.exe
+ 2012-07-27 06:03 . 2012-07-27 06:03 12315336 c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll
+ 2012-05-20 16:03 . 2012-07-27 08:30 55997292 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-828861725-3807086355-1025742366-1000-12288.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"Logitech G930"="c:\program files (x86)\Logitech\G930\G930.exe" [2011-03-23 1516888]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"EasyTuneVI"="c:\program files (x86)\GIGABYTE\ET6\ETCall.exe" [2007-07-26 20480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-05 2655768]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 250056]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-19 113120]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-05-21 1255736]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-11 239616]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-06-11 10248192]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-06-11 367616]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-01-26 39808]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-01-26 64256]
S3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-07-27 30528]
S3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys [2011-03-18 410184]
S3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys [2011-03-18 335688]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-24 412264]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45d30484-7ded-43d9-957a-d2fd1f046511}]
2010-11-05 01:57 444752 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1d09c093-f71e-43c3-b948-19316cbd695e}"= "mscoree.dll" [2010-11-05 444752]
.
[HKEY_CLASSES_ROOT\CLSID\{1d09c093-f71e-43c3-b948-19316cbd695e}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RPMKickstart"="c:\program files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe" [2010-08-23 2552320]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\MrPierc\AppData\Roaming\Mozilla\Firefox\Profiles\oa60nmup.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz
FF - prefs.js: network.proxy.type - 0
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\GIGABYTE\ET6\GUI.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2012-07-27 10:33:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-07-27 08:33
ComboFix2.txt 2012-07-26 20:58
.
Před spuštěním: Volných bajtů: 41 614 213 120
Po spuštění: Volných bajtů: 41 237 422 080
.
- - End Of File - - DB100C76AB08733BEE507C2EF71EFA12

#11 Příspěvek od **vyosek** » 27 črc 2012 10:13

Mel jste tam peknou mrchu v podobe ZeroAccessu - ten uz nyni neni problem lecit ale spise je problem opravit skody co napacha v systemu

Stahnete postupne nize uvedene soubory, kliknete na ne pravym a dejte "Spustit jako Administrator"

BITSWin7.reg http://www.sevenforums.com/attachments/ ... tswin7.reg
Reset_Windows_Update_History.bat http://www.sevenforums.com/attachments/ ... istory.bat
Reset_Reregister_Windows_Update_Components.bat http://www.sevenforums.com/attachments/ ... onents.bat
MS Fix 50202 http://go.microsoft.com/?linkid=9665683 spusti v AGGRESSIVE MODE

Restart PC a napiste ci aktualizace funguji

MrPierc · #12 Příspěvek od **MrPierc** » 27 črc 2012 11:25

Udělal jsem vše dle Vaší rady a vše funguje. Aktualizace jdou a MSE antivir taky! Velice děkuji! Jen nechápu, jak se mi mohl "ZeroAcces" mohl dostat do pc. Nic jsem neinstaloval, jen brouzdal na jednom webu a stáhl jeden soundtrack. To může takto sám přes web napadnout pc? To ten MSE moc dobrý tedy není. Zatím jsem žádné škody od viru nenašel, doufám, že žádné nebudou. Nebo jaké bych měl očekávat?

Ještě jednou Vám velice děkuji za vyřešení problému

#13 Příspěvek od **vyosek** » 27 črc 2012 19:36

Tak jeste uklidime

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

Jinak nemate zac, rado se stalo

MrPierc · #14 Příspěvek od **MrPierc** » 27 črc 2012 21:22

Uklizeno dle Vašeho návodu. Vše se zdá v pořádku. Děkuji za pomoc a přeji všem ostatním méně virů

#15 Příspěvek od **vyosek** » 28 črc 2012 07:12

Jeste jednou, neni zac

VIRY.CZ

Security Shield - vir zablokuje MSE a PC (Vyřešeno)

Security Shield - vir zablokuje MSE a PC (Vyřešeno)

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC

Re: Security Shield - vir zablokuje MSE a PC (Vyřešeno)

Re: Security Shield - vir zablokuje MSE a PC (Vyřešeno)

Re: Security Shield - vir zablokuje MSE a PC (Vyřešeno)