Trojan, svchost.exe

[Defaultzz]

Zdravím
Potřeboval bych od vás poradit, jak mám smazat koně z svchost.exe

nic nenašel: registryboosterem, tdsskiller, mbam
akorat při kontrole na virustotal.com 1/46
eSafe Win32.TrojanHorse 20130103

Log mi sem nešel napsat kuli omezenému počtu znaků... tak ho přidávám jako přílohu (doufám že to nebude vadit)
snad sem to udělal správně

http://pastebin.com/bd2pRfGn

[vyosek]

Zdravim

Logy priste davejte primo do tematu, klidne rozdelene do vice prispevku

Tu hlasku Vam dava antivir nebo jste si dal jen tak ten soubor na virustotal a je tam ten jeden nalez, coz bude falesna detekce

[Defaultzz]

Když sem si znovu četl návod tak sem předtím přehlédl:
Edit Rudy: Vzhledem k tomu, že z technických důvodů na zdejším fóru je omezen počet znaků na jeden post na 80000, může se stát, že se log do 1 postu nevejde. V takovém případě buď rozdělte log na více postů, nebo jej uložte někam na net a dejte odkaz. Děkuji za pochopení.

Ale dával sem to testovat protože to mam 10x ve správci úloh a to jedno bere něják moc výkonu..

[vyosek]

Mnozstvi svchost.exe spustenych v systemu je zavisle na tom, kolik je treba potreba spustit sluzeb, ktere se pres nej spousteji...Takze muze byt jeden ale i treba 26 krat spusteny...

Takze proto je vicekrat a ten jeden nalez na VT je falesny poplach

PC se chova nejak zpomalene nebo jsou nejake problemy

[Defaultzz]

jinak antivir nic nehlásí ani nehlásil (mám avast)

[vyosek]

To se mi zda byt OK

[Defaultzz]

právě že je to pomalejší.. když jsem ve hře tak se mi to občas úplně zasekne na 5 vteřin třeba a nebo mi padají FPS z 200-300 na 20... a někdy to prostě spadne úplně

[Defaultzz]

ale dělá to od té doby co mi to začalo brát tolik výkon.. stahoval sem hru a nejspíš to bylo v ní dělá to od té doby co sem ji nainstaloval

[vyosek]

stahoval sem hru a nejspíš to bylo v ní dělá to od té doby co sem ji nainstaloval

Predpokladam ze cracknutou ze To jsou ty slavne cracky, keygeny apod


Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Defaultzz]

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/03/2013 05:11:47 PM in x64 mode.
Windows Version: Windows 7 Professional Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Windows\SysWOW64\igfxupdate.exe (PID: 4564) [WD-HEUR]
* C:\Windows\SysWOW64\update\igfxupdate.exe (PID: 2652) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\James\Desktop\rkill\rkill-01-03-2013-05-11-51.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 01/03/2013 05:11:58 PM
Execution time: 0 hours(s), 0 minute(s), and 11 seconds(s)

[vyosek]

OK, pockam si jeste na ComboFix

[Defaultzz]

ComboFix 13-01-03.05 - James 03.01.2013 17:17:21.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8173.6729 [GMT 1:00]
Spuštěný z: c:\users\James\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\update\diablo121016.cl
c:\windows\SysWow64\update\diakgcn121016.cl
c:\windows\SysWow64\update\igfxupdate.exe
c:\windows\SysWow64\update\libcurl-4.dll
c:\windows\SysWow64\update\libeay32.dll
c:\windows\SysWow64\update\libidn-11.dll
c:\windows\SysWow64\update\libusb-1.0.dll
c:\windows\SysWow64\update\phatk121016.cl
c:\windows\SysWow64\update\poclbm121016.cl
c:\windows\SysWow64\update\poclbm121016GeForce 8800 GTv1w256l4.bin
c:\windows\SysWow64\update\pthreadGC2.dll
c:\windows\SysWow64\update\scrypt121016.cl
c:\windows\SysWow64\update\ssleay32.dll
c:\windows\SysWow64\update\zlib1.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-12-03 do 2013-01-03 )))))))))))))))))))))))))))))))
.
.
2013-01-03 16:21 . 2013-01-03 16:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-03 16:20 . 2013-01-03 16:20 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8640E464-9F14-4208-92B0-AE195B82023D}\offreg.dll
2013-01-03 15:27 . 2013-01-03 15:29 -------- d-----w- c:\program files\trend micro
2013-01-03 15:27 . 2013-01-03 15:27 -------- d-----w- C:\rsit
2013-01-03 14:36 . 2013-01-03 14:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-01-03 14:36 . 2013-01-03 14:36 -------- d-----w- c:\programdata\Malwarebytes
2013-01-03 14:36 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-03 12:47 . 2013-01-03 12:47 -------- d-----w- c:\program files (x86)\Uniblue
2013-01-01 23:45 . 2012-11-19 00:01 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8640E464-9F14-4208-92B0-AE195B82023D}\mpengine.dll
2012-12-31 22:47 . 2012-12-31 08:00 269824 ----a-w- c:\windows\SysWow64\igfxupdate.exe
2012-12-31 14:40 . 2012-11-14 10:59 160784 ----a-w- c:\windows\system32\drivers\ESLWireACD.sys
2012-12-31 14:39 . 2012-12-31 14:39 -------- d-----w- c:\program files\EslWire
2012-12-31 14:39 . 2012-12-31 14:39 -------- d-----w- c:\programdata\ESL Wire
2012-12-29 22:47 . 2013-01-03 16:21 -------- d-----w- c:\windows\SysWow64\update
2012-12-29 22:47 . 2012-12-31 08:00 410112 ----a-w- c:\windows\system32\taskhost.rs
2012-12-29 22:47 . 2012-12-31 08:00 269824 ----a-w- c:\windows\system32\SearchEngine.rs
2012-12-29 22:47 . 2012-12-30 10:54 307712 ----a-w- c:\windows\system32\SearchIndexer.dll
2012-12-29 21:59 . 2012-12-29 21:59 -------- d-----w- c:\programdata\TuneUp Software
2012-12-29 21:59 . 2012-12-29 21:59 -------- d-sh--w- c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2012-12-29 21:59 . 2012-12-29 21:59 -------- d--h--w- c:\programdata\Common Files
2012-12-29 21:58 . 2012-12-29 21:58 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-12-29 21:58 . 2012-12-29 21:58 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-12-29 21:57 . 2012-12-29 21:59 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-12-29 16:31 . 2012-12-29 16:31 -------- d-----w- c:\program files (x86)\Conduit
2012-12-29 16:31 . 2012-12-29 16:31 -------- d-----w- c:\program files (x86)\uTorrentControl_v2
2012-12-29 16:30 . 2012-12-29 16:31 -------- d-----w- c:\program files\uTorrent
2012-12-27 00:43 . 2012-12-27 00:43 -------- d-----w- c:\windows\Sun
2012-12-27 00:12 . 2012-12-27 00:12 -------- d-----w- c:\programdata\McAfee
2012-12-26 23:47 . 2012-12-26 23:47 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-12-26 08:06 . 2012-12-26 08:06 -------- d-----w- c:\windows\SysWow64\Wat
2012-12-26 08:06 . 2012-12-26 08:06 -------- d-----w- c:\windows\system32\Wat
2012-12-25 15:58 . 2012-07-26 07:40 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wdf01000.sys.mui
2012-12-25 15:58 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-25 15:58 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-25 15:58 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-25 15:52 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-12-25 15:46 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-25 15:46 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-25 15:46 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-25 15:46 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
2012-12-25 15:46 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2012-12-25 15:46 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-25 15:46 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-25 15:46 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-25 15:46 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-25 15:46 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-25 15:46 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-25 15:46 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-25 15:46 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-25 15:45 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-12-25 15:45 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-12-25 15:45 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-12-25 15:45 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-12-25 15:45 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-12-25 09:16 . 2012-12-29 20:13 -------- d-----w- c:\program files\mIRC
2012-12-25 05:14 . 2012-12-25 05:14 -------- d-----w- c:\program files\OBS
2012-12-25 03:44 . 2012-12-25 03:44 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-12-25 03:41 . 2012-12-25 05:13 -------- d-----w- c:\program files\FFsplit
2012-12-25 02:48 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-12-25 02:46 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-12-25 02:45 . 2012-10-03 17:56 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-12-25 02:44 . 2012-10-04 17:46 243200 ----a-w- c:\windows\system32\wow64.dll
2012-12-25 02:43 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-12-25 02:42 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-12-25 02:41 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
2012-12-25 02:41 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-12-25 02:41 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-12-25 02:41 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-12-25 02:41 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-12-25 02:41 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-12-25 02:41 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-12-25 02:41 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-12-25 02:31 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-12-25 02:31 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-12-25 02:31 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-12-25 02:26 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-12-25 02:26 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-12-25 02:26 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-12-25 02:26 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-12-25 02:26 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-12-25 02:26 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-12-25 02:26 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-12-25 02:26 . 2012-06-02 14:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-12-25 02:26 . 2012-06-02 14:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-12-25 01:51 . 2012-12-25 01:51 -------- d-----w- c:\windows\system32\SPReview
2012-12-25 01:25 . 2010-11-20 04:32 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\rdpwd.sys.mui
2012-12-25 01:25 . 2010-11-20 04:26 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\tsusbflt.sys.mui
2012-12-25 01:25 . 2010-11-20 04:32 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\GAGP30KX.SYS.mui
2012-12-25 01:25 . 2010-11-20 04:32 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdclass.sys.mui
2012-12-25 01:22 . 2010-11-20 04:34 199552 ----a-w- c:\windows\system32\drivers\vmbus.sys
2012-12-25 01:20 . 2012-12-25 01:20 -------- d-----w- c:\windows\system32\EventProviders
2012-12-25 01:17 . 2012-12-25 01:18 -------- d-----w- c:\program files\Winrar
2012-12-25 01:07 . 2012-10-30 22:51 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-12-25 01:07 . 2012-10-30 22:51 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-12-25 01:06 . 2012-10-15 16:59 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-12-25 01:06 . 2012-10-30 22:51 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-12-25 01:06 . 2012-10-30 22:51 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-12-25 01:06 . 2012-10-30 22:51 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-12-25 01:06 . 2012-10-30 22:50 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-12-25 01:06 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2012-12-25 01:06 . 2012-10-30 22:50 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-12-25 01:06 . 2012-12-25 01:06 -------- d-----w- c:\programdata\AVAST Software
2012-12-25 01:06 . 2012-12-25 01:06 -------- d-----w- c:\program files\AVAST Software
2012-12-25 01:02 . 2012-12-25 01:02 -------- d-----w- c:\windows\system32\appmgmt
2012-12-25 00:54 . 2012-12-25 00:54 -------- d-----w- c:\programdata\SplitMediaLabs
2012-12-25 00:30 . 2008-10-15 05:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 452440 ----a-w- c:\windows\SysWow64\d3dx10_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 2605920 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 2036576 ----a-w- c:\windows\SysWow64\D3DCompiler_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 5631312 ----a-w- c:\windows\system32\D3DX9_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 4379984 ----a-w- c:\windows\SysWow64\D3DX9_40.dll
2012-12-25 00:24 . 2012-12-25 00:24 -------- d-----w- c:\program files\TeamSpeak 3 Client
2012-12-24 22:23 . 2012-12-25 01:58 -------- d-----w- c:\program files (x86)\Common Files\Steam
2012-12-24 21:55 . 2012-12-24 21:55 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-12-24 21:55 . 2012-12-25 01:57 -------- d-----w- c:\users\UpdatusUser
2012-12-24 21:54 . 2012-12-24 21:55 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-12-24 21:54 . 2013-01-03 15:09 -------- d-----w- c:\programdata\NVIDIA
2012-12-24 21:54 . 2012-12-01 05:49 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-12-24 21:54 . 2012-12-01 05:49 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-12-24 21:54 . 2012-12-01 05:49 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-12-24 21:54 . 2012-12-01 05:49 890216 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-24 21:54 . 2012-12-01 05:48 6223208 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-24 21:54 . 2012-12-01 05:48 3311464 ----a-w- c:\windows\system32\nvsvc64.dll
2012-12-24 21:54 . 2012-12-03 15:47 60776 ----a-w- c:\windows\system32\OpenCL.dll
2012-12-24 21:54 . 2012-12-03 15:47 52584 ----a-w- c:\windows\SysWow64\OpenCL.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-25 15:50 . 2012-12-25 15:50 249344 ----a-w- c:\windows\system32\webcheck.dll
2012-12-25 15:50 . 2012-12-25 15:50 203776 ----a-w- c:\windows\SysWow64\webcheck.dll
2012-12-25 01:48 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-12-25 01:48 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-12-03 15:47 . 2009-06-10 20:37 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-11-30 21:43 . 2012-11-30 21:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-10-16 08:38 . 2012-12-25 02:43 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-12-25 02:43 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-12-25 02:43 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{7473b6bd-4691-4744-a82b-7854eb3d70b6}"= "c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{7473b6bd-4691-4744-a82b-7854eb3d70b6}"= "c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryBooster"="c:\program files (x86)\Uniblue\RegistryBooster\launcher.exe" [2012-07-08 68000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2012-05-11 5119600]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-12-25 1255736]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-29 283200]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys [2012-11-14 160784]
S2 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe [2012-11-14 678416]
S2 SearchIndexer;Search Indexer;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2012-05-04 27760]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-07-29 56960]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-07-29 79104]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-08-23 565352]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-05-04 2196592]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-01-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-24 00:13]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-24 21:42]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-24 21:42]
.
2013-01-03 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2013-01-03 13:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
SearchIndexer
SearchIndexer
SearchIndexer
SearchIndexer
SearchIndexer
SearchIndexer
.
------- Doplňkový sken -------
.
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 212.96.167.50 212.96.167.18 89.190.50.18
FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\a6h6pa1t.default\
FF - ExtSQL: 2012-12-25 02:07; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2012-12-29 17:31; {7473b6bd-4691-4744-a82b-7854eb3d70b6}; c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\a6h6pa1t.default\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-01-03 17:23:53
ComboFix-quarantined-files.txt 2013-01-03 16:23
.
Před spuštěním: Volných bajtů: 117 193 433 088
Po spuštění: Volných bajtů: 117 285 564 416
.
- - End Of File - - 3A295B11A07CC46CA757961ECF0E00A0

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Collect::
  c:\windows\SysWow64\igfxupdate.exe
  c:\windows\system32\taskhost.rs
  c:\windows\system32\SearchEngine.rs
  c:\windows\system32\SearchIndexer.dll
  
  Folder::
  c:\windows\SysWow64\update
  
  File::
  c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{7473b6bd-4691-4744-a82b-7854eb3d70b6}"=-
  [-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
  "{7473b6bd-4691-4744-a82b-7854eb3d70b6}"=-
  [-HKEY_CLASSES_ROOT\clsid\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "RegistryBooster"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  "Adobe ARM"=-
  "SunJavaUpdateSched"=-
  
  Driver::
  SearchIndexer
  
  NetSvc::
  SearchIndexer
  
  NetSvc64::
  SearchIndexer
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  
  ClearJavaCache::
  
  Reboot::
  
  

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[Defaultzz]

ComboFix 13-01-03.05 - James 03.01.2013 17:56:48.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8173.6485 [GMT 1:00]
Spuštěný z: c:\users\James\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\James\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll"
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll
c:\windows\system32\SearchEngine.rs
c:\windows\system32\SearchIndexer.dll
c:\windows\system32\taskhost.rs
c:\windows\SysWow64\igfxupdate.exe
c:\windows\SysWow64\update
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SearchIndexer
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-12-03 do 2013-01-03 )))))))))))))))))))))))))))))))
.
.
2013-01-03 15:27 . 2013-01-03 15:29 -------- d-----w- c:\program files\trend micro
2013-01-03 15:27 . 2013-01-03 15:27 -------- d-----w- C:\rsit
2013-01-03 14:36 . 2013-01-03 14:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-01-03 14:36 . 2013-01-03 14:36 -------- d-----w- c:\programdata\Malwarebytes
2013-01-03 14:36 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-03 12:47 . 2013-01-03 12:47 -------- d-----w- c:\program files (x86)\Uniblue
2013-01-01 23:45 . 2012-11-19 00:01 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8640E464-9F14-4208-92B0-AE195B82023D}\mpengine.dll
2012-12-31 14:40 . 2012-11-14 10:59 160784 ----a-w- c:\windows\system32\drivers\ESLWireACD.sys
2012-12-31 14:39 . 2012-12-31 14:39 -------- d-----w- c:\program files\EslWire
2012-12-31 14:39 . 2012-12-31 14:39 -------- d-----w- c:\programdata\ESL Wire
2012-12-29 21:59 . 2012-12-29 21:59 -------- d-----w- c:\programdata\TuneUp Software
2012-12-29 21:59 . 2012-12-29 21:59 -------- d-sh--w- c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2012-12-29 21:59 . 2012-12-29 21:59 -------- d--h--w- c:\programdata\Common Files
2012-12-29 21:58 . 2012-12-29 21:58 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-12-29 21:58 . 2012-12-29 21:58 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-12-29 21:57 . 2012-12-29 21:59 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-12-29 16:31 . 2012-12-29 16:31 -------- d-----w- c:\program files (x86)\Conduit
2012-12-29 16:31 . 2013-01-03 17:00 -------- d-----w- c:\program files (x86)\uTorrentControl_v2
2012-12-29 16:30 . 2012-12-29 16:31 -------- d-----w- c:\program files\uTorrent
2012-12-27 00:43 . 2012-12-27 00:43 -------- d-----w- c:\windows\Sun
2012-12-27 00:12 . 2012-12-27 00:12 -------- d-----w- c:\programdata\McAfee
2012-12-26 23:47 . 2012-12-26 23:47 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-12-26 08:06 . 2012-12-26 08:06 -------- d-----w- c:\windows\SysWow64\Wat
2012-12-26 08:06 . 2012-12-26 08:06 -------- d-----w- c:\windows\system32\Wat
2012-12-25 15:58 . 2012-07-26 07:40 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wdf01000.sys.mui
2012-12-25 15:58 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-25 15:58 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-25 15:58 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-25 15:52 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-12-25 15:46 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-25 15:46 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-25 15:46 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-25 15:46 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
2012-12-25 15:46 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2012-12-25 15:46 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-25 15:46 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-25 15:46 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-25 15:46 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-25 15:46 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-25 15:46 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-25 15:46 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-25 15:46 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-25 15:45 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-12-25 15:45 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-12-25 15:45 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-12-25 15:45 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-12-25 15:45 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-12-25 09:16 . 2012-12-29 20:13 -------- d-----w- c:\program files\mIRC
2012-12-25 05:14 . 2012-12-25 05:14 -------- d-----w- c:\program files\OBS
2012-12-25 03:44 . 2012-12-25 03:44 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-12-25 03:41 . 2012-12-25 05:13 -------- d-----w- c:\program files\FFsplit
2012-12-25 02:48 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-12-25 02:46 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-12-25 02:45 . 2012-10-03 17:56 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-12-25 02:44 . 2012-10-04 17:46 243200 ----a-w- c:\windows\system32\wow64.dll
2012-12-25 02:43 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-12-25 02:42 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-12-25 02:41 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
2012-12-25 02:41 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-12-25 02:41 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-12-25 02:41 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-12-25 02:41 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-12-25 02:41 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-12-25 02:41 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-12-25 02:41 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-12-25 02:31 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-12-25 02:31 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-12-25 02:31 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-12-25 02:26 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-12-25 02:26 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-12-25 02:26 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-12-25 02:26 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-12-25 02:26 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-12-25 02:26 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-12-25 02:26 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-12-25 02:26 . 2012-06-02 14:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-12-25 02:26 . 2012-06-02 14:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-12-25 01:51 . 2012-12-25 01:51 -------- d-----w- c:\windows\system32\SPReview
2012-12-25 01:25 . 2010-11-20 04:32 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\rdpwd.sys.mui
2012-12-25 01:25 . 2010-11-20 04:26 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\tsusbflt.sys.mui
2012-12-25 01:25 . 2010-11-20 04:32 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\GAGP30KX.SYS.mui
2012-12-25 01:25 . 2010-11-20 04:32 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdclass.sys.mui
2012-12-25 01:22 . 2010-11-20 04:34 199552 ----a-w- c:\windows\system32\drivers\vmbus.sys
2012-12-25 01:20 . 2012-12-25 01:20 -------- d-----w- c:\windows\system32\EventProviders
2012-12-25 01:17 . 2012-12-25 01:18 -------- d-----w- c:\program files\Winrar
2012-12-25 01:07 . 2012-10-30 22:51 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-12-25 01:07 . 2012-10-30 22:51 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-12-25 01:06 . 2012-10-15 16:59 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-12-25 01:06 . 2012-10-30 22:51 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-12-25 01:06 . 2012-10-30 22:51 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-12-25 01:06 . 2012-10-30 22:51 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-12-25 01:06 . 2012-10-30 22:50 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-12-25 01:06 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2012-12-25 01:06 . 2012-10-30 22:50 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-12-25 01:06 . 2012-12-25 01:06 -------- d-----w- c:\programdata\AVAST Software
2012-12-25 01:06 . 2012-12-25 01:06 -------- d-----w- c:\program files\AVAST Software
2012-12-25 01:02 . 2012-12-25 01:02 -------- d-----w- c:\windows\system32\appmgmt
2012-12-25 00:54 . 2012-12-25 00:54 -------- d-----w- c:\programdata\SplitMediaLabs
2012-12-25 00:30 . 2008-10-15 05:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 452440 ----a-w- c:\windows\SysWow64\d3dx10_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 2605920 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 2036576 ----a-w- c:\windows\SysWow64\D3DCompiler_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 5631312 ----a-w- c:\windows\system32\D3DX9_40.dll
2012-12-25 00:30 . 2008-10-15 05:22 4379984 ----a-w- c:\windows\SysWow64\D3DX9_40.dll
2012-12-25 00:24 . 2012-12-25 00:24 -------- d-----w- c:\program files\TeamSpeak 3 Client
2012-12-24 22:23 . 2012-12-25 01:58 -------- d-----w- c:\program files (x86)\Common Files\Steam
2012-12-24 21:55 . 2012-12-24 21:55 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-12-24 21:55 . 2012-12-25 01:57 -------- d-----w- c:\users\UpdatusUser
2012-12-24 21:54 . 2012-12-24 21:55 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-12-24 21:54 . 2013-01-03 17:01 -------- d-----w- c:\programdata\NVIDIA
2012-12-24 21:54 . 2012-12-01 05:49 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-12-24 21:54 . 2012-12-01 05:49 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-12-24 21:54 . 2012-12-01 05:49 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-12-24 21:54 . 2012-12-01 05:49 890216 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-24 21:54 . 2012-12-01 05:48 6223208 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-24 21:54 . 2012-12-01 05:48 3311464 ----a-w- c:\windows\system32\nvsvc64.dll
2012-12-24 21:54 . 2012-12-03 15:47 60776 ----a-w- c:\windows\system32\OpenCL.dll
2012-12-24 21:54 . 2012-12-03 15:47 52584 ----a-w- c:\windows\SysWow64\OpenCL.dll
2012-12-24 21:54 . 2012-12-24 21:54 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-12-24 21:52 . 2012-12-24 21:54 -------- d-----w- c:\program files\NVIDIA Corporation
2012-12-24 21:52 . 2012-12-24 21:52 -------- d-----w- C:\NVIDIA
2012-12-24 21:52 . 2012-12-24 21:52 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-12-24 21:51 . 2012-12-24 21:51 859072 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-12-24 21:51 . 2012-12-24 21:51 779704 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-12-24 21:51 . 2012-12-24 21:51 95184 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-25 15:50 . 2012-12-25 15:50 249344 ----a-w- c:\windows\system32\webcheck.dll
2012-12-25 15:50 . 2012-12-25 15:50 203776 ----a-w- c:\windows\SysWow64\webcheck.dll
2012-12-25 01:48 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-12-25 01:48 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-12-03 15:47 . 2009-06-10 20:37 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-11-30 21:43 . 2012-11-30 21:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-10-16 08:38 . 2012-12-25 02:43 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-12-25 02:43 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-12-25 02:43 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryBooster"="c:\program files (x86)\Uniblue\RegistryBooster\launcher.exe" [2012-07-08 68000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2012-05-11 5119600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-12-25 1255736]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-29 283200]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys [2012-11-14 160784]
S2 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe [2012-11-14 678416]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2012-05-04 27760]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-07-29 56960]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-07-29 79104]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-08-23 565352]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-05-04 2196592]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2013-01-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-24 00:13]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-24 21:42]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-24 21:42]
.
2013-01-03 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2013-01-03 13:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
------- Doplňkový sken -------
.
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 212.96.167.50 212.96.167.18 89.190.50.18
FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\a6h6pa1t.default\
FF - ExtSQL: 2012-12-25 02:07; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2012-12-29 17:31; {7473b6bd-4691-4744-a82b-7854eb3d70b6}; c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\a6h6pa1t.default\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{7473b6bd-4691-4744-a82b-7854eb3d70b6} - c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
.
**************************************************************************
.
Celkový čas: 2013-01-03 18:06:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-01-03 17:06
ComboFix2.txt 2013-01-03 16:23
.
Před spuštěním: Volných bajtů: 117 339 557 888
Po spuštění: Volných bajtů: 117 135 933 440
.
- - End Of File - - 9F0CACEC403B687407992D8FFA2ADA50
Nahr nˇ probŘhlo ŁspŘçnŘ

[vyosek]

Jak se chova PC