Prosím o kontrolu

Zpráva

Svara7 · #1 Příspěvek od **Svara7** » 20 úno 2013 17:29

Dobrý den, prosím o kontrolu logu. Antivir mi našel několik virů a bojím se, že to není ještě úplně všechno. Počítač se chová divně a zpomaleně

Děkuju moc

Logfile of random's system information tool 1.09 (written by random/random)
Run by Maminka a Tatínek at 2013-02-20 16:58:45
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 21 GB (14%) free of 149 GB
Total RAM: 2047 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:59:50, on 20.2.2013
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18639)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\Macromed\Flash\FlashUtil32_11_5_502_149_ActiveX.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Users\Maminka a Tatínek\Downloads\RSIT.exe
C:\Program Files\trend micro\Maminka a Tatínek.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cs.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3167932717-2641840553-2148427197-1002\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3167932717-2641840553-2148427197-1002\..\RunOnce: [RUN] C:\Windows\Acer_Normal\run_DT.exe (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {5F509E42-537E-482B-B66C-145BC170054C} (PhotoUploader Control) - http://sberna.fotostar.cz/snadno-vlozit ... loader.dll
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/a ... oader6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: ecojink - Invalid registry found
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--
End of file - 9764 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\At1.job
C:\Windows\tasks\At10.job
C:\Windows\tasks\At11.job
C:\Windows\tasks\At12.job
C:\Windows\tasks\At13.job
C:\Windows\tasks\At14.job
C:\Windows\tasks\At15.job
C:\Windows\tasks\At16.job
C:\Windows\tasks\At17.job
C:\Windows\tasks\At18.job
C:\Windows\tasks\At19.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At20.job
C:\Windows\tasks\At21.job
C:\Windows\tasks\At22.job
C:\Windows\tasks\At23.job
C:\Windows\tasks\At24.job
C:\Windows\tasks\At25.job
C:\Windows\tasks\At26.job
C:\Windows\tasks\At27.job
C:\Windows\tasks\At28.job
C:\Windows\tasks\At29.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\At30.job
C:\Windows\tasks\At31.job
C:\Windows\tasks\At32.job
C:\Windows\tasks\At33.job
C:\Windows\tasks\At34.job
C:\Windows\tasks\At35.job
C:\Windows\tasks\At36.job
C:\Windows\tasks\At37.job
C:\Windows\tasks\At38.job
C:\Windows\tasks\At39.job
C:\Windows\tasks\At4.job
C:\Windows\tasks\At40.job
C:\Windows\tasks\At41.job
C:\Windows\tasks\At42.job
C:\Windows\tasks\At43.job
C:\Windows\tasks\At44.job
C:\Windows\tasks\At45.job
C:\Windows\tasks\At46.job
C:\Windows\tasks\At47.job
C:\Windows\tasks\At48.job
C:\Windows\tasks\At5.job
C:\Windows\tasks\At6.job
C:\Windows\tasks\At7.job
C:\Windows\tasks\At8.job
C:\Windows\tasks\At9.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000Core1cd64429577fbe0.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000UA.job
C:\Windows\tasks\User_Feed_Synchronization-{D0CD071F-3BDD-4B2F-9403-0AD9AC0BAED2}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-27 192144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll [2013-01-29 1000984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2009-05-20 1258808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-02-06 151552]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2009-05-20 1258808]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-27 192144]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-02-15 4390912]
"Acer Tour"= []
"Acer Empowering Technology Monitor"=C:\Acer\Empowering Technology\SysMonitor.exe [2007-01-24 319488]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-02-06 464168]
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]
"eRecoveryService"= []
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-02-15 151552]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2013-02-20 385248]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"Acer Tour Reminder"= []
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-10-19 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\SweetIM\Messenger\SweetIM.exe [2009-05-20 111928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-10-19 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe

C:\Users\Maminka a Tatínek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ecojink]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption"
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption"
"C:\Windows\TEMP\nwangv\setup.exe"="C:\Windows\TEMP\nwangv\setup.exe:*:Enabled:setup"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"vidc.VP60"=C:\Windows\system32\vp6vfw.dll
"vidc.VP61"=C:\Windows\system32\vp6vfw.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.tscc"=tsccvid.dll
"msacm.l3codec"=l3codecp.acm

======List of files/folders created in the last 1 month======

2013-02-20 16:58:46 ----D---- C:\Program Files\trend micro
2013-02-20 16:58:45 ----D---- C:\rsit
2013-02-20 09:40:26 ----D---- C:\Users\Maminka a Tatínek\AppData\Roaming\Avira
2013-02-20 09:38:13 ----A---- C:\Windows\system32\drivers\ssmdrv.sys
2013-02-20 09:38:05 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2013-02-20 09:38:05 ----A---- C:\Windows\system32\drivers\avipbb.sys
2013-02-20 09:38:05 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2013-02-20 09:37:59 ----D---- C:\ProgramData\Avira
2013-02-20 09:37:59 ----D---- C:\Program Files\Avira
2013-02-20 09:24:24 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2013-02-20 16:58:50 ----D---- C:\Windows\Temp
2013-02-20 16:58:46 ----RD---- C:\Program Files
2013-02-20 16:46:33 ----D---- C:\Windows\System32
2013-02-20 16:46:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-02-20 16:46:32 ----D---- C:\Windows\inf
2013-02-20 16:40:03 ----D---- C:\ProgramData\NVIDIA
2013-02-20 16:25:06 ----D---- C:\Windows\Prefetch
2013-02-20 16:21:12 ----D---- C:\Windows\system32\catroot
2013-02-20 15:33:22 ----SHD---- C:\System Volume Information
2013-02-20 13:29:10 ----HD---- C:\ProgramData
2013-02-20 13:29:10 ----D---- C:\ProgramData\BrowserQuest
2013-02-20 13:29:10 ----D---- C:\Program Files\BrowserQuest
2013-02-20 13:29:09 ----D---- C:\Windows\system32\drivers
2013-02-20 10:26:32 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-02-20 10:04:21 ----SHD---- C:\Config.Msi
2013-02-20 10:04:18 ----D---- C:\Windows
2013-02-20 09:57:08 ----D---- C:\ProgramData\Norton
2013-02-20 09:56:51 ----D---- C:\Program Files\Common Files\Symantec Shared
2013-02-20 09:56:04 ----SHD---- C:\Windows\Installer
2013-02-20 09:55:40 ----D---- C:\Program Files\Symantec
2013-02-20 09:55:33 ----D---- C:\ProgramData\Symantec
2013-02-20 09:53:23 ----D---- C:\Program Files\Common Files
2013-02-20 09:49:52 ----RSD---- C:\Windows\assembly
2013-02-20 09:36:19 ----D---- C:\Windows\Panther
2013-02-20 09:36:18 ----D---- C:\Windows\Minidump
2013-02-20 09:36:18 ----D---- C:\Windows\Logs
2013-02-20 09:36:18 ----D---- C:\Windows\Debug
2013-02-20 09:26:36 ----D---- C:\Windows\system32\Tasks
2013-02-20 09:15:32 ----D---- C:\ProgramData\Microsoft Help
2013-02-20 09:11:27 ----D---- C:\Windows\system32\catroot2
2013-02-20 09:06:01 ----ASH---- C:\Windows\system32\dds_trash_log.cmd
2013-02-05 23:51:33 ----D---- C:\Users\Maminka a Tatínek\AppData\Roaming\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor32;nvstor32; C:\Windows\system32\drivers\nvstor32.sys [2007-01-27 101160]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-06 20264]
R0 PSDNServ;PSDNSERVER; C:\Windows\system32\drivers\PSDNServ.sys [2007-02-06 16680]
R0 psdvdisk;psdvdisk; C:\Windows\system32\drivers\psdvdisk.sys [2007-02-06 60712]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2013-02-20 134336]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2012-11-16 36552]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2012-08-27 28520]
R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2013-02-20 83944]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-02-14 1740904]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-05-03 6144]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2012-10-10 10837352]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-19 9216]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-09 194560]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RT73;Belkin USB Network Adapter; C:\Windows\system32\DRIVERS\rt73.sys [2005-08-02 232192]
S3 s1029bus;Sony Ericsson Device 1029 driver (WDM); C:\Windows\system32\DRIVERS\s1029bus.sys [2009-05-25 86568]
S3 s1029mdfl;Sony Ericsson Device 1029 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1029mdfl.sys [2009-05-25 15016]
S3 s1029mdm;Sony Ericsson Device 1029 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1029mdm.sys [2009-05-25 114472]
S3 s1029mgmt;Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1029mgmt.sys [2009-05-25 108200]
S3 s1029nd5;Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1029nd5.sys [2009-05-25 26024]
S3 s1029obex;Sony Ericsson Device 1029 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1029obex.sys [2009-05-25 104488]
S3 s1029unic;Sony Ericsson Device 1029 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1029unic.sys [2009-05-25 109480]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcerMemUsageCheckService;ePerformance Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2006-12-29 28672]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2013-02-20 110816]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2013-02-20 86752]
R2 AntiVirWebService;Avira Web Protection; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2013-02-20 565472]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-02-06 457512]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-01-31 53248]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-10-02 645992]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-10-10 1258856]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-26 135664]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 slabbus;Mctskshd.exe; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-20 251248]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-26 135664]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-29 194032]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 20 úno 2013 20:05

Zdravim

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Pockejte na dokonceni PreScanu
Zvolte moznost Prohledat (scan)
Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
Detailni postup vc. obrazku mate zde http://forum.viry.cz/viewtopic.php?f=24&t=120452

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Search
Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

Svara7 · #3 Příspěvek od **Svara7** » 20 úno 2013 20:18

Tady je RogueKiller:

RogueKiller V8.5.1 [Feb 20 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.geekstogo.com/forum/files/fi ... guekiller/
Webové stránky : http://tigzy.geekstogo.com/roguekiller.php
: http://tigzyrk.blogspot.com/

Operační systém : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : Maminka a Tatínek [Práva správce]
Mód : Kontrola -- Datum : 02/20/2013 20:15:55
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 99 ¤¤¤
[TASK][SUSP PATH] At17.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At16.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At15.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At14.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At13.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At12.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At11.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At10.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At1.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At26.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At25.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At24.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At23.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At22.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At21.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At20.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At2.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At19.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At18.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At35.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At34.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At33.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At32.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At31.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At30.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At3.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At29.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At28.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At27.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At44.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At43.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At42.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At41.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At40.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At4.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At39.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At38.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At37.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At36.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At9.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At8.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At7.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At6.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At5.job : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At48.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At47.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At46.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At45.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At1 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At10 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At11 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At12 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At13 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At14 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At15 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At16 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At17 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At18 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At19 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At2 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At20 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At21 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At22 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At23 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At24 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At25 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At26 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At27 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At28 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At29 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At3 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At30 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At31 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At32 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At33 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At34 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At35 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At36 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At37 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At38 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At39 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At4 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At40 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At41 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At42 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At43 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At44 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At45 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At46 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At47 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At48 : C:\ProgramData\8C1vJqv0.exe_ [x] -> NALEZENO
[TASK][SUSP PATH] At5 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At6 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At7 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At8 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[TASK][SUSP PATH] At9 : C:\ProgramData\8C1vJqv0.exe [x] -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO
[SCREENSV][SUSP PATH] HKCU\[...]\Desktop (C:\Windows\Acer(Normal).scr) [-] -> NALEZENO

¤¤¤ Zvláštní soubory / Složky: ¤¤¤
[ZeroAccess][FOLDER] $NtUninstallKB8970$ : C:\Windows\$NtUninstallKB8970$ --> NALEZENO

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
SSDT[75] : NtCreateSection @ 0x82691689 -> HOOKED (Unknown @ 0x8A8824B6)
SSDT[276] : NtRequestWaitReplyPort @ 0x82675415 -> HOOKED (Unknown @ 0x8A8824C0)
SSDT[289] : NtSetContextThread @ 0x826DD233 -> HOOKED (Unknown @ 0x8A8824BB)
SSDT[314] : NtSetSecurityObject @ 0x82621773 -> HOOKED (Unknown @ 0x8A8824C5)
SSDT[332] : NtSystemDebugControl @ 0x82645E60 -> HOOKED (Unknown @ 0x8A8824CA)
SSDT[334] : NtTerminateProcess @ 0x8262B2F0 -> HOOKED (Unknown @ 0x8A882457)
S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8A8824DE)
S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8A8824E3)

¤¤¤ Nákaza : ZeroAccess ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST332082 0AS SCSI Disk Device +++++
--- User ---
[MBR] be07f36201506e03336fd4c1efbb0dc3
[BSP] 415b1c5fb7cef1912cc966191c47ae55 : Acer tatooed MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 6997 Mo
1 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 14329980 | Size: 149299 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 320095125 | Size: 148946 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Dokončeno : << RKreport[1]_S_02202013_02d2015.txt >>
RKreport[1]_S_02202013_02d2015.txt

Svara7 · #4 Příspěvek od **Svara7** » 20 úno 2013 20:20

A AdwCleaner:

# AdwCleaner v2.112 - Logfile created 02/20/2013 at 20:19:50
# Updated 10/02/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# User : Maminka a Tatínek - NADULKAS9-PC
# Boot Mode : Normal
# Running from : C:\Users\Maminka a Tatínek\Desktop\adwcleaner0.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files\Ask.com
Folder Found : C:\Program Files\ICQ6Toolbar
Folder Found : C:\Program Files\ShoppingReport
Folder Found : C:\Program Files\SweetIM
Folder Found : C:\ProgramData\ICQ\ICQToolbar
Folder Found : C:\ProgramData\SweetIM
Folder Found : C:\Users\MAMINK~1\AppData\Local\Temp\AskSearch
Folder Found : C:\Users\Maminka a Tatínek\AppData\Local\AskToolbar
Folder Found : C:\Users\Maminka a Tatínek\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Maminka a Tatínek\AppData\LocalLow\ShoppingReport
Folder Found : C:\Users\Nadulkas.9\AppData\LocalLow\ShoppingReport
Folder Found : C:\Users\Nadulkas.9\AppData\LocalLow\SweetIM
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\ShoppingReport
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AskToolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKLM\Software\APN
Key Found : HKLM\Software\AskToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8AD9AD05-36BE-4E40-BA62-5422EB0D02FB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.HbAx
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.IEButton
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
Key Found : HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
Key Found : HKLM\Software\ShoppingReport
Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Key Found : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Key Found : HKU\S-1-5-21-3167932717-2641840553-2148427197-1001\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6001.18639

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com

-\\ Google Chrome v24.0.1312.57

File : C:\Users\Nadulkas.9\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\Maminka a Tatínek\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [13988 octets] - [20/02/2013 20:19:50]

########## EOF - C:\AdwCleaner[R1].txt - [14049 octets] ##########

#5 Příspěvek od **vyosek** » 20 úno 2013 20:53

Spustte znovu RogueKiller

Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Zvolte moznost Prohledat a pote Smazat a nasledne Zprava - otevre se log, ten sem vlozte
Pak kliknete na Oprava Host a Zprava - otevre se log, ten sem vlozte

Spustte znovu AdwCleaner

Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
Kliknete na Delete
PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

Svara7 · #6 Příspěvek od **Svara7** » 21 úno 2013 08:23

RogueKiller:

RogueKiller V8.5.1 [Feb 20 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.geekstogo.com/forum/files/fi ... guekiller/
Webové stránky : http://tigzy.geekstogo.com/roguekiller.php
: http://tigzyrk.blogspot.com/

Operační systém : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : Maminka a Tatínek [Práva správce]
Mód : Odebrat -- Datum : 02/21/2013 08:21:52
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 99 ¤¤¤
[TASK][SUSP PATH] At17.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At16.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At15.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At14.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At13.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At12.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At11.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At10.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At1.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At26.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At25.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At24.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At23.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At22.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At21.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At20.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At2.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At19.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At18.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At35.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At34.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At33.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At32.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At31.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At30.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At3.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At29.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At28.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At27.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At44.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At43.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At42.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At41.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At40.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At4.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At39.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At38.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At37.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At36.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At9.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At8.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At7.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At6.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At5.job : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At48.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At47.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At46.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At45.job : C:\ProgramData\8C1vJqv0.exe_ [x] -> VYMAZÁNO
[TASK][SUSP PATH] At1 : C:\ProgramData\8C1vJqv0.exe [x] -> VYMAZÁNO
[TASK][SUSP PATH] At10 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At11 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At12 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At13 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At14 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At15 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At16 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At17 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At18 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At19 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At2 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At20 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At21 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At22 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At23 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At24 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At25 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At26 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At27 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At28 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At29 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At3 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At30 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At31 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At32 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At33 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At34 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At35 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At36 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At37 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At38 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At39 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At4 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At40 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At41 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At42 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At43 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At44 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At45 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At46 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At47 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At48 : C:\ProgramData\8C1vJqv0.exe_ [x] -> ERROR
[TASK][SUSP PATH] At5 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At6 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At7 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At8 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[TASK][SUSP PATH] At9 : C:\ProgramData\8C1vJqv0.exe [x] -> ERROR
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NAHRAZENO (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NAHRAZENO (0)
[SCREENSV][SUSP PATH] HKCU\[...]\Desktop (C:\Windows\Acer(Normal).scr) [-] -> NAHRAZENO (C:\Windows\system32\logon.scr)

¤¤¤ Zvláštní soubory / Složky: ¤¤¤
[ZeroAccess][JUNCTION] C:\Windows\$NtUninstallKB8970$ >> \systemroot\system32\config --> ODSTRANĚN
[Del.Parent][FILE] @ : C:\Windows\$NtUninstallKB8970$\3820535986\@ [-] --> ODSTRANĚN
[Del.Parent][FILE] cfg.ini : C:\Windows\$NtUninstallKB8970$\3820535986\cfg.ini [-] --> ODSTRANĚN
[Del.Parent][FILE] Desktop.ini : C:\Windows\$NtUninstallKB8970$\3820535986\Desktop.ini [-] --> ODSTRANĚN
[Del.Parent][FILE] 00000004.@ : C:\Windows\$NtUninstallKB8970$\3820535986\L\00000004.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 201d3dde : C:\Windows\$NtUninstallKB8970$\3820535986\L\201d3dde [-] --> ODSTRANĚN
[Del.Parent][FILE] 4cce1f70 : C:\Windows\$NtUninstallKB8970$\3820535986\L\4cce1f70 [-] --> ODSTRANĚN
[Del.Parent][FILE] 76603ac3 : C:\Windows\$NtUninstallKB8970$\3820535986\L\76603ac3 [-] --> ODSTRANĚN
[Del.Parent][FILE] qnbwvoto : C:\Windows\$NtUninstallKB8970$\3820535986\L\qnbwvoto [-] --> ODSTRANĚN
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB8970$\3820535986\L --> ODSTRANĚN
[Del.Parent][FILE] 00000001.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\00000001.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 00000002.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\00000002.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 00000004.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\00000004.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 80000000.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\80000000.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 80000004.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\80000004.@ [-] --> ODSTRANĚN
[Del.Parent][FILE] 80000032.@ : C:\Windows\$NtUninstallKB8970$\3820535986\U\80000032.@ [-] --> ODSTRANĚN
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB8970$\3820535986\U --> ODSTRANĚN
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB8970$\3820535986 --> ODSTRANĚN
[Del.Parent][FILE] 4223477617 : C:\Windows\$NtUninstallKB8970$\4223477617 [-] --> ODSTRANĚN
[ZeroAccess][FOLDER] ROOT : C:\Windows\$NtUninstallKB8970$ --> ODSTRANĚN

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
SSDT[75] : NtCreateSection @ 0x82691689 -> HOOKED (Unknown @ 0x8A8824B6)
SSDT[276] : NtRequestWaitReplyPort @ 0x82675415 -> HOOKED (Unknown @ 0x8A8824C0)
SSDT[289] : NtSetContextThread @ 0x826DD233 -> HOOKED (Unknown @ 0x8A8824BB)
SSDT[314] : NtSetSecurityObject @ 0x82621773 -> HOOKED (Unknown @ 0x8A8824C5)
SSDT[332] : NtSystemDebugControl @ 0x82645E60 -> HOOKED (Unknown @ 0x8A8824CA)
SSDT[334] : NtTerminateProcess @ 0x8262B2F0 -> HOOKED (Unknown @ 0x8A882457)
S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8A8824DE)
S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8A8824E3)

¤¤¤ Nákaza : ZeroAccess ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST332082 0AS SCSI Disk Device +++++
--- User ---
[MBR] be07f36201506e03336fd4c1efbb0dc3
[BSP] 415b1c5fb7cef1912cc966191c47ae55 : Acer tatooed MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 6997 Mo
1 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 14329980 | Size: 149299 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 320095125 | Size: 148946 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Dokončeno : << RKreport[3]_D_02212013_02d0821.txt >>
RKreport[1]_S_02202013_02d2015.txt ; RKreport[2]_S_02212013_02d0818.txt ; RKreport[3]_D_02212013_02d0821.txt

Svara7 · #7 Příspěvek od **Svara7** » 21 úno 2013 08:29

A ještě AdwCleaner:

# AdwCleaner v2.112 - Logfile created 02/21/2013 at 08:24:40
# Updated 10/02/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# User : Maminka a Tatínek - NADULKAS9-PC
# Boot Mode : Normal
# Running from : C:\Users\Maminka a Tatínek\Desktop\adwcleaner0.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Program Files\Ask.com
Folder Deleted : C:\Program Files\ICQ6Toolbar
Folder Deleted : C:\Program Files\ShoppingReport
Folder Deleted : C:\Program Files\SweetIM
Folder Deleted : C:\ProgramData\ICQ\ICQToolbar
Folder Deleted : C:\ProgramData\SweetIM
Folder Deleted : C:\Users\MAMINK~1\AppData\Local\Temp\AskSearch
Folder Deleted : C:\Users\Maminka a Tatínek\AppData\Local\AskToolbar
Folder Deleted : C:\Users\Maminka a Tatínek\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Maminka a Tatínek\AppData\LocalLow\ShoppingReport
Folder Deleted : C:\Users\Nadulkas.9\AppData\LocalLow\ShoppingReport
Folder Deleted : C:\Users\Nadulkas.9\AppData\LocalLow\SweetIM
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AskToolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8AD9AD05-36BE-4E40-BA62-5422EB0D02FB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.HbAx
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.IEButton
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
Key Deleted : HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
Key Deleted : HKLM\Software\ShoppingReport
Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6001.18639

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com --> hxxp://www.google.com

-\\ Google Chrome v24.0.1312.57

File : C:\Users\Nadulkas.9\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\Maminka a Tatínek\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [14119 octets] - [20/02/2013 20:19:50]
AdwCleaner[R2].txt - [14180 octets] - [21/02/2013 08:24:26]
AdwCleaner[S1].txt - [14021 octets] - [21/02/2013 08:24:40]

########## EOF - C:\AdwCleaner[S1].txt - [14082 octets] ##########

#8 Příspěvek od **vyosek** » 21 úno 2013 08:31

Fajn, jdeme dale, je tam toho opravdu hodne

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Svara7 · #9 Příspěvek od **Svara7** » 21 úno 2013 08:37

Rkill níže, hned se vrhám na combo. Děkuji

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/21/2013 08:35:31 AM in x86 mode.
Windows Version: Windows Vista (TM) Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Ovladač ověření brány firewall systému Windows (mpsdrv) is not Running.
Startup Type set to: Manual

* BFE [Missing Service]
* iphlpsvc [Missing Service]
* MpsSvc [Missing Service]
* WinDefend [Missing Service]
* wscsvc [Missing Service]
* NetBT [Missing Service]

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 02/21/2013 08:35:39 AM
Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s)

Svara7 · #10 Příspěvek od **Svara7** » 21 úno 2013 09:04

A tady je combo:

ComboFix 13-02-20.01 - Maminka a Tatínek 21.02.2013 8:42.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.2047.1305 [GMT 1:00]
Spuštěný z: c:\users\Maminka a TatÝnek\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\uninstall.exe
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\SET4B2.tmp
.
c:\windows\system32\drivers\netbt.sys chyběl.
Obnovena kopie z - c:\windows\SoftwareDistribution\Download\15d05090e6f876555f2419af621dda9f\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-21 do 2013-02-21 )))))))))))))))))))))))))))))))
.
.
2013-02-21 07:51 . 2013-02-21 07:51 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-02-21 07:51 . 2013-02-21 07:58 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Local\temp
2013-02-21 07:51 . 2013-02-21 07:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-21 07:51 . 2009-04-11 04:45 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2013-02-20 17:07 . 2013-02-20 17:07 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Local\DoNotTrackPlus
2013-02-20 15:58 . 2013-02-20 15:59 -------- d-----w- c:\program files\trend micro
2013-02-20 15:58 . 2013-02-20 15:59 -------- d-----w- C:\rsit
2013-02-20 08:40 . 2013-02-20 08:40 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Roaming\Avira
2013-02-20 08:38 . 2013-02-20 15:34 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-02-20 08:38 . 2013-02-20 15:34 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-02-20 08:38 . 2012-11-16 19:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-02-20 08:37 . 2013-02-20 09:12 -------- d-----w- c:\programdata\Avira
2013-02-20 08:37 . 2013-02-20 08:37 -------- d-----w- c:\program files\Avira
2013-02-20 08:24 . 2013-02-20 08:26 -------- d-----w- c:\program files\CCleaner
2013-01-27 18:21 . 2013-01-27 18:21 -------- d-----w- c:\users\Nadulkas.9\AppData\Roaming\Uschovna
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-20 09:26 . 2012-05-04 18:16 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-20 09:26 . 2012-05-04 18:16 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-02-20 385248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-3 528384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Maminka a Tatínek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\users\Maminka a Tatínek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2013-02-20 17:14 116648 ----atw- c:\users\Maminka a Tatínek\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2008-01-29 16:38 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
slabbus
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 09:26]
.
2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000Core1cd64429577fbe0.job
- c:\users\Nadulkas.9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-19 09:35]
.
2013-02-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000UA.job
- c:\users\Nadulkas.9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-19 09:35]
.
2012-01-13 c:\windows\Tasks\User_Feed_Synchronization-{D0CD071F-3BDD-4B2F-9403-0AD9AC0BAED2}.job
- c:\windows\system32\msfeedssync.exe [2008-06-08 07:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.fotostar.cz/snadno-vlozit-fotografie/fs/FotoStarPhotoUploader.dll
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
Notify-ecojink - (no file)
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-21 08:58
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(4004)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
c:\acer\Empowering Technology\eRecovery\ERAGENT.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Celkový čas: 2013-02-21 09:04:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-21 08:04
.
Před spuštěním: Volných bajtů: 20 604 829 696
Po spuštění: Volných bajtů: 22 185 189 376
.
- - End Of File - - 2909A33A92722BA04026DB773244A702

#11 Příspěvek od **vyosek** » 21 úno 2013 09:16

Poprosim o DDS http://forum.viry.cz/viewtopic.php?f=30&t=125172

Odjizdim ted na fakultu, mam nejake studijni povinnosti, budu zde kolem 12

Svara7 · #12 Příspěvek od **Svara7** » 21 úno 2013 09:42

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 7.0.6001.18639
Run by Maminka a Tatínek at 9:40:55 on 2013-02-21
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.2047.1246 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\SLsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\conime.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Users\Maminka a Tatínek\Desktop\dds.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://www.google.com
dURLSearchHooks: {855F3B16-6D32-4fe6-8A56-BBB695989046} - <orphaned>
dURLSearchHooks: {EEE6C35D-6118-11DC-9C72-001320C79847} - <orphaned>
dURLSearchHooks: <No Name>: - LocalServer32 - <no file>
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - c:\windows\system32\eDStoolbar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [WarReg_PopUp] c:\acer\wr_popup\WarReg_PopUp.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.fotostar.cz/snadno-vlozit-fotografie/fs/FotoStarPhotoUploader.dll
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{0CE5B948-6B88-4089-8209-C97674F9616B} : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{40FF6ABD-1B61-4949-91C3-51A5AD0E071C} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{98F178C4-DBEC-4468-A176-2C093E8879F4} : DHCPNameServer = 192.168.1.254
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2013-2-20 36552]
R2 AntiVirService;Avira Real-Time Protection;c:\program files\avira\antivir desktop\avguard.exe [2013-2-20 110816]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2013-2-20 86752]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2013-2-20 83944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-10-2 382824]
S2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2013-2-20 565472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 s1029bus;Sony Ericsson Device 1029 driver (WDM);c:\windows\system32\drivers\s1029bus.sys [2009-12-25 86568]
S3 s1029mdfl;Sony Ericsson Device 1029 USB WMC Modem Filter;c:\windows\system32\drivers\s1029mdfl.sys [2009-12-25 15016]
S3 s1029mdm;Sony Ericsson Device 1029 USB WMC Modem Driver;c:\windows\system32\drivers\s1029mdm.sys [2009-12-25 114472]
S3 s1029mgmt;Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1029mgmt.sys [2009-12-25 108200]
S3 s1029nd5;Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1029nd5.sys [2009-12-25 26024]
S3 s1029obex;Sony Ericsson Device 1029 USB WMC OBEX Interface;c:\windows\system32\drivers\s1029obex.sys [2009-12-25 104488]
S3 s1029unic;Sony Ericsson Device 1029 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1029unic.sys [2009-12-25 109480]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2013-02-21 08:04:10 -------- d-----w- c:\users\maminka a tatínek\appdata\local\temp
2013-02-21 07:51:03 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2013-02-21 07:39:14 98816 ----a-w- c:\windows\sed.exe
2013-02-21 07:39:14 256000 ----a-w- c:\windows\PEV.exe
2013-02-21 07:39:14 208896 ----a-w- c:\windows\MBR.exe
2013-02-21 07:39:07 -------- d-----w- C:\ComboFix
2013-02-20 17:21:45 -------- d-----w- c:\windows\pss
2013-02-20 17:07:06 -------- d-----w- c:\users\maminka a tatínek\appdata\local\DoNotTrackPlus
2013-02-20 15:58:46 -------- d-----w- c:\program files\trend micro
2013-02-20 08:40:26 -------- d-----w- c:\users\maminka a tatínek\appdata\roaming\Avira
2013-02-20 08:38:05 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-02-20 08:38:05 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-02-20 08:37:59 -------- d-----w- c:\programdata\Avira
2013-02-20 08:37:59 -------- d-----w- c:\program files\Avira
2013-02-20 08:24:24 -------- d-----w- c:\program files\CCleaner
.
==================== Find3M ====================
.
2013-02-20 09:26:32 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-20 09:26:32 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
============= FINISH: 9:41:28,15 ===============

#13 Příspěvek od **vyosek** » 21 úno 2013 11:57

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"=-
[-HKLM\~\startupfolder\C:^Users^Maminka a Tatínek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000

File::
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000Core1cd64429577fbe0.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000UA.job
c:\windows\Tasks\User_Feed_Synchronization-{D0CD071F-3BDD-4B2F-9403-0AD9AC0BAED2}.job

RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Svara7 · #14 Příspěvek od **Svara7** » 21 úno 2013 12:31

ComboFix 13-02-20.01 - Maminka a Tatínek 21.02.2013 12:13:42.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.2047.1415 [GMT 1:00]
Spuštěný z: c:\users\Maminka a Tatínek\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Maminka a Tatínek\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk"
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000Core1cd64429577fbe0.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000UA.job"
"c:\windows\Tasks\User_Feed_Synchronization-{D0CD071F-3BDD-4B2F-9403-0AD9AC0BAED2}.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-21 do 2013-02-21 )))))))))))))))))))))))))))))))
.
.
2013-02-21 11:21 . 2013-02-21 11:24 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Local\temp
2013-02-21 11:21 . 2013-02-21 11:21 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-02-21 11:21 . 2013-02-21 11:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-21 07:51 . 2009-04-11 04:45 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2013-02-20 17:07 . 2013-02-20 17:07 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Local\DoNotTrackPlus
2013-02-20 15:58 . 2013-02-20 15:59 -------- d-----w- c:\program files\trend micro
2013-02-20 15:58 . 2013-02-20 15:59 -------- d-----w- C:\rsit
2013-02-20 08:40 . 2013-02-20 08:40 -------- d-----w- c:\users\Maminka a Tatínek\AppData\Roaming\Avira
2013-02-20 08:38 . 2013-02-20 15:34 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-02-20 08:38 . 2013-02-20 15:34 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-02-20 08:38 . 2012-11-16 19:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-02-20 08:37 . 2013-02-20 09:12 -------- d-----w- c:\programdata\Avira
2013-02-20 08:37 . 2013-02-20 08:37 -------- d-----w- c:\program files\Avira
2013-02-20 08:24 . 2013-02-20 08:26 -------- d-----w- c:\program files\CCleaner
2013-01-27 18:21 . 2013-01-27 18:21 -------- d-----w- c:\users\Nadulkas.9\AppData\Roaming\Uschovna
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-20 09:26 . 2012-05-04 18:16 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-20 09:26 . 2012-05-04 18:16 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-02-20 385248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-3 528384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2008-01-29 16:38 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
slabbus
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 09:26]
.
2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000Core1cd64429577fbe0.job
- c:\users\Nadulkas.9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-19 09:35]
.
2013-02-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3167932717-2641840553-2148427197-1000UA.job
- c:\users\Nadulkas.9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-19 09:35]
.
2012-01-13 c:\windows\Tasks\User_Feed_Synchronization-{D0CD071F-3BDD-4B2F-9403-0AD9AC0BAED2}.job
- c:\windows\system32\msfeedssync.exe [2008-06-08 07:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.fotostar.cz/snadno-vlozit-fotografie/fs/FotoStarPhotoUploader.dll
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-21 12:23
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3764)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conime.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\windows\RtHDVCpl.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
c:\acer\Empowering Technology\eRecovery\ERAGENT.EXE
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2013-02-21 12:29:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-21 11:29
ComboFix2.txt 2013-02-21 08:04
.
Před spuštěním: Volných bajtů: 22 184 329 216
Po spuštění: Volných bajtů: 22 187 167 744
.
- - End Of File - - 707015DDD27DE0CD0CFFDF09323E51F0

#15 Příspěvek od **vyosek** » 21 úno 2013 12:32

Fajn, jak se chova PC

VIRY.CZ

Prosím o kontrolu

Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu