Počítač freezuje z neznámých důvodů

Zpráva

detox · #1 Příspěvek od **detox** » 01 dub 2013 22:26

Stručně: Náhodně, někdy 2x za týden, někdy jednou za měsíc, přestane v jednu chvíli vše na počítači pracovat, z ničeho nic, objeví se načítací ikona windows na myši a ta už nezmizí, a výsledek tohoto je buďto:

1)Asi tak po půl hodině čekání se objeví bluescreen s informací o fatálním selhání systému, počítač restartuje, a naběhne toto (nevím jak to pojmenovat, tak sem to vyfotil

- systém něnaběhne)

http://2i.cz/f072c1eb38

Odtud se asi po 10 minutách klikání znázorněných kláves (TAB, DEL..) dostanu pouze do BIOSu, odkud vždy jen odejdu, a poté nastane černý obraz s hláškou - 3rd master hard disk error.

2) Počítač se jakoby asi po 10 sekundách nachvíli rozeběhne, 5 sekund pracuje zas normál, a pak se restartuje sám, se stejným průběhem jako při bodu 1)

Prosím o pomoc.

Zapomněl jsem dodat, že přivést k životu se to dá nazpět komplet vypnutím, počkat tak 3-4 sec, znovu zapnout, a windows opět naběhne jen s hláškou, že byl neočekávaně ukončen a jak chci systém spustit..

#2 Příspěvek od **Rudy** » 02 dub 2013 17:56

Zdravím!
Tohle je jedna ze závad, které se obtížně zjišťují. Příčin může být mnoho, od sw konfliktu, přes syst. chybu, až po hardware. Když se vás zeptám, od kdy to dělá a co jste instaloval těsně přr začátkem problému, patrně mi neodpovíte. Koukněte do adresáře windows\minidump, zda tam není nějaký soubor. Pokud ano, zabalte jej do raru a přiložte k vašemu příštímu postu.

detox · #3 Příspěvek od **detox** » 03 dub 2013 23:45

V minidumpu nic není, jinak nevím, ale dělá to už dělší dobu, počítač je starý cca 2 roky, tyhle skopičiny to začalo dělat tak po roce, ale s odstupem třeba 2-3 měsíce, akorát teď je to čím dál frekventovanější, s úžasnou ztrátou dat pokaždé..

A existuje nějaký způsob, jak to zjistit ? Když to někam odnesu, dokáží s tím něco vůbec udělat ?

I když mam takové podezření na HDD (možná) občas ukládání zabírá až moc času, a u starších her, které tento pc zvládá levou zadní, tak se dokáží i na 5s zaseknout, jen kvůli uložení

#4 Příspěvek od **Rudy** » 04 dub 2013 18:13

HDD můžeme zkontrolovat pomocí CrystalDiskInfo: http://www.stahuj.centrum.cz/utility_a_ ... ldiskinfo/ . Stáhněte, nainstalujte, spusťte a přes Úpravy>kopírovat sem dejte log.

detox · #5 Příspěvek od **detox** » 04 dub 2013 23:39

----------------------------------------------------------------------------
CrystalDiskInfo 5.4.1 Shizuku Edition (C) 2008-2013 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 7 Professional SP1 [6.1 Build 7601] (x64)
Date : 2013/04/05 0:39:00

-- Controller Map ----------------------------------------------------------
+ NVIDIA nForce Serial ATA Controller [ATA]
- WDC WD50 00AADS-00S9B SCSI Disk Device
- Optiarc DVD RW AD-5260S SCSI CdRom Device
+ PCI Standardní dvoukanálový řadič IDE [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)
- NVIDIA nForce Serial ATA Controller [ATA]
- ATA Channel 0 (0) [ATA]
- ATA Channel 1 (1) [ATA]

-- Disk List ---------------------------------------------------------------
(1) WDC WD5000AADS-00S9B0 : 500,1 GB [0/2/0, sm] - wd

----------------------------------------------------------------------------
(1) WDC WD5000AADS-00S9B0
----------------------------------------------------------------------------
Model : WDC WD5000AADS-00S9B0
Firmware : 01.00A01
Serial Number : WD-WCAV95165433
Disk Size : 500,1 GB (8,4/137,4/500,1)
Buffer Size : 32767 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ----
Transfer Mode : SATA/300
Power On Hours : 6524 hod.
Power On Count : 1492 krát
Temparature : 33 C (91 F)
Health Status : Dobrý
Features : S.M.A.R.T., AAM, 48bit LBA, NCQ
APM Level : ----
AAM Level : 80FEh [ON]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000000000 Počet chyb čtení
03 165 146 _21 000000000AAD Čas na roztočení ploten
04 _99 _99 __0 000000000658 Počet spuštění/zastavení
05 200 200 140 000000000000 Počet přemapovaných sektorů
07 200 200 __0 000000000000 Počet chybných hledání
09 _92 _92 __0 00000000197C Hodin v činnosti
0A 100 100 __0 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 __0 000000000000 Počet pokusů o překalibrování
0C _99 _99 __0 0000000005D4 Počet cyklů zapnutí zařízení
C0 200 200 __0 000000000078 Počet vypnutí disku
C1 162 162 __0 00000001BD54 Počet cyklů načítání/vymazání
C2 110 101 __0 000000000021 Teplota
C4 200 200 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000000 Počet podezřelých sektorů
C6 200 200 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 200 200 __0 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 427A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2057 442D 5743 4156 3935 3136 3534 3333
020: 0000 FFFF 0032 3031 2E30 3041 3031 5744 4320 5744
030: 3530 3030 4141 4453 2D30 3053 3942 3020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4001 0000 0000 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 1706 0000 0044 0040
080: 01FE 0000 746B 7F61 4123 7469 BE41 4123 407F 0039
090: 0039 0000 FFFE 0000 80FE 0000 0000 0000 0000 0000
100: 6030 3A38 0000 0000 0000 0000 0000 0000 5001 4EE1
110: 5817 56F6 0000 0000 0000 0000 0000 0000 0000 401C
120: 401C 0000 0000 0000 0000 0000 0000 0000 0021 0000
130: 0000 0000 0000 16D9 0000 0000 0000 0000 0000 0000
140: 0000 0000 0004 0000 0000 0000 0000 0000 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 303F 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 101E 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0001 1000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 8CA5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 2F 00 C8 C8 00 00 00 00 00 00 00 03 27
010: 00 A5 92 AD 0A 00 00 00 00 00 04 32 00 63 63 58
020: 06 00 00 00 00 00 05 33 00 C8 C8 00 00 00 00 00
030: 00 00 07 2E 00 C8 C8 00 00 00 00 00 00 00 09 32
040: 00 5C 5C 7C 19 00 00 00 00 00 0A 32 00 64 64 00
050: 00 00 00 00 00 00 0B 32 00 64 64 00 00 00 00 00
060: 00 00 0C 32 00 63 63 D4 05 00 00 00 00 00 C0 32
070: 00 C8 C8 78 00 00 00 00 00 00 C1 32 00 A2 A2 54
080: BD 01 00 00 00 00 C2 22 00 6E 65 21 00 00 00 00
090: 00 00 C4 32 00 C8 C8 00 00 00 00 00 00 00 C5 32
0A0: 00 C8 C8 00 00 00 00 00 00 00 C6 30 00 C8 C8 00
0B0: 00 00 00 00 00 00 C7 32 00 C8 C8 00 00 00 00 00
0C0: 00 00 C8 08 00 C8 C8 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 84 00 98 2B 01 7B
170: 03 00 01 00 02 83 05 00 00 00 00 00 00 00 00 00
180: 00 00 01 02 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 C8 C8 00 00 00 00 00 00 00 00 03 15
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 8C 00 00 00 00 00 00 00 00
030: 00 00 07 00 C8 C8 00 00 00 00 00 00 00 00 09 00
040: 00 00 00 00 00 00 00 00 00 00 0A 00 00 00 00 00
050: 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 00 00
060: 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 C0 00
070: 00 00 00 00 00 00 00 00 00 00 C1 00 00 00 00 00
080: 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 00 00
090: 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 C5 00
0A0: 00 00 00 00 00 00 00 00 00 00 C6 00 00 00 00 00
0B0: 00 00 00 00 00 00 C7 00 00 00 00 00 00 00 00 00
0C0: 00 00 C8 00 C8 C8 00 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0D

#6 Příspěvek od **Rudy** » 05 dub 2013 18:32

Disk je také OK. Co jste instaloval těsně před tím, než se problém objevil?

detox · #7 Příspěvek od **detox** » 07 dub 2013 03:21

To právě nelze určitě říct, je to dlouhodobý problém už, a nevím už co bylo dříve instalování..

#8 Příspěvek od **Rudy** » 07 dub 2013 11:43

Dejte log RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=105895 .

detox · #9 Příspěvek od **detox** » 08 dub 2013 21:00

Logfile of random's system information tool 1.09 (written by random/random)
Run by Host at 2013-04-08 21:51:42
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 186 GB (39%) free of 477 GB
Total RAM: 8191 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:51:48, on 8.4.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16470)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Host.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files (x86)\FileHippo\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8226 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"
C:\Windows\SysWOW64\IoctlSvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\SysWOW64\PnkBstrB.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files (x86)\FileHippo\UpdateChecker.exe" /background
"C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe"
"C:\Windows\System32\StikyNot.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
WLIDSvcM.exe 1996
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/SilentExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/WarmSocketImpact/warmest_socket/ --enable-print-preview --channel=3784.0440E540.791581118 /prefetch:3
"C:\Program Files\Microsoft Security Client\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey E3628286-6223-1633-D1A9-1B263601F143 -Reinvoke
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/SilentExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/WarmSocketImpact/warmest_socket/ --enable-print-preview --channel=3784.05BAA380.240206923 /prefetch:3
C:\Windows\system32\rundll32.exe "C:\PROGRA~2\Google\Chrome\APPLIC~1\170963~1.56\gcswf32.dll",BrokerMain browser=chrome
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Program Files (x86)\Google\Chrome\Application\17.0.963.56\gcswf32.dll" --lang=cs --channel=3784.08938CD0.478317283 --flash-broker=1116 /prefetch:4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/SilentExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/WarmSocketImpact/warmest_socket/ --enable-print-preview --channel=3784.081CA000.2071534366 /prefetch:3
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/SilentExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/WarmSocketImpact/warmest_socket/ --enable-print-preview --channel=3784.083388C0.1752047458 /prefetch:3
"C:\Users\Host\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-03-06 551840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-03-06 209824]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-02-08 461216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-02-08 170912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 1281512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-02-07 17706088]
"FileHippo.com"=C:\Program Files (x86)\FileHippo\UpdateChecker.exe [2012-11-23 307712]
"Pando Media Booster"=C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [2013-02-17 3093624]
"RESTART_STICKY_NOTES"=C:\Windows\System32\StikyNot.exe [2009-07-14 427520]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RESTART_STICKY_NOTES]
C:\Windows\System32\StikyNot.exe [2009-07-14 427520]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2013-04-08 21:51:42 ----D---- C:\rsit
2013-04-05 00:38:08 ----D---- C:\Program Files (x86)\CrystalDiskInfo
2013-03-31 17:09:24 ----A---- C:\Windows\SYSWOW64\~.tmp
2013-03-26 15:55:12 ----A---- C:\Windows\system32\drivers\usb8023.sys
2013-03-24 15:32:13 ----SHD---- C:\Config.Msi
2013-03-24 15:24:12 ----D---- C:\Program Files\7-Zip
2013-03-14 04:02:36 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-03-14 04:02:36 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-03-14 04:02:36 ----A---- C:\Windows\system32\mshtmled.dll
2013-03-14 04:02:35 ----A---- C:\Windows\SYSWOW64\url.dll
2013-03-14 04:02:35 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-03-14 04:02:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-03-14 04:02:35 ----A---- C:\Windows\system32\url.dll
2013-03-14 04:02:35 ----A---- C:\Windows\system32\ieUnatt.exe
2013-03-14 04:02:35 ----A---- C:\Windows\system32\ieui.dll
2013-03-14 04:02:33 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-03-14 04:02:33 ----A---- C:\Windows\system32\urlmon.dll
2013-03-14 04:02:33 ----A---- C:\Windows\system32\jscript9.dll
2013-03-14 04:02:32 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-03-14 04:02:32 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-03-14 04:02:32 ----A---- C:\Windows\system32\wininet.dll
2013-03-14 04:02:32 ----A---- C:\Windows\system32\msfeeds.dll
2013-03-14 04:02:31 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-03-14 04:02:31 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-03-14 04:02:31 ----A---- C:\Windows\system32\vbscript.dll
2013-03-14 04:02:31 ----A---- C:\Windows\system32\jsproxy.dll
2013-03-14 04:02:31 ----A---- C:\Windows\system32\jscript.dll
2013-03-14 04:02:30 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-03-14 04:02:30 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-03-14 04:02:30 ----A---- C:\Windows\system32\iertutil.dll
2013-03-14 04:02:29 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-03-14 04:02:27 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-03-14 04:02:27 ----A---- C:\Windows\system32\mshtml.dll
2013-03-14 04:02:27 ----A---- C:\Windows\system32\ieframe.dll
2013-03-14 04:01:21 ----D---- C:\Program Files\Microsoft Silverlight
2013-03-14 04:01:21 ----D---- C:\Program Files (x86)\Microsoft Silverlight

======List of files/folders modified in the last 1 month======

2013-04-08 21:51:47 ----D---- C:\Program Files\trend micro
2013-04-08 21:46:37 ----D---- C:\Windows\System32
2013-04-08 21:46:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-08 21:46:36 ----D---- C:\Windows\inf
2013-04-08 21:43:23 ----D---- C:\Windows\temp
2013-04-08 21:43:02 ----D---- C:\Users\Host\AppData\Roaming\Skype
2013-04-08 21:42:03 ----D---- C:\ProgramData\NVIDIA
2013-04-08 19:10:31 ----D---- C:\Windows\system32\config
2013-04-07 13:51:11 ----SHD---- C:\System Volume Information
2013-04-05 00:38:08 ----RD---- C:\Program Files (x86)
2013-04-04 14:59:34 ----D---- C:\Windows
2013-04-04 00:49:23 ----D---- C:\Windows\Prefetch
2013-04-03 01:39:26 ----D---- C:\Users\Host\AppData\Roaming\BitTorrent
2013-04-02 23:00:06 ----D---- C:\Peete
2013-04-02 22:58:15 ----D---- C:\Users\Host\AppData\Roaming\DAEMON Tools Lite
2013-04-02 12:34:28 ----N---- C:\Windows\system32\MpSigStub.exe
2013-04-02 03:06:07 ----D---- C:\Windows\system32\catroot2
2013-03-31 17:09:24 ----D---- C:\Windows\SysWOW64
2013-03-27 23:07:20 ----D---- C:\Windows\Tasks
2013-03-27 23:07:20 ----D---- C:\Windows\system32\Tasks
2013-03-27 23:07:10 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-03-26 18:59:08 ----D---- C:\Windows\winsxs
2013-03-26 18:57:49 ----D---- C:\Windows\system32\DriverStore
2013-03-26 18:57:49 ----D---- C:\Windows\system32\drivers
2013-03-26 15:52:42 ----D---- C:\Windows\system32\catroot
2013-03-24 21:12:09 ----D---- C:\Users\Host\AppData\Roaming\TeamViewer
2013-03-24 15:33:04 ----SHD---- C:\Windows\Installer
2013-03-24 15:33:03 ----RD---- C:\Program Files
2013-03-24 15:32:56 ----D---- C:\ProgramData
2013-03-24 15:13:13 ----RSD---- C:\Windows\Fonts
2013-03-20 19:51:47 ----D---- C:\ProgramData\PMB Files
2013-03-17 17:32:42 ----D---- C:\Windows\rescache
2013-03-14 04:14:35 ----D---- C:\Windows\SYSWOW64\migration
2013-03-14 04:14:35 ----D---- C:\Windows\system32\migration
2013-03-14 04:14:35 ----D---- C:\Windows\AppPatch
2013-03-14 04:14:35 ----D---- C:\Program Files\Internet Explorer
2013-03-14 04:14:35 ----D---- C:\Program Files (x86)\Internet Explorer
2013-03-14 04:04:21 ----D---- C:\Windows\debug
2013-03-14 04:04:19 ----A---- C:\Windows\system32\MRT.exe
2013-03-14 04:04:14 ----D---- C:\ProgramData\Microsoft Help
2013-03-12 15:06:31 ----D---- C:\Windows\pss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 230320]
R0 nvstor64;nvstor64; C:\Windows\system32\DRIVERS\nvstor64.sys [2010-04-08 244328]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2009-08-04 13440]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2012-07-03 19600]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-01-24 283200]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys [2010-11-20 59392]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys [2010-11-20 360832]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2012-12-14 24176]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 15416]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2012-07-03 189288]
R3 NVNET;NVIDIA nForce Ethernet Driver; C:\Windows\system32\DRIVERS\nvmf6264.sys [2010-08-12 350952]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2010-05-15 1327520]
R3 vpcbus;Služba hostitelské sběrnice programu Virtual PC; C:\Windows\system32\DRIVERS\vpchbus.sys [2010-11-20 194944]
R3 vpcusb;Služba konektoru virtualizace rozhraní USB; C:\Windows\system32\DRIVERS\vpcusb.sys [2010-11-20 95232]
S2 MLPTDR_C;MLPTDR_C; \??\C:\Windows\syswow64\MLPTDR_C.SYS [2002-09-03 19296]
S2 MLPTDR_Q;MLPTDR_Q; \??\C:\Windows\syswow64\MLPTDR_Q.SYS [2003-07-22 18848]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Peete\Garena\Garena Classic\safedrv.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2011-08-17 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2011-08-17 27136]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2011-08-17 9216]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2011-08-17 9216]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;Sony Ericsson USB Device sa0101 Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 22056]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [2010-01-21 209000]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-18 884512]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [2006-12-19 81920]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-01-02 75064]
R2 PnkBstrB;PnkBstrB; C:\Windows\syswow64\PnkBstrB.exe [2012-09-16 214520]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
S2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-12-29 1260472]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-07 161384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-01-28 1436424]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-08-02 1255736]
S4 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [2010-01-21 496232]
S4 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
S4 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]

-----------------EOF-----------------

detox · #10 Příspěvek od **detox** » 08 dub 2013 21:37

Mimochodem, dnes to opět spadlo, prohlížel jsem net přes G Chrome, a najednou se seklo video, vše přestalo jít, blabla... a poté sem dostal po restartu zbrusu novou hlášku:

SATA1 HARD DISK: S.M.A.R.T. Command Failed (F1 to res..)

#11 Příspěvek od **Rudy** » 08 dub 2013 21:41

Disky se tváří jako bezchbyné. Poprosím o log ConboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

detox · #12 Příspěvek od **detox** » 12 dub 2013 00:48

ComboFix 13-04-11.01 - Host 12.04.2013 1:24.3.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8191.6618 [GMT 2:00]
Spuštěný z: c:\users\Host\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Host\AppData\Local\assembly\tmp
c:\windows\SysWow64\~.inf
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-11 do 2013-04-11 )))))))))))))))))))))))))))))))
.
.
2013-04-11 20:27 . 2013-03-15 06:28 9311288 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{98C4B651-1659-4565-8D68-01866103EDEC}\mpengine.dll
2013-04-10 20:15 . 2013-03-15 06:28 9311288 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-10 12:36 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 12:36 . 2013-03-02 06:04 1655656 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 12:36 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 12:36 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 12:36 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 12:36 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 12:36 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 12:36 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-10 12:36 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-08 19:51 . 2013-04-08 19:51 -------- d-----w- C:\rsit
2013-04-06 21:59 . 2013-04-06 21:59 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-04 22:38 . 2013-04-04 22:38 -------- d-----w- c:\program files (x86)\CrystalDiskInfo
2013-03-31 15:09 . 2013-03-31 15:09 173815 ----a-w- c:\windows\SysWow64\~.tmp
2013-03-26 13:55 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-24 13:44 . 2013-03-29 23:14 -------- d-----w- c:\users\Host\AppData\Local\S2
2013-03-24 13:24 . 2013-03-24 13:24 -------- d-----w- c:\program files\7-Zip
2013-03-23 13:14 . 2012-10-23 05:04 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0A5C98AC-D570-4AA2-9CC6-F3EA688079BA}\gapaengine.dll
2013-03-14 02:01 . 2013-03-14 02:01 -------- d-----w- c:\program files\Microsoft Silverlight
2013-03-14 02:01 . 2013-03-14 02:01 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-03-13 11:41 . 2012-10-23 05:04 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 17:40 . 2011-08-02 06:37 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-02 10:34 . 2011-08-02 04:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-03-27 21:07 . 2012-04-04 20:57 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-27 21:07 . 2011-08-02 07:19 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-06 21:26 . 2013-03-06 21:26 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-03-06 21:26 . 2013-03-06 21:26 310688 ----a-w- c:\windows\system32\javaws.exe
2013-03-06 21:26 . 2013-03-06 21:26 188832 ----a-w- c:\windows\system32\javaw.exe
2013-03-06 21:26 . 2013-03-06 21:26 188320 ----a-w- c:\windows\system32\java.exe
2013-03-06 21:26 . 2011-12-18 10:40 1085344 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-06 21:26 . 2011-08-03 00:34 963488 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-25 23:32 . 2013-02-25 23:32 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-02-25 23:32 . 2013-01-08 14:05 2505144 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-02-25 23:32 . 2011-08-02 04:47 15129960 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-02-25 23:32 . 2013-02-25 23:32 6262608 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-02-25 23:32 . 2011-08-02 04:47 2826040 ----a-w- c:\windows\system32\nvapi64.dll
2013-02-25 23:32 . 2013-02-25 23:32 18055184 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-02-25 23:32 . 2012-05-15 14:28 1107440 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-02-25 23:32 . 2012-05-15 14:28 1814304 ----a-w- c:\windows\system32\nvdispco64.dll
2013-02-25 23:32 . 2013-02-25 23:32 958120 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-02-25 23:32 . 2013-02-25 23:32 2720544 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-02-25 23:32 . 2013-02-25 23:32 26929440 ----a-w- c:\windows\system32\nvoglv64.dll
2013-02-25 23:32 . 2013-02-25 23:32 7932256 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-02-25 23:32 . 2013-02-25 23:32 2346784 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-02-25 23:32 . 2013-02-25 23:32 245872 ----a-w- c:\windows\system32\nvinitx.dll
2013-02-25 23:32 . 2013-02-25 23:32 11036448 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-02-25 23:32 . 2012-11-08 14:34 1510176 ----a-w- c:\windows\system32\nvdispgenco64.dll
2013-02-25 23:32 . 2013-02-25 23:32 2904352 ----a-w- c:\windows\system32\nvcuvid.dll
2013-02-25 23:32 . 2013-02-25 23:32 20449056 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-02-25 23:32 . 2011-08-02 04:48 15053264 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-02-25 23:32 . 2013-02-25 23:32 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-02-25 23:32 . 2013-02-25 23:32 7564040 ----a-w- c:\windows\system32\nvopencl.dll
2013-02-25 23:32 . 2013-02-25 23:32 1985824 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-02-25 23:32 . 2013-02-25 23:32 12641992 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-02-25 23:32 . 2013-02-25 23:32 9390760 ----a-w- c:\windows\system32\nvcuda.dll
2013-02-25 23:32 . 2013-02-25 23:32 201576 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-02-25 21:21 . 2013-02-25 21:21 0 ----a-w- c:\windows\SysWow64\FAP3F9F.tmp
2013-02-25 21:21 . 2013-02-25 21:21 0 ----a-w- c:\windows\SysWow64\FAP33F8.tmp
2013-02-25 21:21 . 2013-02-25 21:21 0 ----a-w- c:\windows\SysWow64\FAPF65.tmp
2013-02-25 21:19 . 2013-02-25 21:19 0 ----a-w- c:\windows\SysWow64\FAPCC1C.tmp
2013-02-25 21:19 . 2013-02-25 21:19 0 ----a-w- c:\windows\SysWow64\FAPC5F1.tmp
2013-02-25 21:19 . 2013-02-25 21:19 0 ----a-w- c:\windows\SysWow64\FAPB1C3.tmp
2013-02-25 21:19 . 2013-02-25 21:19 0 ----a-w- c:\windows\SysWow64\FAPB143.tmp
2013-02-25 21:18 . 2013-02-25 21:18 0 ----a-w- c:\windows\SysWow64\FAPA4E1.tmp
2013-02-25 21:16 . 2013-02-25 21:16 0 ----a-w- c:\windows\SysWow64\FAP432F.tmp
2013-02-25 21:14 . 2013-02-25 21:14 0 ----a-w- c:\windows\SysWow64\FAP1910.tmp
2013-02-25 21:13 . 2013-02-25 21:13 0 ----a-w- c:\windows\SysWow64\FAP2EDE.tmp
2013-02-25 21:13 . 2013-02-25 21:13 0 ----a-w- c:\windows\SysWow64\FAPB9BC.tmp
2013-02-25 21:13 . 2013-02-25 21:13 0 ----a-w- c:\windows\SysWow64\FAP922C.tmp
2013-02-25 21:13 . 2013-02-25 21:13 0 ----a-w- c:\windows\SysWow64\FAP91AC.tmp
2013-02-25 21:11 . 2013-02-25 21:11 0 ----a-w- c:\windows\SysWow64\FAPC35.tmp
2013-02-25 21:10 . 2013-02-25 21:10 0 ----a-w- c:\windows\SysWow64\FAP393B.tmp
2013-02-25 21:08 . 2013-02-25 21:08 0 ----a-w- c:\windows\SysWow64\FAP35ED.tmp
2013-02-25 21:06 . 2013-02-25 21:06 0 ----a-w- c:\windows\SysWow64\FAPA12A.tmp
2013-02-25 21:06 . 2013-02-25 21:06 0 ----a-w- c:\windows\SysWow64\FAPA0D9.tmp
2013-02-25 21:05 . 2013-02-25 21:05 0 ----a-w- c:\windows\SysWow64\FAP8C4D.tmp
2013-02-25 21:04 . 2013-02-25 21:04 0 ----a-w- c:\windows\SysWow64\FAPC62E.tmp
2013-02-25 21:04 . 2013-02-25 21:04 0 ----a-w- c:\windows\SysWow64\FAPA18C.tmp
2013-02-25 21:04 . 2013-02-25 21:04 0 ----a-w- c:\windows\SysWow64\FAP9BFD.tmp
2013-02-25 21:03 . 2013-02-25 21:03 0 ----a-w- c:\windows\SysWow64\FAP86E4.tmp
2013-02-25 21:02 . 2013-02-25 21:02 0 ----a-w- c:\windows\SysWow64\FAPE2B7.tmp
2013-02-25 21:01 . 2013-02-25 21:01 0 ----a-w- c:\windows\SysWow64\FAPB3F6.tmp
2013-02-25 21:00 . 2013-02-25 21:00 0 ----a-w- c:\windows\SysWow64\FAPB895.tmp
2013-02-25 21:00 . 2013-02-25 21:00 0 ----a-w- c:\windows\SysWow64\FAPB6BE.tmp
2013-02-25 20:56 . 2013-02-25 20:56 0 ----a-w- c:\windows\SysWow64\FAP772C.tmp
2013-02-25 20:56 . 2013-02-25 20:56 0 ----a-w- c:\windows\SysWow64\FAP769D.tmp
2013-02-25 20:55 . 2013-02-25 20:55 0 ----a-w- c:\windows\SysWow64\FAP393C.tmp
2013-02-12 05:45 . 2013-03-14 01:12 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-14 01:12 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-14 01:12 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-14 01:12 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-14 01:12 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-14 01:12 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-08 17:25 . 2013-02-08 17:25 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-02-08 17:25 . 2012-06-15 16:45 861088 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-02-08 17:25 . 2011-08-02 07:20 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-01-24 21:50 . 2013-01-24 21:50 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2013-01-24 21:43 . 2013-01-24 21:43 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-01-20 14:59 . 2013-01-20 14:59 230320 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-01-20 14:59 . 2012-08-30 21:03 130008 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-01-18 15:00 . 2011-01-07 18:50 6390048 ----a-w- c:\windows\system32\nvcpl.dll
2013-01-18 15:00 . 2011-01-07 18:49 3460896 ----a-w- c:\windows\system32\nvsvc64.dll
2013-01-18 15:00 . 2012-05-15 14:30 2953448 ----a-w- c:\windows\system32\nvcoproc.bin
2013-01-18 15:00 . 2011-01-07 18:49 118560 ----a-w- c:\windows\system32\nvmctray.dll
2013-01-18 15:00 . 2011-01-07 18:49 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-01-18 15:00 . 2011-01-07 18:49 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-01-18 15:00 . 2011-01-07 18:49 2558240 ----a-w- c:\windows\system32\nvsvcr.dll
2013-01-18 07:15 . 2013-01-18 07:15 550176 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-01-13 21:17 . 2013-02-27 18:32 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 21:17 . 2013-02-27 18:32 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 21:16 . 2013-02-27 18:32 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 21:12 . 2013-02-27 18:32 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-01-13 21:11 . 2013-02-27 18:32 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-01-13 21:11 . 2013-02-27 18:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-01-13 21:11 . 2013-02-27 18:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-01-13 21:11 . 2013-02-27 18:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-01-13 21:11 . 2013-02-27 18:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-01-13 20:35 . 2013-02-27 18:32 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 20:35 . 2013-02-27 18:32 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 20:35 . 2013-02-27 18:32 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 20:32 . 2013-02-27 18:32 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-07 17706088]
"FileHippo.com"="c:\program files (x86)\FileHippo\UpdateChecker.exe" [2012-11-23 307712]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-02-17 3093624]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
R2 MLPTDR_C;MLPTDR_C;c:\windows\system32\MLPTDR_C.SYS [x]
R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-07 161384]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-01-28 1436424]
R3 GGSAFERDriver;GGSAFER Driver;c:\peete\Garena\Garena Classic\safedrv.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-02 1255736]
R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S1 aswKbd;aswKbd; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-01-24 283200]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-05-15 1327520]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001Core.job
- c:\users\Host\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-02-23 21:28]
.
2013-04-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001UA.job
- c:\users\Host\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-02-23 21:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1:9421
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 192.168.1.254
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2013-04-12 01:47:14
ComboFix-quarantined-files.txt 2013-04-11 23:47
.
Před spuštěním: Volných bajtů: 197 209 305 088
Po spuštění: Volných bajtů: 196 732 059 648
.
- - End Of File - - AB0B17BCECE08150EFD5F0054F49ADB8

#13 Příspěvek od **Rudy** » 12 dub 2013 18:17

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\windows\SysWow64\~.tmp
c:\windows\SysWow64\FAP3F9F.tmp
c:\windows\SysWow64\FAP33F8.tmp
c:\windows\SysWow64\FAPF65.tmp
c:\windows\SysWow64\FAPCC1C.tmp
c:\windows\SysWow64\FAPC5F1.tmp
c:\windows\SysWow64\FAPB1C3.tmp
c:\windows\SysWow64\FAPB143.tmp
c:\windows\SysWow64\FAPA4E1.tmp
c:\windows\SysWow64\FAP432F.tmp
c:\windows\SysWow64\FAP1910.tmp
c:\windows\SysWow64\FAP2EDE.tmp
c:\windows\SysWow64\FAPB9BC.tmp
c:\windows\SysWow64\FAP922C.tmp
c:\windows\SysWow64\FAP91AC.tmp
c:\windows\SysWow64\FAPC35.tmp
c:\windows\SysWow64\FAP393B.tmp
c:\windows\SysWow64\FAP35ED.tmp
c:\windows\SysWow64\FAPA12A.tmp
c:\windows\SysWow64\FAPA0D9.tmp
c:\windows\SysWow64\FAP8C4D.tmp
c:\windows\SysWow64\FAPC62E.tmp
c:\windows\SysWow64\FAPA18C.tmp
c:\windows\SysWow64\FAP9BFD.tmp
c:\windows\SysWow64\FAP86E4.tmp
c:\windows\SysWow64\FAPE2B7.tmp
c:\windows\SysWow64\FAPB3F6.tmp
c:\windows\SysWow64\FAPB895.tmp
c:\windows\SysWow64\FAPB6BE.tmp
c:\windows\SysWow64\FAP772C.tmp
c:\windows\SysWow64\FAP769D.tmp
c:\windows\SysWow64\FAP393C.tmp
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001Core.job
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001UA.job

Folder::
c:\users\Host\AppData\Local\Facebook\Update

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

detox · #14 Příspěvek od **detox** » 14 dub 2013 16:26

ComboFix 13-04-14.01 - Host 14.04.2013 17:13:37.4.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8191.6505 [GMT 2:00]
Spuštěný z: c:\users\Host\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Host\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\SysWow64\~.tmp"
"c:\windows\SysWow64\FAP1910.tmp"
"c:\windows\SysWow64\FAP2EDE.tmp"
"c:\windows\SysWow64\FAP33F8.tmp"
"c:\windows\SysWow64\FAP35ED.tmp"
"c:\windows\SysWow64\FAP393B.tmp"
"c:\windows\SysWow64\FAP393C.tmp"
"c:\windows\SysWow64\FAP3F9F.tmp"
"c:\windows\SysWow64\FAP432F.tmp"
"c:\windows\SysWow64\FAP769D.tmp"
"c:\windows\SysWow64\FAP772C.tmp"
"c:\windows\SysWow64\FAP86E4.tmp"
"c:\windows\SysWow64\FAP8C4D.tmp"
"c:\windows\SysWow64\FAP91AC.tmp"
"c:\windows\SysWow64\FAP922C.tmp"
"c:\windows\SysWow64\FAP9BFD.tmp"
"c:\windows\SysWow64\FAPA0D9.tmp"
"c:\windows\SysWow64\FAPA12A.tmp"
"c:\windows\SysWow64\FAPA18C.tmp"
"c:\windows\SysWow64\FAPA4E1.tmp"
"c:\windows\SysWow64\FAPB143.tmp"
"c:\windows\SysWow64\FAPB1C3.tmp"
"c:\windows\SysWow64\FAPB3F6.tmp"
"c:\windows\SysWow64\FAPB6BE.tmp"
"c:\windows\SysWow64\FAPB895.tmp"
"c:\windows\SysWow64\FAPB9BC.tmp"
"c:\windows\SysWow64\FAPC35.tmp"
"c:\windows\SysWow64\FAPC5F1.tmp"
"c:\windows\SysWow64\FAPC62E.tmp"
"c:\windows\SysWow64\FAPCC1C.tmp"
"c:\windows\SysWow64\FAPE2B7.tmp"
"c:\windows\SysWow64\FAPF65.tmp"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Host\AppData\Local\Facebook\Update
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\FacebookCrashHandler.exe
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\FacebookUpdate.exe
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\FacebookUpdateHelper.msi
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ar.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_bg.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_bn.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ca.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_cs.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_da.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_de.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_el.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_en-GB.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_en.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_es-419.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_es.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_et.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_fa.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_fi.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_fil.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_fr.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_gu.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_hi.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_hr.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_hu.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_id.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_is.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_it.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_iw.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ja.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_kn.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ko.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_lt.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_lv.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ml.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_mr.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ms.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_nl.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_no.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_or.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_pl.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_pt-BR.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_pt-PT.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ro.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ru.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_sk.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_sl.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_sr.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_sv.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ta.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_te.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_th.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_tr.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_uk.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_ur.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_vi.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_zh-CN.dll
c:\users\Host\AppData\Local\Facebook\Update\1.2.205.0\goopdateres_zh-TW.dll
c:\users\Host\AppData\Local\Facebook\Update\FacebookUpdate.exe
c:\windows\SysWow64\~.tmp
c:\windows\SysWow64\FAP1910.tmp
c:\windows\SysWow64\FAP2EDE.tmp
c:\windows\SysWow64\FAP33F8.tmp
c:\windows\SysWow64\FAP35ED.tmp
c:\windows\SysWow64\FAP393B.tmp
c:\windows\SysWow64\FAP393C.tmp
c:\windows\SysWow64\FAP3F9F.tmp
c:\windows\SysWow64\FAP432F.tmp
c:\windows\SysWow64\FAP769D.tmp
c:\windows\SysWow64\FAP772C.tmp
c:\windows\SysWow64\FAP86E4.tmp
c:\windows\SysWow64\FAP8C4D.tmp
c:\windows\SysWow64\FAP91AC.tmp
c:\windows\SysWow64\FAP922C.tmp
c:\windows\SysWow64\FAP9BFD.tmp
c:\windows\SysWow64\FAPA0D9.tmp
c:\windows\SysWow64\FAPA12A.tmp
c:\windows\SysWow64\FAPA18C.tmp
c:\windows\SysWow64\FAPA4E1.tmp
c:\windows\SysWow64\FAPB143.tmp
c:\windows\SysWow64\FAPB1C3.tmp
c:\windows\SysWow64\FAPB3F6.tmp
c:\windows\SysWow64\FAPB6BE.tmp
c:\windows\SysWow64\FAPB895.tmp
c:\windows\SysWow64\FAPB9BC.tmp
c:\windows\SysWow64\FAPC35.tmp
c:\windows\SysWow64\FAPC5F1.tmp
c:\windows\SysWow64\FAPC62E.tmp
c:\windows\SysWow64\FAPCC1C.tmp
c:\windows\SysWow64\FAPE2B7.tmp
c:\windows\SysWow64\FAPF65.tmp
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001Core.job
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3386717662-846962829-222283087-1001UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-14 do 2013-04-14 )))))))))))))))))))))))))))))))
.
.
2013-04-14 15:19 . 2013-04-14 15:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-04-14 15:19 . 2013-04-14 15:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-04-14 15:19 . 2013-04-14 15:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-13 22:14 . 2013-03-15 06:28 9311288 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EBA421A3-E5E0-40CA-8C80-BD16F8C51EA9}\mpengine.dll
2013-04-12 21:12 . 2013-03-15 06:28 9311288 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-12 12:34 . 2013-04-12 12:34 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-04-12 12:32 . 2013-04-12 12:32 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-04-12 12:32 . 2013-04-12 12:32 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2013-04-10 12:36 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 12:36 . 2013-03-02 06:04 1655656 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 12:36 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 12:36 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 12:36 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 12:36 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 12:36 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 12:36 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-10 12:36 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-08 19:51 . 2013-04-08 19:51 -------- d-----w- C:\rsit
2013-04-06 21:59 . 2013-04-06 21:59 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-04 22:38 . 2013-04-04 22:38 -------- d-----w- c:\program files (x86)\CrystalDiskInfo
2013-03-26 13:55 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-24 13:44 . 2013-03-29 23:14 -------- d-----w- c:\users\Host\AppData\Local\S2
2013-03-24 13:24 . 2013-03-24 13:24 -------- d-----w- c:\program files\7-Zip
2013-03-23 13:14 . 2012-10-23 05:04 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0A5C98AC-D570-4AA2-9CC6-F3EA688079BA}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 17:40 . 2011-08-02 06:37 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-04 12:50 . 2013-02-13 22:47 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-02 10:34 . 2011-08-02 04:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-03-27 21:07 . 2012-04-04 20:57 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-27 21:07 . 2011-08-02 07:19 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-06 21:26 . 2013-03-06 21:26 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-03-06 21:26 . 2013-03-06 21:26 310688 ----a-w- c:\windows\system32\javaws.exe
2013-03-06 21:26 . 2013-03-06 21:26 188832 ----a-w- c:\windows\system32\javaw.exe
2013-03-06 21:26 . 2013-03-06 21:26 188320 ----a-w- c:\windows\system32\java.exe
2013-03-06 21:26 . 2011-12-18 10:40 1085344 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-06 21:26 . 2011-08-03 00:34 963488 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-25 23:32 . 2013-02-25 23:32 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-02-25 23:32 . 2013-01-08 14:05 2505144 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-02-25 23:32 . 2011-08-02 04:47 15129960 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-02-25 23:32 . 2013-02-25 23:32 6262608 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-02-25 23:32 . 2011-08-02 04:47 2826040 ----a-w- c:\windows\system32\nvapi64.dll
2013-02-25 23:32 . 2013-02-25 23:32 18055184 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-02-25 23:32 . 2012-05-15 14:28 1107440 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-02-25 23:32 . 2012-05-15 14:28 1814304 ----a-w- c:\windows\system32\nvdispco64.dll
2013-02-25 23:32 . 2013-02-25 23:32 958120 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-02-25 23:32 . 2013-02-25 23:32 2720544 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-02-25 23:32 . 2013-02-25 23:32 26929440 ----a-w- c:\windows\system32\nvoglv64.dll
2013-02-25 23:32 . 2013-02-25 23:32 7932256 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-02-25 23:32 . 2013-02-25 23:32 2346784 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-02-25 23:32 . 2013-02-25 23:32 245872 ----a-w- c:\windows\system32\nvinitx.dll
2013-02-25 23:32 . 2013-02-25 23:32 11036448 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-02-25 23:32 . 2012-11-08 14:34 1510176 ----a-w- c:\windows\system32\nvdispgenco64.dll
2013-02-25 23:32 . 2013-02-25 23:32 2904352 ----a-w- c:\windows\system32\nvcuvid.dll
2013-02-25 23:32 . 2013-02-25 23:32 20449056 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-02-25 23:32 . 2011-08-02 04:48 15053264 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-02-25 23:32 . 2013-02-25 23:32 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-02-25 23:32 . 2013-02-25 23:32 7564040 ----a-w- c:\windows\system32\nvopencl.dll
2013-02-25 23:32 . 2013-02-25 23:32 1985824 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-02-25 23:32 . 2013-02-25 23:32 12641992 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-02-25 23:32 . 2013-02-25 23:32 9390760 ----a-w- c:\windows\system32\nvcuda.dll
2013-02-25 23:32 . 2013-02-25 23:32 201576 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-02-12 05:45 . 2013-03-14 01:12 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-14 01:12 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-14 01:12 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-14 01:12 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-14 01:12 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-14 01:12 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-08 17:25 . 2013-02-08 17:25 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-02-08 17:25 . 2012-06-15 16:45 861088 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-02-08 17:25 . 2011-08-02 07:20 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-01-24 21:50 . 2013-01-24 21:50 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2013-01-20 14:59 . 2013-01-20 14:59 230320 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-01-20 14:59 . 2012-08-30 21:03 130008 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-01-18 15:00 . 2011-01-07 18:50 6390048 ----a-w- c:\windows\system32\nvcpl.dll
2013-01-18 15:00 . 2011-01-07 18:49 3460896 ----a-w- c:\windows\system32\nvsvc64.dll
2013-01-18 15:00 . 2012-05-15 14:30 2953448 ----a-w- c:\windows\system32\nvcoproc.bin
2013-01-18 15:00 . 2011-01-07 18:49 118560 ----a-w- c:\windows\system32\nvmctray.dll
2013-01-18 15:00 . 2011-01-07 18:49 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-01-18 15:00 . 2011-01-07 18:49 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-01-18 15:00 . 2011-01-07 18:49 2558240 ----a-w- c:\windows\system32\nvsvcr.dll
2013-01-18 07:15 . 2013-01-18 07:15 550176 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2011-05-28 20:05 . 2011-08-03 00:32 164864 ----a-w- c:\program files (x86)\RarExt.dll
2011-05-28 20:04 . 2011-08-03 00:32 140288 ----a-w- c:\program files (x86)\RarExt32.dll
2011-05-28 20:04 . 2011-08-03 00:32 98304 ----a-w- c:\program files (x86)\Zip64.SFX
2011-05-28 20:04 . 2011-08-03 00:32 78848 ----a-w- c:\program files (x86)\Zip.SFX
2011-05-28 20:04 . 2011-08-03 00:32 128000 ----a-w- c:\program files (x86)\Default64.SFX
2011-05-28 20:04 . 2011-08-03 00:32 98816 ----a-w- c:\program files (x86)\Default.SFX
2011-05-28 20:03 . 2011-08-03 00:32 94720 ----a-w- c:\program files (x86)\WinCon64.SFX
2011-05-28 20:03 . 2011-08-03 00:32 72704 ----a-w- c:\program files (x86)\WinCon.SFX
2011-05-28 20:03 . 2011-08-03 00:32 276992 ----a-w- c:\program files (x86)\UnRAR.exe
2011-05-28 20:03 . 2011-08-03 00:32 417792 ----a-w- c:\program files (x86)\Rar.exe
2011-05-28 20:03 . 2011-08-03 00:32 1163264 ----a-w- c:\program files (x86)\WinRAR.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024]
"FileHippo.com"="c:\program files (x86)\FileHippo\UpdateChecker.exe" [2012-11-23 307712]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-02-17 3093624]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 MLPTDR_C;MLPTDR_C;c:\windows\system32\MLPTDR_C.SYS [x]
R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-01-28 1436424]
R3 GGSAFERDriver;GGSAFER Driver;c:\peete\Garena\Garena Classic\safedrv.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-02 1255736]
R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S1 aswKbd;aswKbd; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-04-12 283200]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-05-15 1327520]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1:9421
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 192.168.1.254
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
.
**************************************************************************
.
Celkový čas: 2013-04-14 17:24:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-04-14 15:24
ComboFix2.txt 2013-04-11 23:47
.
Před spuštěním: Volných bajtů: 197 992 693 760
Po spuštění: Volných bajtů: 197 699 432 448
.
- - End Of File - - 4E45B7F2E2C8F49D3A56761D4D05681A

#15 Příspěvek od **Rudy** » 14 dub 2013 17:28

Log již vypadá OK. Nastala nějaká změna?

VIRY.CZ

Počítač freezuje z neznámých důvodů

Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů

Re: Počítač freezuje z neznámých důvodů