Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

prosím o kontrolu LOGU

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

prosím o kontrolu LOGU

#1 Příspěvek od Hugo »

Zdravím, chtěl jsem Vás poprosit o kontrolu logu. Ač mám antivir, začaly mi v prohlížeci samovolně vyskakovat reklamní okna a přes mojí snahu o likvidaci možné příčiny se mi toto nedaří. Děkuji za pomoc!

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2013-05-27 18:11:49
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 356 GB (75%) free of 477 GB
Total RAM: 3062 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:11:56, on 27.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\Garmin\Express Tray\ExpressTray.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
C:\freeware\RSIT.exe
C:\Program Files\trend micro\admin.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.soft-quick.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [GarminExpressTrayApp] "C:\Program Files\Garmin\Express Tray\ExpressTray.exe"
O4 - HKCU\..\Run: [Spybot-S&D Cleaning] "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: c:\progra~1\contin~1\sprote~1.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 7249 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - "http://websearch.soft-quick.info/?l=1&q="

"{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\coFFPlgn\
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\IPSFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.202 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\extensions\
50df30738e7f8@50df30738e831.com
50f5a1a7e0975@50f5a1a7e09ae.com
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\searchplugins\
WebSearch.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll [2012-11-13 3214392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Norton Vulnerability Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL [2012-11-16 387040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NWEReboot"= []
"SDTray"=C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [2012-11-13 3825176]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Xvid"=C:\Program Files\Xvid\CheckUpdate.exe [2011-01-17 8192]
"GarminExpressTrayApp"=C:\Program Files\Garmin\Express Tray\ExpressTray.exe [2013-03-12 1099608]
"Spybot-S&D Cleaning"=C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [2012-11-13 3713032]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-05-05 4763008]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="c:\progra~1\contin~1\sprote~1.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon]
SDWinLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2013-05-05 113024]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon"
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.xvid"=xvidvfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-05-27 17:49:02 ----D---- C:\ProgramData\PDF Architect
2013-05-27 17:43:53 ----D---- C:\Program Files\CCleaner
2013-05-26 18:30:25 ----D---- C:\Program Files\Mozilla Firefox
2013-05-26 17:59:15 ----D---- C:\Program Files\trend micro
2013-05-26 17:59:13 ----D---- C:\rsit
2013-05-26 17:28:53 ----N---- C:\Windows\system32\HPDiscoPMB611.dll
2013-05-26 17:28:03 ----D---- C:\Program Files\HP
2013-05-26 17:27:53 ----A---- C:\ProgramData\Ament.ini
2013-05-26 17:13:10 ----D---- C:\ProgramData\HP
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript9.dll
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\jsproxy.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\iesetup.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\urlmon.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-05-23 19:58:36 ----A---- C:\Windows\system32\msfeeds.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ieui.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iesysprep.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iernonce.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ie4uinit.exe
2013-05-23 19:58:35 ----A---- C:\Windows\system32\iertutil.dll
2013-05-23 19:58:33 ----A---- C:\Windows\system32\wininet.dll
2013-05-23 19:58:32 ----A---- C:\Windows\system32\ieframe.dll
2013-05-23 19:58:29 ----A---- C:\Windows\system32\mshtml.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwansvc.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwanprotdim.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\win32k.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shell32.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shdocvw.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\consent.exe
2013-05-19 19:29:02 ----A---- C:\Windows\system32\authui.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\appinfo.dll
2013-05-12 20:46:42 ----A---- C:\Windows\wininit.ini
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Adobe
2013-05-04 17:00:26 ----RA---- C:\Windows\system32\drivers\SymIMV.sys
2013-05-04 12:55:46 ----D---- C:\Users\admin\AppData\Roaming\SUPERAntiSpyware.com
2013-05-04 12:55:46 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2013-05-04 12:55:41 ----D---- C:\Program Files\SUPERAntiSpyware
2013-05-04 11:53:40 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-05-04 11:53:24 ----A---- C:\Windows\system32\sdnclean.exe
2013-05-04 11:53:19 ----D---- C:\Program Files\Spybot - Search & Destroy 2
2013-05-02 22:01:49 ----A---- C:\Windows\system32\wextract.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\vbscript.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\pngfilt.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\occache.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msrating.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msls31.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmler.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmled.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshta.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedssync.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedsbs.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\inseng.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\imgutil.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iexpress.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieUnatt.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iepeers.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dat
2013-05-02 22:01:49 ----A---- C:\Windows\system32\IEAdvpack.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\elshyph.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtrans.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtmsft.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\webcheck.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\url.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\mshtmlmedia.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\licmgr10.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\iedkcs32.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\icardie.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsPrint.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WMPhoto.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\UIAnimation.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\FntCache.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\dxgi.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\DWrite.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d11.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10warp.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10level9.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d2d1.dll
2013-05-01 19:53:29 ----D---- C:\Users\admin\AppData\Roaming\Opera
2013-05-01 19:53:13 ----D---- C:\Program Files\Opera
2013-05-01 19:50:11 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of files/folders modified in the last 1 month======

2013-05-27 18:08:54 ----D---- C:\Windows\Temp
2013-05-27 18:08:53 ----D---- C:\Windows\inf
2013-05-27 18:07:37 ----D---- C:\Users\admin\AppData\Roaming\Skype
2013-05-27 18:07:35 ----D---- C:\Windows\Panther
2013-05-27 18:07:35 ----D---- C:\Windows\Minidump
2013-05-27 18:07:35 ----D---- C:\Windows\Logs
2013-05-27 18:07:35 ----D---- C:\Windows\debug
2013-05-27 18:07:35 ----D---- C:\Windows
2013-05-27 18:02:56 ----RD---- C:\Program Files
2013-05-27 18:02:56 ----HD---- C:\ProgramData
2013-05-27 18:01:59 ----SHD---- C:\Windows\Installer
2013-05-27 18:01:46 ----D---- C:\Program Files\Common Files\microsoft shared
2013-05-27 18:01:36 ----SHD---- C:\System Volume Information
2013-05-27 18:00:37 ----D---- C:\Windows\system32\config
2013-05-27 17:59:57 ----RSD---- C:\Windows\assembly
2013-05-27 17:58:51 ----D---- C:\Program Files\ContinueToSave
2013-05-27 17:58:20 ----D---- C:\Program Files\AviSynth 2.5
2013-05-27 17:58:18 ----D---- C:\Windows\System32
2013-05-27 17:46:11 ----D---- C:\freeware
2013-05-27 17:43:56 ----D---- C:\Windows\system32\Tasks
2013-05-27 17:43:19 ----D---- C:\Windows\Prefetch
2013-05-27 17:27:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-26 18:37:58 ----D---- C:\Windows\Microsoft.NET
2013-05-26 17:28:48 ----D---- C:\Windows\system32\DriverStore
2013-05-26 17:28:48 ----D---- C:\Windows\system32\catroot
2013-05-26 17:28:14 ----D---- C:\Windows\twain_32
2013-05-26 17:13:06 ----D---- C:\Windows\system32\drivers
2013-05-24 20:49:56 ----D---- C:\Windows\winsxs
2013-05-23 20:31:01 ----D---- C:\Program Files\Internet Explorer
2013-05-23 20:31:00 ----D---- C:\Windows\AppPatch
2013-05-23 20:30:59 ----D---- C:\Windows\system32\cs-CZ
2013-05-23 19:58:52 ----D---- C:\Windows\system32\catroot2
2013-05-23 19:54:19 ----A---- C:\Windows\system32\MRT.exe
2013-05-19 19:39:19 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-05-04 17:50:13 ----D---- C:\ProgramData\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files
2013-05-04 13:38:56 ----SD---- C:\ProgramData\Microsoft
2013-05-04 13:38:56 ----D---- C:\Program Files\Microsoft
2013-05-04 13:36:17 ----D---- C:\ProgramData\continuetosave
2013-05-04 13:35:18 ----D---- C:\ProgramData\firebird
2013-05-04 11:07:14 ----D---- C:\ProgramData\Norton
2013-05-02 22:31:37 ----D---- C:\Windows\system32\migration
2013-05-02 22:31:37 ----D---- C:\Windows\PolicyDefinitions
2013-05-02 22:31:36 ----D---- C:\Windows\system32\en-US
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-PT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-BR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pl-PL
2013-05-02 22:31:33 ----D---- C:\Windows\system32\ko-KR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\it-IT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\hu-HU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-TW
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-HK
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-CN
2013-05-02 22:31:32 ----D---- C:\Windows\system32\tr-TR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\sv-SE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ru-RU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nl-NL
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nb-NO
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ja-JP
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fr-FR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fi-FI
2013-05-02 22:31:32 ----D---- C:\Windows\system32\es-ES
2013-05-02 22:31:32 ----D---- C:\Windows\system32\el-GR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\de-DE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\da-DK

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NIS\1403010.016\SYMDS.SYS [2013-01-22 367704]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NIS\1403010.016\SYMEFA.SYS [2013-01-31 934488]
R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [2013-04-13 1000024]
R1 ccSet_NIS;Norton Internet Security Settings Manager; C:\Windows\system32\drivers\NIS\1403010.016\ccSetx86.sys [2012-11-16 134304]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2012-08-11 376480]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\IPSDefs\20130524.001\IDSvix86.sys [2013-02-14 386720]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2013-05-05 67664]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1403010.016\SRTSPX.SYS [2013-01-29 32344]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2012-11-16 36512]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NIS\1403010.016\Ironx86.SYS [2012-11-16 175264]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NIS\1403010.016\SYMNETS.SYS [2013-01-31 338592]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-11 106656]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130527.004\NAVENG.SYS [2013-05-23 93272]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130527.004\NAVEX15.SYS [2013-05-23 1611992]
R3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1403010.016\SRTSP.SYS [2013-01-29 602712]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2013-02-14 142496]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2013-05-05 116608]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-03-12 185688]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-11-13 1103392]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-11-13 1369624]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-11-13 168384]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-19 256904]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-05-26 117144]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-11-16 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#2 Příspěvek od Rudy »

Zdravím!
Spusťte nejprve tuto utilitu:
Stáhněte AdwCleaner http://www.stahuj.centrum.cz/utility_a_ ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte na Search (hledat)
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#3 Příspěvek od Hugo »

Dobrý den, děkuji za pomoc. Podle návodu přikládám log.

Děkuji!

# AdwCleaner v2.301 - Log vytvooen 28/05/2013 v 20:27:59
# Aktualizováno 16/05/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (32 bits)
# Uživatel : admin - PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\admin\Desktop\adwcleaner.exe
# Volba [Prohledat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Nalezeno : C:\Program Files\continuetosave
Složka Nalezeno : C:\Program Files\continuetosave
Složka Nalezeno : C:\ProgramData\continuetosave
Složka Nalezeno : C:\ProgramData\continuetosave
Složka Nalezeno : C:\ProgramData\InstallMate
Složka Nalezeno : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flpemcbdhfnlfgpfpdgggppdhkdpmmhb
Složka Nalezeno : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\extensions\50f5a1a7e0975@50f5a1a7e09ae.com
Soubor Nalezeno : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\searchplugins\WebSearch.xml

***** [Registry] *****

Data Nalezeno : HKLM\..\Windows [AppInit_DLLs] = c:\progra~1\contin~1\sprote~1.dll
Klíe Nalezeno : HKCU\Software\AppDataLow\SProtector
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Klíe Nalezeno : HKLM\Software\SP Global
Klíe Nalezeno : HKLM\Software\SProtector
Klíe Nalezeno : HKU\S-1-5-21-2053584350-1708006775-2896780222-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v10.0.9200.16576

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://websearch.soft-quick.info/

-\\ Mozilla Firefox v21.0 (cs)

Soubor : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\prefs.js

Nalezeno : user_pref("aol_toolbar.default.homepage.check", false);
Nalezeno : user_pref("aol_toolbar.default.search.check", false);
Nalezeno : user_pref("browser.search.defaultenginename", "WebSearch");
Nalezeno : user_pref("browser.search.defaultenginename,S", "WebSearch");
Nalezeno : user_pref("browser.search.defaulturl", "hxxp://websearch.soft-quick.info/?l=1&q=");
Nalezeno : user_pref("browser.search.order.1", "WebSearch");
Nalezeno : user_pref("browser.search.order.1,S", "WebSearch");
Nalezeno : user_pref("browser.search.selectedEngine", "WebSearch");
Nalezeno : user_pref("browser.search.selectedEngine,S", "WebSearch");
Nalezeno : user_pref("extensions.50df30738e8a3.scode", "(function(){try{if('aol.com,mail.google.com,premiumrepo[...]
Nalezeno : user_pref("extensions.50f5a1a7e0a20.scode", "(function(){try{if('aol.com,mail.google.com,premiumrepo[...]
Nalezeno : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Nalezeno : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Nalezeno : user_pref("keyword.URL", "hxxp://websearch.soft-quick.info/?l=1&q=");
Nalezeno : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Nalezeno : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Nalezeno : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Nalezeno : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Nalezeno : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Nalezeno : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Nalezeno : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Nalezeno : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v [Nemohu získat verzi]

Soubor : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Nalezeno [l.42] : homepage = "hxxp://websearch.soft-quick.info/",
Nalezeno [l.46] : urls_to_restore_on_startup = [ "hxxp://websearch.soft-quick.info/" ]

*************************

AdwCleaner[R1].txt - [4417 octets] - [28/05/2013 20:27:59]

########## EOF - C:\AdwCleaner[R1].txt - [4477 octets] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#4 Příspěvek od Rudy »

Spusťte znovu ADWCleaner a klikněte na >Delete< (smazat). Vložte nový log.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#5 Příspěvek od Hugo »

Opět zdravím, provedeno! Níže připojuji požadovaný log. Děkuji!

# AdwCleaner v2.301 - Log vytvooen 28/05/2013 v 22:39:51
# Aktualizováno 16/05/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (32 bits)
# Uživatel : admin - PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\admin\Desktop\adwcleaner.exe
# Volba [Vymazat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Vymazáno : C:\Program Files\continuetosave
Složka Vymazáno : C:\ProgramData\continuetosave
Složka Vymazáno : C:\ProgramData\InstallMate
Složka Vymazáno : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flpemcbdhfnlfgpfpdgggppdhkdpmmhb
Složka Vymazáno : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\extensions\50f5a1a7e0975@50f5a1a7e09ae.com
Soubor Vymazáno : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\searchplugins\WebSearch.xml

***** [Registry] *****

Data Vymazáno : HKLM\..\Windows [AppInit_DLLs] = c:\progra~1\contin~1\sprote~1.dll
Klíe Vymazáno : HKCU\Software\AppDataLow\SProtector
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Klíe Vymazáno : HKLM\Software\Conduit
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Klíe Vymazáno : HKLM\Software\SP Global
Klíe Vymazáno : HKLM\Software\SProtector

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v10.0.9200.16576

Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://websearch.soft-quick.info/ --> hxxp://www.google.com

-\\ Mozilla Firefox v21.0 (cs)

Soubor : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\prefs.js

Vymazáno : user_pref("aol_toolbar.default.homepage.check", false);
Vymazáno : user_pref("aol_toolbar.default.search.check", false);
Vymazáno : user_pref("browser.search.defaultenginename", "WebSearch");
Vymazáno : user_pref("browser.search.defaultenginename,S", "WebSearch");
Vymazáno : user_pref("browser.search.defaulturl", "hxxp://websearch.soft-quick.info/?l=1&q=");
Vymazáno : user_pref("browser.search.order.1", "WebSearch");
Vymazáno : user_pref("browser.search.order.1,S", "WebSearch");
Vymazáno : user_pref("browser.search.selectedEngine", "WebSearch");
Vymazáno : user_pref("browser.search.selectedEngine,S", "WebSearch");
Vymazáno : user_pref("extensions.50df30738e8a3.scode", "(function(){try{if('aol.com,mail.google.com,premiumrepo[...]
Vymazáno : user_pref("extensions.50f5a1a7e0a20.scode", "(function(){try{if('aol.com,mail.google.com,premiumrepo[...]
Vymazáno : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Vymazáno : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Vymazáno : user_pref("keyword.URL", "hxxp://websearch.soft-quick.info/?l=1&q=");
Vymazáno : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Vymazáno : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Vymazáno : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Vymazáno : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Vymazáno : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Vymazáno : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Vymazáno : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Vymazáno : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v [Nemohu získat verzi]

Soubor : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Vymazáno [l.42] : homepage = "hxxp://websearch.soft-quick.info/",
Vymazáno [l.46] : urls_to_restore_on_startup = [ "hxxp://websearch.soft-quick.info/" ]

*************************

AdwCleaner[R1].txt - [4546 octets] - [28/05/2013 20:27:59]
AdwCleaner[S1].txt - [4255 octets] - [28/05/2013 22:39:51]

########## EOF - C:\AdwCleaner[S1].txt - [4315 octets] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#6 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#7 Příspěvek od Hugo »

Tady je:

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2013-05-28 22:57:25
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 355 GB (75%) free of 477 GB
Total RAM: 3062 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:57:31, on 28.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\Garmin\Express Tray\ExpressTray.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\Windows\system32\taskeng.exe
C:\freeware\RSIT.exe
C:\Program Files\trend micro\admin.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.soft-quick.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [GarminExpressTrayApp] "C:\Program Files\Garmin\Express Tray\ExpressTray.exe"
O4 - HKCU\..\Run: [Spybot-S&D Cleaning] "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs:
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 7492 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

"{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\coFFPlgn\
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\IPSFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.202 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\extensions\
50df30738e7f8@50df30738e831.com
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll [2012-11-13 3214392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Norton Vulnerability Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL [2012-11-16 387040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NWEReboot"= []
"SDTray"=C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [2012-11-13 3825176]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Xvid"=C:\Program Files\Xvid\CheckUpdate.exe [2011-01-17 8192]
"GarminExpressTrayApp"=C:\Program Files\Garmin\Express Tray\ExpressTray.exe [2013-03-12 1099608]
"Spybot-S&D Cleaning"=C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [2012-11-13 3713032]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-05-05 4763008]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon]
SDWinLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2013-05-05 113024]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon"
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.xvid"=xvidvfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-05-28 22:39:51 ----A---- C:\AdwCleaner[S1].txt
2013-05-28 20:27:59 ----A---- C:\AdwCleaner[R1].txt
2013-05-27 17:49:02 ----D---- C:\ProgramData\PDF Architect
2013-05-27 17:43:53 ----D---- C:\Program Files\CCleaner
2013-05-26 18:30:25 ----D---- C:\Program Files\Mozilla Firefox
2013-05-26 17:59:15 ----D---- C:\Program Files\trend micro
2013-05-26 17:59:13 ----D---- C:\rsit
2013-05-26 17:28:53 ----N---- C:\Windows\system32\HPDiscoPMB611.dll
2013-05-26 17:28:03 ----D---- C:\Program Files\HP
2013-05-26 17:27:53 ----A---- C:\ProgramData\Ament.ini
2013-05-26 17:13:10 ----D---- C:\ProgramData\HP
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript9.dll
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\jsproxy.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\iesetup.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\urlmon.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-05-23 19:58:36 ----A---- C:\Windows\system32\msfeeds.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ieui.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iesysprep.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iernonce.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ie4uinit.exe
2013-05-23 19:58:35 ----A---- C:\Windows\system32\iertutil.dll
2013-05-23 19:58:33 ----A---- C:\Windows\system32\wininet.dll
2013-05-23 19:58:32 ----A---- C:\Windows\system32\ieframe.dll
2013-05-23 19:58:29 ----A---- C:\Windows\system32\mshtml.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwansvc.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwanprotdim.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\win32k.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shell32.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shdocvw.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\consent.exe
2013-05-19 19:29:02 ----A---- C:\Windows\system32\authui.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\appinfo.dll
2013-05-12 20:46:42 ----A---- C:\Windows\wininit.ini
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Adobe
2013-05-04 17:00:26 ----RA---- C:\Windows\system32\drivers\SymIMV.sys
2013-05-04 12:55:46 ----D---- C:\Users\admin\AppData\Roaming\SUPERAntiSpyware.com
2013-05-04 12:55:46 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2013-05-04 12:55:41 ----D---- C:\Program Files\SUPERAntiSpyware
2013-05-04 11:53:40 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-05-04 11:53:24 ----A---- C:\Windows\system32\sdnclean.exe
2013-05-04 11:53:19 ----D---- C:\Program Files\Spybot - Search & Destroy 2
2013-05-02 22:01:49 ----A---- C:\Windows\system32\wextract.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\vbscript.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\pngfilt.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\occache.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msrating.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msls31.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmler.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmled.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshta.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedssync.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedsbs.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\inseng.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\imgutil.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iexpress.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieUnatt.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iepeers.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dat
2013-05-02 22:01:49 ----A---- C:\Windows\system32\IEAdvpack.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\elshyph.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtrans.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtmsft.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\webcheck.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\url.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\mshtmlmedia.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\licmgr10.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\iedkcs32.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\icardie.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsPrint.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WMPhoto.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\UIAnimation.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\FntCache.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\dxgi.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\DWrite.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d11.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10warp.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10level9.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d2d1.dll
2013-05-01 19:53:29 ----D---- C:\Users\admin\AppData\Roaming\Opera
2013-05-01 19:53:13 ----D---- C:\Program Files\Opera
2013-05-01 19:50:11 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of files/folders modified in the last 1 month======

2013-05-28 22:55:55 ----D---- C:\Windows\System32
2013-05-28 22:55:55 ----D---- C:\Windows\inf
2013-05-28 22:55:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-28 22:44:10 ----SHD---- C:\System Volume Information
2013-05-28 22:44:07 ----D---- C:\Windows\Temp
2013-05-28 22:42:15 ----D---- C:\Windows\system32\config
2013-05-28 22:39:58 ----RD---- C:\Program Files
2013-05-28 22:39:58 ----HD---- C:\ProgramData
2013-05-28 20:24:22 ----D---- C:\Windows
2013-05-27 18:12:03 ----D---- C:\Windows\winsxs
2013-05-27 18:07:37 ----D---- C:\Users\admin\AppData\Roaming\Skype
2013-05-27 18:07:35 ----D---- C:\Windows\Panther
2013-05-27 18:07:35 ----D---- C:\Windows\Minidump
2013-05-27 18:07:35 ----D---- C:\Windows\Logs
2013-05-27 18:07:35 ----D---- C:\Windows\debug
2013-05-27 18:01:59 ----SHD---- C:\Windows\Installer
2013-05-27 18:01:46 ----D---- C:\Program Files\Common Files\microsoft shared
2013-05-27 17:59:57 ----RSD---- C:\Windows\assembly
2013-05-27 17:58:20 ----D---- C:\Program Files\AviSynth 2.5
2013-05-27 17:57:16 ----D---- C:\Program Files\Gabest
2013-05-27 17:46:11 ----D---- C:\freeware
2013-05-27 17:43:56 ----D---- C:\Windows\system32\Tasks
2013-05-27 17:43:19 ----D---- C:\Windows\Prefetch
2013-05-26 18:37:58 ----D---- C:\Windows\Microsoft.NET
2013-05-26 17:28:48 ----D---- C:\Windows\system32\DriverStore
2013-05-26 17:28:48 ----D---- C:\Windows\system32\catroot
2013-05-26 17:28:14 ----D---- C:\Windows\twain_32
2013-05-26 17:13:06 ----D---- C:\Windows\system32\drivers
2013-05-23 20:31:01 ----D---- C:\Program Files\Internet Explorer
2013-05-23 20:31:00 ----D---- C:\Windows\AppPatch
2013-05-23 20:30:59 ----D---- C:\Windows\system32\cs-CZ
2013-05-23 19:58:52 ----D---- C:\Windows\system32\catroot2
2013-05-23 19:54:19 ----A---- C:\Windows\system32\MRT.exe
2013-05-19 19:39:19 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-05-04 17:50:13 ----D---- C:\ProgramData\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files
2013-05-04 13:38:56 ----SD---- C:\ProgramData\Microsoft
2013-05-04 13:38:56 ----D---- C:\Program Files\Microsoft
2013-05-04 13:35:18 ----D---- C:\ProgramData\firebird
2013-05-04 11:07:14 ----D---- C:\ProgramData\Norton
2013-05-02 22:31:37 ----D---- C:\Windows\system32\migration
2013-05-02 22:31:37 ----D---- C:\Windows\PolicyDefinitions
2013-05-02 22:31:36 ----D---- C:\Windows\system32\en-US
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-PT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-BR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pl-PL
2013-05-02 22:31:33 ----D---- C:\Windows\system32\ko-KR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\it-IT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\hu-HU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-TW
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-HK
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-CN
2013-05-02 22:31:32 ----D---- C:\Windows\system32\tr-TR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\sv-SE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ru-RU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nl-NL
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nb-NO
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ja-JP
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fr-FR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fi-FI
2013-05-02 22:31:32 ----D---- C:\Windows\system32\es-ES
2013-05-02 22:31:32 ----D---- C:\Windows\system32\el-GR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\de-DE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\da-DK

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NIS\1403010.016\SYMDS.SYS [2013-01-22 367704]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NIS\1403010.016\SYMEFA.SYS [2013-01-31 934488]
R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [2013-04-13 1000024]
R1 ccSet_NIS;Norton Internet Security Settings Manager; C:\Windows\system32\drivers\NIS\1403010.016\ccSetx86.sys [2012-11-16 134304]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2012-08-11 376480]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\IPSDefs\20130527.001\IDSvix86.sys [2013-02-14 386720]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2013-05-05 67664]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1403010.016\SRTSPX.SYS [2013-01-29 32344]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2012-11-16 36512]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NIS\1403010.016\Ironx86.SYS [2012-11-16 175264]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NIS\1403010.016\SYMNETS.SYS [2013-01-31 338592]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-11 106656]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130528.009\NAVENG.SYS [2013-05-23 93272]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130528.009\NAVEX15.SYS [2013-05-23 1611992]
R3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1403010.016\SRTSP.SYS [2013-01-29 602712]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2013-02-14 142496]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2013-05-05 116608]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-03-12 185688]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-11-13 1103392]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-11-13 1369624]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-11-13 168384]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-19 256904]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-05-26 117144]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-11-16 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#8 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Program Files\Windows Live\Companion\companioncore.dll

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

Odinstalujte Spybot, může být v konfliktu s antispywarem NIS.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#9 Příspěvek od Hugo »

Zdravím! Opět děkuji za trpělivost a pomoc, vše jsem provedl podle návodu a níže připojuji log.

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2013-05-30 18:30:02
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 356 GB (75%) free of 477 GB
Total RAM: 3062 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:30:09, on 30.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Garmin\Express Tray\ExpressTray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\freeware\RSIT.exe
C:\Program Files\trend micro\admin.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.soft-quick.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [GarminExpressTrayApp] "C:\Program Files\Garmin\Express Tray\ExpressTray.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (file missing)
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs:
O23 - Service: SAS Core Service (!SASCORE) - Unknown owner - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 5971 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

"{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\coFFPlgn\
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\IPSFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.202 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\extensions\
50df30738e7f8@50df30738e831.com
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Norton Vulnerability Protection - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.DLL [2012-11-16 387040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\20.3.1.22\coIEPlg.dll [2013-04-02 509776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NWEReboot"= []
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Xvid"=C:\Program Files\Xvid\CheckUpdate.exe [2011-01-17 8192]
"GarminExpressTrayApp"=C:\Program Files\Garmin\Express Tray\ExpressTray.exe [2013-03-12 1099608]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.xvid"=xvidvfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-05-30 18:25:27 ----D---- C:\_OTM
2013-05-28 22:39:51 ----A---- C:\AdwCleaner[S1].txt
2013-05-28 20:27:59 ----A---- C:\AdwCleaner[R1].txt
2013-05-27 17:49:02 ----D---- C:\ProgramData\PDF Architect
2013-05-27 17:43:53 ----D---- C:\Program Files\CCleaner
2013-05-26 18:30:25 ----D---- C:\Program Files\Mozilla Firefox
2013-05-26 17:59:15 ----D---- C:\Program Files\trend micro
2013-05-26 17:59:13 ----D---- C:\rsit
2013-05-26 17:28:53 ----N---- C:\Windows\system32\HPDiscoPMB611.dll
2013-05-26 17:28:03 ----D---- C:\Program Files\HP
2013-05-26 17:27:53 ----A---- C:\ProgramData\Ament.ini
2013-05-26 17:13:10 ----D---- C:\ProgramData\HP
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript9.dll
2013-05-23 19:58:38 ----A---- C:\Windows\system32\jscript.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\jsproxy.dll
2013-05-23 19:58:37 ----A---- C:\Windows\system32\iesetup.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\urlmon.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-05-23 19:58:36 ----A---- C:\Windows\system32\msfeeds.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ieui.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iesysprep.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\iernonce.dll
2013-05-23 19:58:36 ----A---- C:\Windows\system32\ie4uinit.exe
2013-05-23 19:58:35 ----A---- C:\Windows\system32\iertutil.dll
2013-05-23 19:58:33 ----A---- C:\Windows\system32\wininet.dll
2013-05-23 19:58:32 ----A---- C:\Windows\system32\ieframe.dll
2013-05-23 19:58:29 ----A---- C:\Windows\system32\mshtml.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwansvc.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\wwanprotdim.dll
2013-05-19 19:29:11 ----A---- C:\Windows\system32\win32k.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2013-05-19 19:29:07 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shell32.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\shdocvw.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\consent.exe
2013-05-19 19:29:02 ----A---- C:\Windows\system32\authui.dll
2013-05-19 19:29:02 ----A---- C:\Windows\system32\appinfo.dll
2013-05-12 20:46:42 ----A---- C:\Windows\wininit.ini
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Adobe
2013-05-04 17:00:26 ----RA---- C:\Windows\system32\drivers\SymIMV.sys
2013-05-04 11:53:40 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-05-02 22:01:49 ----A---- C:\Windows\system32\wextract.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\vbscript.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\pngfilt.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\occache.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msrating.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msls31.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmler.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshtmled.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\mshta.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedssync.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\msfeedsbs.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\inseng.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\imgutil.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iexpress.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieUnatt.exe
2013-05-02 22:01:49 ----A---- C:\Windows\system32\iepeers.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\ieapfltr.dat
2013-05-02 22:01:49 ----A---- C:\Windows\system32\IEAdvpack.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\elshyph.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtrans.dll
2013-05-02 22:01:49 ----A---- C:\Windows\system32\dxtmsft.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\webcheck.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\url.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\mshtmlmedia.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\licmgr10.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\iedkcs32.dll
2013-05-02 22:01:48 ----A---- C:\Windows\system32\icardie.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-02 22:00:23 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsPrint.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WMPhoto.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\UIAnimation.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\FntCache.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\dxgi.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\DWrite.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d11.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10warp.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10level9.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10_1.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d3d10.dll
2013-05-02 22:00:23 ----A---- C:\Windows\system32\d2d1.dll
2013-05-01 19:53:29 ----D---- C:\Users\admin\AppData\Roaming\Opera
2013-05-01 19:53:13 ----D---- C:\Program Files\Opera
2013-05-01 19:50:11 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of files/folders modified in the last 1 month======

2013-05-30 18:28:30 ----D---- C:\Windows\Temp
2013-05-30 18:28:29 ----SHD---- C:\System Volume Information
2013-05-30 18:26:38 ----D---- C:\Windows\system32\config
2013-05-30 18:26:21 ----RD---- C:\Program Files
2013-05-30 18:24:47 ----D---- C:\Windows\System32
2013-05-30 18:24:47 ----D---- C:\Windows\inf
2013-05-30 18:24:47 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-30 18:22:18 ----HD---- C:\ProgramData
2013-05-30 18:21:59 ----SD---- C:\ProgramData\Microsoft
2013-05-28 20:24:22 ----D---- C:\Windows
2013-05-27 18:12:03 ----D---- C:\Windows\winsxs
2013-05-27 18:07:37 ----D---- C:\Users\admin\AppData\Roaming\Skype
2013-05-27 18:07:35 ----D---- C:\Windows\Panther
2013-05-27 18:07:35 ----D---- C:\Windows\Minidump
2013-05-27 18:07:35 ----D---- C:\Windows\Logs
2013-05-27 18:07:35 ----D---- C:\Windows\debug
2013-05-27 18:01:59 ----SHD---- C:\Windows\Installer
2013-05-27 18:01:46 ----D---- C:\Program Files\Common Files\microsoft shared
2013-05-27 17:59:57 ----RSD---- C:\Windows\assembly
2013-05-27 17:58:20 ----D---- C:\Program Files\AviSynth 2.5
2013-05-27 17:57:16 ----D---- C:\Program Files\Gabest
2013-05-27 17:46:11 ----D---- C:\freeware
2013-05-27 17:43:56 ----D---- C:\Windows\system32\Tasks
2013-05-27 17:43:19 ----D---- C:\Windows\Prefetch
2013-05-26 18:37:58 ----D---- C:\Windows\Microsoft.NET
2013-05-26 17:28:48 ----D---- C:\Windows\system32\DriverStore
2013-05-26 17:28:48 ----D---- C:\Windows\system32\catroot
2013-05-26 17:28:14 ----D---- C:\Windows\twain_32
2013-05-26 17:13:06 ----D---- C:\Windows\system32\drivers
2013-05-23 20:31:01 ----D---- C:\Program Files\Internet Explorer
2013-05-23 20:31:00 ----D---- C:\Windows\AppPatch
2013-05-23 20:30:59 ----D---- C:\Windows\system32\cs-CZ
2013-05-23 19:58:52 ----D---- C:\Windows\system32\catroot2
2013-05-23 19:54:19 ----A---- C:\Windows\system32\MRT.exe
2013-05-19 19:39:19 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-05-04 17:50:13 ----D---- C:\ProgramData\Adobe
2013-05-04 17:47:18 ----D---- C:\Program Files\Common Files
2013-05-04 13:38:56 ----D---- C:\Program Files\Microsoft
2013-05-04 13:35:18 ----D---- C:\ProgramData\firebird
2013-05-04 11:07:14 ----D---- C:\ProgramData\Norton
2013-05-02 22:31:37 ----D---- C:\Windows\system32\migration
2013-05-02 22:31:37 ----D---- C:\Windows\PolicyDefinitions
2013-05-02 22:31:36 ----D---- C:\Windows\system32\en-US
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-PT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pt-BR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\pl-PL
2013-05-02 22:31:33 ----D---- C:\Windows\system32\ko-KR
2013-05-02 22:31:33 ----D---- C:\Windows\system32\it-IT
2013-05-02 22:31:33 ----D---- C:\Windows\system32\hu-HU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-TW
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-HK
2013-05-02 22:31:32 ----D---- C:\Windows\system32\zh-CN
2013-05-02 22:31:32 ----D---- C:\Windows\system32\tr-TR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\sv-SE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ru-RU
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nl-NL
2013-05-02 22:31:32 ----D---- C:\Windows\system32\nb-NO
2013-05-02 22:31:32 ----D---- C:\Windows\system32\ja-JP
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fr-FR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\fi-FI
2013-05-02 22:31:32 ----D---- C:\Windows\system32\es-ES
2013-05-02 22:31:32 ----D---- C:\Windows\system32\el-GR
2013-05-02 22:31:32 ----D---- C:\Windows\system32\de-DE
2013-05-02 22:31:32 ----D---- C:\Windows\system32\da-DK

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NIS\1403010.016\SYMDS.SYS [2013-01-22 367704]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NIS\1403010.016\SYMEFA.SYS [2013-01-31 934488]
R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [2013-04-13 1000024]
R1 ccSet_NIS;Norton Internet Security Settings Manager; C:\Windows\system32\drivers\NIS\1403010.016\ccSetx86.sys [2012-11-16 134304]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2012-08-11 376480]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\IPSDefs\20130527.001\IDSvix86.sys [2013-02-14 386720]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1403010.016\SRTSPX.SYS [2013-01-29 32344]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2012-11-16 36512]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NIS\1403010.016\Ironx86.SYS [2012-11-16 175264]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\NIS\1403010.016\SYMNETS.SYS [2013-01-31 338592]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-11 106656]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130528.009\NAVENG.SYS [2013-05-23 93272]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\VirusDefs\20130528.009\NAVEX15.SYS [2013-05-23 1611992]
R3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1403010.016\SRTSP.SYS [2013-01-29 602712]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2013-02-14 142496]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-03-12 185688]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
S2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-19 256904]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-05-26 117144]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-11-16 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#10 Příspěvek od Rudy »

Log již vypadá OK. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#11 Příspěvek od Hugo »

Zdravím, tak rád bych vám napsal, že už mě ty vyskakovací okna nevyskakují, ale bohužel se mi to děje pořad. Jako prohlížeč mám Mozillu a bez nějakých pravidel mi někdy při kliknutí na odkaz na internetu vyskočí okno a odkazuje třeba na "p.employmentapplicationsforally.asia ". Jako Ásie musí být pěkná, ale takhle si to u mě rozhází:) Né, nejsou to jen odkazy na tento server..Nejsem žádný bezhlavý klikač a mám i antivir, ale toto nějak vše obešlo. Kdybyste byl tak hodný a poradil, co bych ještě mohl udělat? Je možné, že se ta havět skrývá i před odhalením a projevy v logu? Moc děkuji za pomoc a čas, který tomu věnujete!
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#12 Příspěvek od Rudy »

Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#13 Příspěvek od Hugo »

Zdravím, níže připojuji log z programu, díky.

ComboFix 13-05-31.02 - admin 01.06.2013 12:48:21.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3062.1937 [GMT 2:00]
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-05-01 do 2013-06-01 )))))))))))))))))))))))))))))))
.
.
2013-06-01 10:53 . 2013-06-01 10:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-27 15:49 . 2013-05-27 15:49 -------- d-----w- c:\programdata\PDF Architect
2013-05-27 15:43 . 2013-05-27 15:43 -------- d-----w- c:\program files\CCleaner
2013-05-26 15:59 . 2013-05-30 16:30 -------- d-----w- c:\program files\trend micro
2013-05-26 15:28 . 2012-10-17 02:04 580712 ------w- c:\windows\system32\HPDiscoPMB611.dll
2013-05-26 15:28 . 2013-05-26 15:28 -------- d-----w- c:\program files\HP
2013-05-26 15:25 . 2013-05-26 15:29 -------- d-----w- c:\users\admin\AppData\Local\HP
2013-05-26 15:13 . 2013-05-26 15:28 -------- d-----w- c:\programdata\HP
2013-05-19 17:29 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-19 17:29 . 2013-03-19 04:53 186368 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-19 17:29 . 2013-03-19 03:33 40960 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-19 17:29 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-19 17:29 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-19 17:29 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-19 17:29 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll
2013-05-19 17:29 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll
2013-05-04 15:47 . 2013-05-04 15:47 -------- d-----w- c:\program files\Common Files\Adobe
2013-05-04 15:00 . 2012-11-16 02:45 36512 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2013-05-04 09:53 . 2013-05-04 10:25 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-05-04 09:07 . 2013-05-04 09:46 -------- d-----w- c:\users\admin\AppData\Local\NPE
2013-05-02 20:00 . 2013-05-02 20:00 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-19 17:39 . 2013-03-29 12:52 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-19 17:39 . 2011-12-17 15:32 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-16 19:15 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-04-13 04:45 . 2013-05-19 17:29 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-19 17:29 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-24 16:51 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-03-19 05:04 . 2013-04-10 15:18 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 15:18 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48 . 2013-04-10 15:18 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49 . 2013-04-10 15:18 69632 ----a-w- c:\windows\system32\smss.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2013-03-12 1099608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1403010.016\SYMDS.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1403010.016\SYMEFA.SYS [x]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NIS\1403010.016\ccSetx86.sys [x]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.1.22\Definitions\IPSDefs\20130531.001\IDSvix86.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1403010.016\Ironx86.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1403010.016\SYMNETS.SYS [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-29 17:39]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://websearch.soft-quick.info/
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{1F6CB2EF-4205-494A-8CA0-80D8D8E55FF1}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4livhsso.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-NWEReboot - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\SUPERAntiSpyware\SASSEH.DLL
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\20.3.1.22\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-06-01 12:56:06
ComboFix-quarantined-files.txt 2013-06-01 10:56
.
Před spuštěním: Volných bajtů: 372 420 509 696
Po spuštění: Volných bajtů: 374 109 298 688
.
- - End Of File - - 8E744DC4E0EC1C1174F896189A63A93B
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119526
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: prosím o kontrolu LOGU

#14 Příspěvek od Rudy »

Log je OK. Přesvědčte se, zda máte zapnuto blokování vyskakovacích oken. Pokud ano, stáhněte, nainstalujte a spusťte SuperAntispyware: http://www.stahuj.centrum.cz/utility_a_ ... tispyware/ . Updatujte, proveďte sken a smažte vše, co najde. CF odinstalujte T-Cleanerem: http://vyosek.ic.cz/pro_usery/T-Cleaner.exe .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Hugo
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 27 kvě 2013 17:16

Re: prosím o kontrolu LOGU

#15 Příspěvek od Hugo »

Zdravím, vyskakovací okna mám blokovaná a asi jsem na to moc spoléhal. Takže jsem nyní dal po vyskočení okna "blokaci konkrétho serveru", a zatím ok:) Prý na tato okna odkazoval seznam.cz, tak nevím, proč se i přes zákaz vyskakovacích oken v Mozille objevovaly. Mohu se tedy zeptat, zda je možné považovat můj počítač za bezpečný, především z pohledu internetbankingu atd? Toto mě při zjištění problémů nejvíc trápilo. Každopádně moc děkuji za pomoc s řešením problému a váš čas, ještě mrknu, jak bych se mohl revanžovat.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“