Vir Police Čr

Zpráva

sorcer · #1 Příspěvek od **sorcer** » 29 kvě 2013 21:05

Dobrý večer, odstraňuji známému tento vir.

Níže posílám log z FRST64. Prosím o skript. Děkuji.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-05-2013
Ran by Lukáš (administrator) on 29-05-2013 21:51:16
Running from E:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 9
Boot Mode: Safe Mode (minimal)
==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Farbar) E:\FRST64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [792224 2012-02-10] (Atheros Communications)
HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [657568 2012-02-10] (Atheros Commnucations)
HKLM\...\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-05-30] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-05-30] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-05-30] (Lenovo)
HKLM\...\Run: [OneKeyReminder] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\OneKey Reminder.exe [537896 2012-01-12] (CyberLink)
HKLM\...\RunOnce: [OneKeyReminder] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\OneKey Reminder.exe /DeleteRunKey [537896 2012-01-12] (CyberLink)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-30] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [LockKey] C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-26] ( )
HKLM-x32\...\Run: [Dolby Advanced Audio v2] "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe" [136488 2011-01-29] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s [228448 2011-01-29] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0" [222504 2010-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-05-30] (Lenovo)
HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1658440 2011-04-20] (McAfee, Inc.)
HKLM-x32\...\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery" [222504 2009-05-14] (CyberLink Corp.)
HKU\Default\...\RunOnce: [Lenovo.ShowBand] C:\SWTOOLS\SimpleTap DeskBand\ShowBand.exe /show [155960 2012-02-17] (Lenovo)
HKU\Default User\...\RunOnce: [Lenovo.ShowBand] C:\SWTOOLS\SimpleTap DeskBand\ShowBand.exe /show [155960 2012-02-17] (Lenovo)
HKU\UpdatusUser\...\Run: [Power2GoExpress] NA [x]
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [260928 2012-02-23] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120530071233.dll (McAfee, Inc.)
BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120530071233.dll (McAfee, Inc.)
BHO-x32: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\progra~2\mcafee\sitead~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\progra~2\mcafee\sitead~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\progra~2\mcafee\sitead~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\progra~2\mcafee\sitead~1\mcieplg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\PROGRA~1\mcafee\msc\MCSNIE~1.DLL (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{8E0934FA-64E2-4897-820A-FD41AC6D8D63}: [NameServer]194.24.128.100 81.3.216.100
Tcpip\..\Interfaces\{98B20819-9A18-447A-9DC7-3F257430965C}: [NameServer]194.24.128.100 81.3.216.100
Tcpip\..\Interfaces\{B0D87FD9-0EAB-4652-A13F-A909E3257766}: [NameServer]194.24.128.100 81.3.216.100
Tcpip\..\Interfaces\{F5DCECC6-F037-4470-B942-4B5548435A71}: [NameServer]194.24.128.100 81.3.216.100

==================== Services (Whitelisted) =================

S2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
S2 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-02-13] (Lenovo (Beijing) Limited)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
S2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2012-02-10] (Atheros)
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [x]
S2 BBSvc; C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [x]
S3 BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [x]
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe -/service [x]
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [x]
S2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
S3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]
S3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [x]
S3 osppsvc; "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE" [x]
S2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [x]
S2 PCSUService; C:\Program Files (x86)\Zrychleni Pocitace\PCSUService.exe [x]
S2 Skype C2C Service; "C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [x]
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 acnbkhgj; C:\Windows\system32\drivers\acnbkhgj.sys [49872 2013-05-27] (Microsoft Corporation)
S1 bnshkbrl; C:\Windows\system32\drivers\bnshkbrl.sys [49872 2013-05-20] (Microsoft Corporation)
S1 bvmlzmiq; C:\Windows\system32\drivers\bvmlzmiq.sys [49872 2013-05-20] (Microsoft Corporation)
S1 bxjrotna; C:\Windows\system32\drivers\bxjrotna.sys [49872 2013-05-20] (Microsoft Corporation)
S1 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-11] (Lenovo)
S1 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
S1 fdszjlwg; C:\Windows\system32\drivers\fdszjlwg.sys [49872 2013-05-27] (Microsoft Corporation)
S1 gsttjgsr; C:\Windows\system32\drivers\gsttjgsr.sys [49872 2013-05-20] (Microsoft Corporation)
S1 htvlnbwg; C:\Windows\system32\drivers\htvlnbwg.sys [49872 2012-12-21] (Microsoft Corporation)
S1 jdwbtyvn; C:\Windows\system32\drivers\jdwbtyvn.sys [49872 2012-12-21] (Microsoft Corporation)
S1 lpxiqcik; C:\Windows\system32\drivers\lpxiqcik.sys [49872 2013-05-27] (Microsoft Corporation)
S1 miaylaql; C:\Windows\system32\drivers\miaylaql.sys [49872 2012-12-21] (Microsoft Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-02-20] (Microsoft Corporation)
S1 nkifziun; C:\Windows\system32\drivers\nkifziun.sys [49872 2013-05-27] (Microsoft Corporation)
S1 pnggncrt; C:\Windows\system32\drivers\pnggncrt.sys [49872 2013-05-27] (Microsoft Corporation)
S1 ppmgjqwq; C:\Windows\system32\drivers\ppmgjqwq.sys [49872 2013-05-26] (Microsoft Corporation)
S1 qpeygyja; C:\Windows\system32\drivers\qpeygyja.sys [49872 2013-05-20] (Microsoft Corporation)
S1 sdgncqqb; C:\Windows\system32\drivers\sdgncqqb.sys [49872 2013-05-20] (Microsoft Corporation)
S1 squukdtv; C:\Windows\system32\drivers\squukdtv.sys [49872 2013-05-27] (Microsoft Corporation)
S1 tbfwvsou; C:\Windows\system32\drivers\tbfwvsou.sys [49872 2013-05-27] (Microsoft Corporation)
S1 tpzqyrjf; C:\Windows\system32\drivers\tpzqyrjf.sys [49872 2013-05-20] (Microsoft Corporation)
S3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
S1 wgudtjns; C:\Windows\system32\drivers\wgudtjns.sys [49872 2013-05-20] (Microsoft Corporation)
S1 zeeyvmfl; C:\Windows\system32\drivers\zeeyvmfl.sys [49872 2013-05-20] (Microsoft Corporation)
S1 zhbvmhji; C:\Windows\system32\drivers\zhbvmhji.sys [49872 2013-05-20] (Microsoft Corporation)
U3 BcmSqlStartupSvc;
S1 BPntDrv; system32\drivers\BPntDrv.sys [x]
S3 BthMtpEnum; system32\DRIVERS\BthMtpEnum.sys [x]
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
S1 cwfnuuvc; \??\C:\Windows\system32\drivers\cwfnuuvc.sys [x]
U2 DriverService;
S1 earogmxl; \??\C:\Windows\system32\drivers\earogmxl.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
R0 fbfmon; system32\drivers\fbfmon.sys [x]
S1 gcwwiomh; \??\C:\Windows\system32\drivers\gcwwiomh.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
S2 NisDrv; system32\DRIVERS\NisDrvWFP.sys [x]
U2 Oasis2Service;
S1 oespmfaz; \??\C:\Windows\system32\drivers\oespmfaz.sys [x]
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
S1 rppxoitn; \??\C:\Windows\system32\drivers\rppxoitn.sys [x]
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
S3 WinUsb; system32\DRIVERS\WinUsb.sys [x]

========================== Drivers MD5 =======================

C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys DA1E991A61CFDD755A589E206B97644B
C:\Windows\System32\Drivers\ksecpkg.sys 7E33198D956943A4F11A5474C1E9106F
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys E84DA1A93978B3700EA63414357B9BA3
C:\Windows\System32\DRIVERS\LhdX64.sys BE166935083F9C38EDFDC21B9A7A679B
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lpxiqcik.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys 6B01B7414A105B9E51652089A03027CF
C:\Windows\system32\drivers\miaylaql.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys F8A10560B35C66F9DE212F03DAD5BFA7
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys C38B8AE57F78915905064A9A24DC1586
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\system32\drivers\nkifziun.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys A2F74975097F52A00745F9637451FDD8
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nvlddmkm.sys A68C95F8E17A4CFCB99F2139D73F552B
C:\Windows\System32\DRIVERS\nvpciflt.sys 7B4BD86B22DFE63FC08E5F4E24B54438
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\system32\drivers\pnggncrt.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\system32\drivers\ppmgjqwq.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qpeygyja.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUVStor.sys 88AB579F407A3D02918B8DCC4E6E34B3
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\drivers\sdgncqqb.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\system32\drivers\squukdtv.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\tbfwvsou.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\drivers\tcpip.sys FC62769E7BFF2896035AEED399108162
C:\Windows\System32\DRIVERS\tcpip.sys FC62769E7BFF2896035AEED399108162
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys DBCC20C02E8A3E43B03C304A4E40A84F
C:\Windows\system32\drivers\tpzqyrjf.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vm331avs.sys 8793B8146F58D54D07245CE5F722DA93
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\system32\drivers\wgudtjns.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wsvd.sys 83575C43B2BFE9AB0661A7F957E843C0
C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit
C:\Windows\system32\drivers\zeeyvmfl.sys 5E75CA03513BF7563F9A6AFCBDC47AC2
C:\Windows\system32\drivers\zhbvmhji.sys 5E75CA03513BF7563F9A6AFCBDC47AC2

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-29 21:51 - 2013-05-29 21:51 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-05-29 22:29 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\sk-SK
2013-05-29 22:22 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-05-29 22:21 - 2011-10-10 10:19 - 00000000 ____D C:\Program Files\Windows Journal
2013-05-29 21:51 - 2013-05-29 21:51 - 00000000 ____D C:\FRST
2013-05-29 21:51 - 1601-01-01 02:14 - 01578700 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-29 21:51 - 1601-01-01 02:14 - 00680082 ____A C:\Windows\System32\perfh005.dat
2013-05-29 21:51 - 1601-01-01 02:14 - 00137962 ____A C:\Windows\System32\perfc005.dat
2013-05-29 21:49 - 1601-01-01 02:14 - 00328493 ____A C:\Windows\System32\fastboot.set
2013-05-29 21:35 - 2009-07-14 06:45 - 00289192 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-29 17:02 - 2013-03-05 13:58 - 00000374 ____A C:\Windows\Tasks\WpsUpdateTask_Lukáš.job
2013-05-29 17:02 - 2012-09-09 00:51 - 00000914 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-29 17:02 - 2012-05-30 16:13 - 00000966 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-29 17:02 - 2012-05-30 16:13 - 00000962 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-29 15:01 - 2013-02-17 08:43 - 00000276 ____A C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-05-29 13:12 - 2013-03-05 14:12 - 00000278 ____A C:\Windows\Tasks\SweetPCFix_UPDATES.job
2013-05-29 13:05 - 2013-02-17 08:45 - 00000368 ____A C:\Windows\Tasks\PC SpeedUp Service Deactivator.job
2013-05-29 12:45 - 2012-05-30 15:26 - 00422082 ____A C:\Windows\WindowsUpdate.log
2013-05-27 23:56 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TBFWVSOU.sys
2013-05-27 21:01 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\PNGGNCRT.sys
2013-05-27 19:53 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ACNBKHGJ.sys
2013-05-27 19:50 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FDSZJLWG.sys
2013-05-27 19:42 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\NKIFZIUN.sys
2013-05-27 18:06 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\LPXIQCIK.sys
2013-05-27 18:00 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\SQUUKDTV.sys
2013-05-26 00:46 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\PPMGJQWQ.sys
2013-05-25 10:59 - 2013-02-17 08:43 - 00000284 ____A C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-05-20 23:46 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ZHBVMHJI.sys
2013-05-20 23:45 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TPZQYRJF.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ZEEYVMFL.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WGUDTJNS.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\GSTTJGSR.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BNSHKBRL.sys
2013-05-20 23:43 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BXJROTNA.sys
2013-05-20 23:43 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BVMLZMIQ.sys
2013-05-20 23:42 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\QPEYGYJA.sys
2013-05-20 23:38 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\SDGNCQQB.sys
2013-05-03 17:38 - 1601-01-01 02:14 - 00060824 ____A C:\Users\Lukáš\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-03 17:38 - 1601-01-01 02:14 - 00002250 ____A C:\Users\Lukáš\Desktop\OneKey Recovery.lnk

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Spr vce spouçtŘnˇ syst‚mu Windows
--------------------
identifik tor {bootmgr}
device partition=\Device\HarddiskVolume1
description Windows Boot Manager
locale cs-CZ
inherit {globalsettings}
default {current}
resumeobject {90b5e6e4-a9cb-11e1-8d27-dc0ea1ef9634}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 0

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale cs-CZ
inherit {bootloadersettings}
recoverysequence {eb2f054f-f907-11e1-aab1-446d57e56960}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {90b5e6e4-a9cb-11e1-8d27-dc0ea1ef9634}
nx OptIn

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {eb2f054f-f907-11e1-aab1-446d57e56960}
device ramdisk=[C:]\Recovery\eb2f054f-f907-11e1-aab1-446d57e56960\Winre.wim,{eb2f0550-f907-11e1-aab1-446d57e56960}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\eb2f054f-f907-11e1-aab1-446d57e56960\Winre.wim,{eb2f0550-f907-11e1-aab1-446d57e56960}
systemroot \windows
nx OptIn
winpe Yes

Obnovenˇ z hibernace
---------------------
identifik tor {90b5e6e4-a9cb-11e1-8d27-dc0ea1ef9634}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale cs-CZ
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Testov nˇ pamŘti syst‚mu Windows
---------------------
identifik tor {memdiag}
device partition=\Device\HarddiskVolume1
path \boot\memtest.exe
description Windows Memory Diagnostic
locale cs-CZ
inherit {globalsettings}
badmemoryaccess Yes

Nastavenˇ slu§by EMS
------------
identifik tor {emssettings}
bootems Yes

Nastavenˇ ladicˇho programu
-----------------
identifik tor {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

Chyby pamŘti RAM
-----------
identifik tor {badmemory}

Glob lnˇ nastavenˇ
---------------
identifik tor {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Nastavenˇ spouçtŘcˇho zavadŘźe
--------------------
identifik tor {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Nastavenˇ hypervisoru
-------------------
identifik tor {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Nastavenˇ zavadŘźe obnovenˇ
----------------------
identifik tor {resumeloadersettings}
inherit {globalsettings}

Parametry instalaźnˇho disku RAM
---------------------
identifik tor {ramdiskoptions}
description Ramdisk options
ramdisksdidevice boot
ramdisksdipath \boot\boot.sdi

Parametry zaýˇzenˇ
--------------
identifik tor {eb2f0550-f907-11e1-aab1-446d57e56960}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\eb2f054f-f907-11e1-aab1-446d57e56960\boot.sdi

Last Boot: 2011-02-24 19:04

==================== End Of Log ============================

#2 Příspěvek od **vyosek** » 29 kvě 2013 21:14

Zdravim a pekny vecer preji
Vas log se studuje Obrázek

a pracuje se na nem Obrázek

.
Prosim o strpeni! Obrázek

#3 Příspěvek od **vyosek** » 29 kvě 2013 21:19

Znamy se dal na chov konicku trojskych a stadecka rootkitu ci co

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

CMD: rmdir "C:\Program Files (x86)\AskPartnerNetwork" /s /q
CMD: rmdir "C:\Program Files (x86)\PANDORA.TV" /s /q
CMD: rmdir "C:\Program Files (x86)\Zrychleni Pocitace" /s /q
S2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [x]
S2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [x]
S2 PCSUService; C:\Program Files (x86)\Zrychleni Pocitace\PCSUService.exe [x]
S1 acnbkhgj; C:\Windows\system32\drivers\acnbkhgj.sys [49872 2013-05-27] (Microsoft Corporation)
S1 bnshkbrl; C:\Windows\system32\drivers\bnshkbrl.sys [49872 2013-05-20] (Microsoft Corporation)
S1 bvmlzmiq; C:\Windows\system32\drivers\bvmlzmiq.sys [49872 2013-05-20] (Microsoft Corporation)
S1 bxjrotna; C:\Windows\system32\drivers\bxjrotna.sys [49872 2013-05-20] (Microsoft Corporation)
S1 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-11] (Lenovo)
S1 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
S1 fdszjlwg; C:\Windows\system32\drivers\fdszjlwg.sys [49872 2013-05-27] (Microsoft Corporation)
S1 gsttjgsr; C:\Windows\system32\drivers\gsttjgsr.sys [49872 2013-05-20] (Microsoft Corporation)
S1 htvlnbwg; C:\Windows\system32\drivers\htvlnbwg.sys [49872 2012-12-21] (Microsoft Corporation)
S1 jdwbtyvn; C:\Windows\system32\drivers\jdwbtyvn.sys [49872 2012-12-21] (Microsoft Corporation)
S1 lpxiqcik; C:\Windows\system32\drivers\lpxiqcik.sys [49872 2013-05-27] (Microsoft Corporation)
S1 miaylaql; C:\Windows\system32\drivers\miaylaql.sys [49872 2012-12-21] (Microsoft Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-02-20] (Microsoft Corporation)
S1 nkifziun; C:\Windows\system32\drivers\nkifziun.sys [49872 2013-05-27] (Microsoft Corporation)
S1 pnggncrt; C:\Windows\system32\drivers\pnggncrt.sys [49872 2013-05-27] (Microsoft Corporation)
S1 ppmgjqwq; C:\Windows\system32\drivers\ppmgjqwq.sys [49872 2013-05-26] (Microsoft Corporation)
S1 qpeygyja; C:\Windows\system32\drivers\qpeygyja.sys [49872 2013-05-20] (Microsoft Corporation)
S1 sdgncqqb; C:\Windows\system32\drivers\sdgncqqb.sys [49872 2013-05-20] (Microsoft Corporation)
S1 squukdtv; C:\Windows\system32\drivers\squukdtv.sys [49872 2013-05-27] (Microsoft Corporation)
S1 tbfwvsou; C:\Windows\system32\drivers\tbfwvsou.sys [49872 2013-05-27] (Microsoft Corporation)
S1 tpzqyrjf; C:\Windows\system32\drivers\tpzqyrjf.sys [49872 2013-05-20] (Microsoft Corporation)
S3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
S1 wgudtjns; C:\Windows\system32\drivers\wgudtjns.sys [49872 2013-05-20] (Microsoft Corporation)
S1 zeeyvmfl; C:\Windows\system32\drivers\zeeyvmfl.sys [49872 2013-05-20] (Microsoft Corporation)
S1 zhbvmhji; C:\Windows\system32\drivers\zhbvmhji.sys [49872 2013-05-20] (Microsoft Corporation)
S1 cwfnuuvc; \??\C:\Windows\system32\drivers\cwfnuuvc.sys [x]
S1 earogmxl; \??\C:\Windows\system32\drivers\earogmxl.sys [x]
S1 gcwwiomh; \??\C:\Windows\system32\drivers\gcwwiomh.sys [x]
S1 oespmfaz; \??\C:\Windows\system32\drivers\oespmfaz.sys [x]
S1 rppxoitn; \??\C:\Windows\system32\drivers\rppxoitn.sys [x]
C:\Windows\system32\drivers\acnbkhgj.sys
C:\Windows\system32\drivers\bnshkbrl.sys
C:\Windows\system32\drivers\bvmlzmiq.sys
C:\Windows\system32\drivers\bxjrotna.sys
C:\Windows\System32\DRIVERS\DamageGuardX64.sys
C:\Windows\System32\drivers\dgFltrX64.sys
C:\Windows\system32\drivers\fdszjlwg.sys
C:\Windows\system32\drivers\gsttjgsr.sys
C:\Windows\system32\drivers\htvlnbwg.sys
C:\Windows\system32\drivers\jdwbtyvn.sys
C:\Windows\system32\drivers\lpxiqcik.sys
C:\Windows\system32\drivers\miaylaql.sys
C:\Windows\System32\DRIVERS\MpFilter.sys
C:\Windows\system32\drivers\nkifziun.sys
C:\Windows\system32\drivers\pnggncrt.sys
C:\Windows\system32\drivers\ppmgjqwq.sys
C:\Windows\system32\drivers\qpeygyja.sys
C:\Windows\system32\drivers\sdgncqqb.sys
C:\Windows\system32\drivers\squukdtv.sys
C:\Windows\system32\drivers\tbfwvsou.sys
C:\Windows\system32\drivers\tpzqyrjf.sys
C:\Windows\System32\Drivers\vm331avs.sys
C:\Windows\system32\drivers\wgudtjns.sys
C:\Windows\system32\drivers\zeeyvmfl.sys
C:\Windows\system32\drivers\zhbvmhji.sys
2013-05-29 17:02 - 2013-03-05 13:58 - 00000374 ____A C:\Windows\Tasks\WpsUpdateTask_Lukáš.job
2013-05-29 17:02 - 2012-09-09 00:51 - 00000914 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-29 17:02 - 2012-05-30 16:13 - 00000966 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-29 17:02 - 2012-05-30 16:13 - 00000962 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-29 15:01 - 2013-02-17 08:43 - 00000276 ____A C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-05-29 13:12 - 2013-03-05 14:12 - 00000278 ____A C:\Windows\Tasks\SweetPCFix_UPDATES.job
2013-05-29 13:05 - 2013-02-17 08:45 - 00000368 ____A C:\Windows\Tasks\PC SpeedUp Service Deactivator.job
2013-05-27 23:56 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TBFWVSOU.sys
2013-05-27 21:01 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\PNGGNCRT.sys
2013-05-27 19:53 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ACNBKHGJ.sys
2013-05-27 19:50 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FDSZJLWG.sys
2013-05-27 19:42 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\NKIFZIUN.sys
2013-05-27 18:06 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\LPXIQCIK.sys
2013-05-27 18:00 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\SQUUKDTV.sys
2013-05-26 00:46 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\PPMGJQWQ.sys
2013-05-25 10:59 - 2013-02-17 08:43 - 00000284 ____A C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-05-20 23:46 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ZHBVMHJI.sys
2013-05-20 23:45 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TPZQYRJF.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ZEEYVMFL.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WGUDTJNS.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\GSTTJGSR.sys
2013-05-20 23:44 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BNSHKBRL.sys
2013-05-20 23:43 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BXJROTNA.sys
2013-05-20 23:43 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BVMLZMIQ.sys
2013-05-20 23:42 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\QPEYGYJA.sys
2013-05-20 23:38 - 1601-01-01 02:14 - 00049872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\SDGNCQQB.sys

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny log na flashku k FRST

Spustte znovu FRST.exe na tom poskozenem PC

Kliknete na Fix
Probehne oprava a na flash disku se vytvori log Fixlog.txt

Pokuste se nastartovat do bezneho rezimu

sorcer · #4 Příspěvek od **sorcer** » 29 kvě 2013 21:53

Velice Vám děkuji za pomoc.

Ač jsem si několikráte četl váš podpis, a běžně to sám dělám automaticky, nezazálohoval jsem na infikovaném Pc položky z plochy (pár složek s fotkama).

Nečekal jsem, že dojde k tak razantnímu obnovení.

Je možno nějakým způsobem vrátit předchozí stav a ta data zálohovat.

Má chyba, vím..

Obnova systému je a byla žel bohu vypnuta

#5 Příspěvek od **vyosek** » 29 kvě 2013 21:57

Co si mam predstavit pod "Nečekal jsem, že dojde k tak razantnímu obnovení."

Skript zadne osobni veci nemazal, takze by mely byt zachovany...

Dostanete se do normalniho rezimu? Tam pak udelat zalohu a urcite bude treba to docistit, bo tam toho je hafo

sorcer · #6 Příspěvek od **sorcer** » 29 kvě 2013 22:02

Nechal jsem Pc najet do "běžného režimu", avšak nezobrazila se plocha tak jak byla dříve (před spuštěním skriptu, ale výchozí plocha - kterou běžně vídáte při prvním zapnutí u nově zakoupeného PC.

#7 Příspěvek od **vyosek** » 29 kvě 2013 22:24

Ty data tam nekde budou, pokud je malware nesmazal

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?t=81939

Mrknu na to ale az rano

sorcer · #8 Příspěvek od **sorcer** » 30 kvě 2013 08:04

RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukáš at 2013-05-30 08:55:46
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 432 GB (65%) free of 669 GB
Total RAM: 8092 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:55:55, on 30.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\LockKey\LockKey.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120530071233.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [LockKey] C:\Program Files (x86)\LockKey\LockKey.exe
O4 - HKLM\..\Run: [Dolby Advanced Audio v2] "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
O4 - HKLM\..\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
O4 - HKLM\..\Run: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
O4 - HKLM\..\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
O4 - HKLM\..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-750176904-3055829442-1053477990-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-750176904-3055829442-1053477990-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{8E0934FA-64E2-4897-820A-FD41AC6D8D63}: NameServer = 194.24.128.100 81.3.216.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{98B20819-9A18-447A-9DC7-3F257430965C}: NameServer = 194.24.128.100 81.3.216.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0D87FD9-0EAB-4652-A13F-A909E3257766}: NameServer = 194.24.128.100 81.3.216.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5DCECC6-F037-4470-B942-4B5548435A71}: NameServer = 194.24.128.100 81.3.216.100
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Unknown owner - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: BingBar Service (BBSvc) - Unknown owner - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe (file missing)
O23 - Service: BBUpdate - Unknown owner - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: Lenovo Instant Reset Service (DamageGuardSvc) - Lenovo (Beijing) Limited - C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HWDeviceService64.exe - Unknown owner - C:\ProgramData\DatacardService\HWDeviceService64.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mobile Partner. OUC (Mobile Partner. RunOuc) - Unknown owner - C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\MsMpEng.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243 (NisSrv) - Unknown owner - c:\Program Files\Microsoft Security Client\NisSrv.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Office Software Protection Platform (osppsvc) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Unknown owner - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Unknown owner - C:\Program Files (x86)\Skype\Updater\Updater.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: ZAtheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

--
End of file - 13457 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
"taskhost.exe"
taskeng.exe {391105DD-8245-46E0-ADE7-272BD04DF275}
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe"
"C:\Program Files (x86)\Lenovo\Energy Management\utility.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\LockKey\LockKey.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
"C:\Program Files (x86)\USB Camera\VM331_STI.EXE"
"C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
"C:\Program Files\mcafee.com\agent\mcagent.exe" /runkey
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 3040
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"taskhost.exe"
"D:\Program Files\Recuva\recuva64.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"E:\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120530071233.dll [2011-03-13 92888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
Partner BHO Class - C:\ProgramData\Partner\Partner64.dll [2012-05-30 750064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2012-05-30 410288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2011-04-09 309096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120530071233.dll [2011-03-13 78456]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
Partner BHO Class - C:\ProgramData\Partner\Partner.dll [2012-05-30 433648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-02-10 64672]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2012-05-30 305328]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\progra~2\mcafee\sitead~1\mcieplg.dll [2011-04-09 251928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2011-04-09 309096]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2012-05-30 410288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\progra~2\mcafee\sitead~1\mcieplg.dll [2011-04-09 251928]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2012-05-30 305328]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2012-03-02 170264]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-03-02 398616]
"Persistence"=C:\Windows\system32\igfxpers.exe [2012-03-02 440600]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2011-12-15 564352]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2012-01-16 2809856]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2012-02-10 792224]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2012-02-10 657568]
"Energy Management"=C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [2012-05-30 8079408]
"EnergyUtility"=C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [2012-05-30 6199128]
"Lenovo EE Boot Optimizer"=C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [2012-05-30 206176]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2011-11-30 284440]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2012-02-27 291608]
"LockKey"=C:\Program Files (x86)\LockKey\LockKey.exe [2011-08-26 337776]
"Dolby Advanced Audio v2"=C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2011-12-21 507744]
"331BigDog"=C:\Program Files (x86)\USB Camera\VM331_STI.EXE [2011-11-24 548864]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"YouCam Mirage"=C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-29 136488]
"YouCam Tray"=C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [2011-01-29 228448]
"UpdateP2GShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2010-07-27 222504]
"VeriFaceManager"=C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [2012-05-30 329056]
"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2011-04-20 1658440]
"UpdatePRCShortCut"=C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [2009-05-14 222504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-02-17 430080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2013-05-30 08:55:46 ----D---- C:\rsit
2013-05-30 08:55:46 ----D---- C:\Program Files\trend micro
2013-05-29 22:54:50 ----D---- C:\Users\Lukáš\AppData\Roaming\Adobe
2013-05-29 21:51:04 ----D---- C:\FRST
2013-05-27 19:00:07 ----A---- C:\Windows\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2013-05-30 08:55:55 ----D---- C:\Windows\Prefetch
2013-05-30 08:55:46 ----RD---- C:\Program Files
2013-05-30 08:55:42 ----D---- C:\Windows\Temp
2013-05-30 08:55:23 ----D---- C:\Windows\SoftwareDistribution
2013-05-30 02:53:37 ----D---- C:\Windows\Microsoft.NET
2013-05-30 02:53:23 ----RSD---- C:\Windows\assembly
2013-05-30 01:36:39 ----D---- C:\Windows\inf
2013-05-29 23:12:55 ----AD---- C:\Windows\System32
2013-05-29 23:12:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-29 23:10:42 ----A---- C:\Windows\SYSWOW64\log.txt
2013-05-29 23:08:52 ----D---- C:\ProgramData\VeriFace
2013-05-29 23:07:03 ----D---- C:\Windows\system32\config
2013-05-29 23:06:31 ----D---- C:\Windows\system32\wdi
2013-05-29 22:46:47 ----SHD---- C:\System Volume Information
2013-05-29 22:46:04 ----D---- C:\Windows\system32\DriverStore
2013-05-29 22:44:56 ----HD---- C:\ProgramData
2013-05-29 22:42:58 ----D---- C:\Windows\Tasks
2013-05-29 22:42:58 ----D---- C:\Windows\system32\drivers
2013-05-29 22:32:01 ----D---- C:\Windows\SysWOW64
2013-05-29 22:31:22 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-05-29 22:29:29 ----D---- C:\Program Files (x86)\Internet Explorer
2013-05-29 22:29:22 ----D---- C:\Windows\SYSWOW64\migration
2013-05-29 22:29:20 ----D---- C:\Windows\SYSWOW64\sk-SK
2013-05-29 22:29:20 ----D---- C:\Windows\SYSWOW64\en-US
2013-05-29 22:27:39 ----D---- C:\Windows\AppPatch
2013-05-29 22:22:13 ----D---- C:\Windows\system32\wbem
2013-05-29 22:22:11 ----D---- C:\Program Files\Common Files\System
2013-05-29 22:22:01 ----D---- C:\Windows\system32\cs-CZ
2013-05-29 22:21:55 ----D---- C:\Windows\system32\drivers\cs-CZ
2013-05-29 22:21:36 ----D---- C:\Windows\system32\en-US
2013-05-29 22:21:25 ----D---- C:\Program Files\Windows Journal
2013-05-29 22:16:23 ----D---- C:\Program Files\Internet Explorer
2013-05-29 22:16:06 ----D---- C:\Windows\system32\migration
2013-05-29 22:14:45 ----RSD---- C:\Windows\Fonts
2013-05-29 22:11:15 ----D---- C:\Windows\system32\LogFiles
2013-05-29 21:51:05 ----AD---- C:\Windows
2013-05-27 20:17:42 ----SD---- C:\Users\Lukáš\AppData\Roaming\Microsoft
2013-05-27 20:12:58 ----D---- C:\Windows\Logs
2013-05-27 19:12:22 ----SD---- C:\ProgramData\Microsoft
2013-05-27 19:04:12 ----D---- C:\Windows\system32\catroot2
2013-05-16 00:21:45 ----D---- C:\Windows\winsxs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fbfmon;fbfmon; C:\Windows\system32\drivers\fbfmon.sys [2012-05-30 57952]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2011-11-30 568600]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-02-27 16152]
R0 LHDmgr;LHDmgr; C:\Windows\System32\DRIVERS\LhdX64.sys [2012-05-30 39008]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2012-02-23 30016]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 BPntDrv;BPntDrv; C:\Windows\system32\drivers\BPntDrv.sys [2012-05-30 13408]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver; C:\Windows\system32\DRIVERS\AcpiVpc.sys [2012-05-30 30816]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-08-04 2768384]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2012-02-10 29344]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\Windows\system32\DRIVERS\clwvd.sys [2011-01-29 31088]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-01-31 1601152]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2012-01-16 208168]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-02-17 14692896]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-02-27 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-02-27 788760]
R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-11-15 111216]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S1 snotushp;snotushp; \??\C:\Windows\system32\drivers\snotushp.sys []
S2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2012-02-10 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2012-02-10 259744]
S3 btath_avdt;Atheros Bluetooth AVDT Service; C:\Windows\system32\drivers\btath_avdt.sys [2012-02-10 109216]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2012-02-10 166048]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2012-02-10 59040]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2012-02-10 283296]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2012-02-10 290464]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthMtpEnum;Modul pro výčet zařízení Bluetooth MTP; C:\Windows\system32\DRIVERS\BthMtpEnum.sys []
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-10-10 80384]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys []
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUVStor.sys [2011-11-15 313960]
S3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2012-02-10 106144]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DamageGuardSvc;Lenovo Instant Reset Service; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [2012-02-13 572976]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-02-03 628448]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-02-28 161560]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-02-28 277784]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-02-23 889664]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-23 2458944]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-02-28 363800]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
S2 BBSvc;BingBar Service; C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-19 138576]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-30 136176]
S2 HWDeviceService64.exe;HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe -/service []
S2 Mobile Partner. RunOuc;Mobile Partner. OUC; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe []
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe []
S2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe []
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe []
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe []
S3 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe []
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-03-02 276248]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-30 136176]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-05-30 182768]
S3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe []
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE []
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE []
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-09-09 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------

#9 Příspěvek od **vyosek** » 30 kvě 2013 09:02

Zkousel jste ty soubory (fotky...) vyhledat?

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

sorcer · #10 Příspěvek od **sorcer** » 30 kvě 2013 23:39

RKILL

Rkill 2.5.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 05/31/2013 12:23:27 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Centrum zabezpečení (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 05/31/2013 12:25:44 AM
Execution time: 0 hours(s), 2 minute(s), and 17 seconds(s)

COMBOFIX

ComboFix 13-05-30.02 - Lukáš 31.05.2013 0:28.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8092.6632 [GMT 2:00]
Spuštěný z: c:\users\LukßÜ\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-28 do 2013-05-30 )))))))))))))))))))))))))))))))
.
.
2013-05-30 22:32 . 2013-05-30 22:32 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-30 22:32 . 2013-05-30 22:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-30 22:01 . 2013-05-30 22:04 -------- d-----w- c:\windows\system32\catroot2
2013-05-30 21:36 . 2012-08-23 15:09 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2013-05-30 21:36 . 2012-08-23 13:41 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-05-30 21:36 . 2012-08-23 13:40 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-05-30 21:36 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2013-05-30 21:31 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-05-30 21:31 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys
2013-05-30 21:31 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll
2013-05-30 21:31 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll
2013-05-30 21:31 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-05-30 21:31 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2013-05-30 21:31 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2013-05-30 21:31 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2013-05-30 21:31 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2013-05-30 20:19 . 2013-05-30 20:19 -------- d-----w- c:\windows\CheckSur
2013-05-30 20:14 . 2013-05-13 23:48 9460464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E3DA2168-7412-41C3-8020-CD917381F653}\mpengine.dll
2013-05-30 19:54 . 2013-05-30 19:54 -------- d-----w- c:\program files\Microsoft Silverlight
2013-05-30 19:54 . 2013-05-30 19:54 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-05-30 17:07 . 1998-06-17 22:00 89360 ----a-w- c:\windows\SysWow64\VB5DB.DLL
2013-05-30 14:39 . 2013-05-30 17:49 -------- d-----w- c:\users\Lukáš\AppData\Local\Google
2013-05-30 06:55 . 2013-05-30 06:55 -------- d-----w- C:\rsit
2013-05-30 06:55 . 2013-05-30 06:55 -------- d-----w- c:\program files\trend micro
2013-05-29 20:55 . 2013-05-29 20:55 -------- d-----w- c:\users\Lukáš\AppData\Local\LSC
2013-05-29 20:55 . 2013-05-30 21:09 -------- d-----w- c:\users\Lukáš\AppData\Local\Adobe
2013-05-29 20:54 . 2013-05-30 21:09 -------- d-----w- c:\users\Lukáš\AppData\Roaming\Adobe
2013-05-29 19:51 . 2013-05-29 19:51 -------- d-----w- C:\FRST
2013-05-27 17:37 . 2013-05-30 22:18 -------- d-----w- c:\users\Lukáš\AppData\Local\ElevatedDiagnostics
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-30 17:21 . 1601-01-01 00:14 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-03 14:15 . 1601-01-01 00:14 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-02 00:06 . 1601-01-01 00:14 278800 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2012-05-30 14:14 433648 ----a-w- c:\programdata\Partner\Partner.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 snotushp;snotushp;c:\windows\system32\drivers\snotushp.sys [x]
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
R2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\program files (x86)\Mobile Partner\UpdateDog\ouc.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2012-02-09 36000]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2012-02-09 259744]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2012-02-09 109216]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2012-02-09 166048]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2012-02-09 59040]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2012-02-09 283296]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2012-02-09 290464]
R3 BthMtpEnum;Modul pro výčet zařízení Bluetooth MTP;c:\windows\system32\DRIVERS\BthMtpEnum.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 NisSrv;NisSrv;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2011-11-15 313960]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-09-09 1255736]
R4 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2012-02-09 106144]
R4 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R4 DamageGuardSvc;Lenovo Instant Reset Service;c:\program files\Lenovo\Instant Reset\DamageGuardSvc.exe [2012-02-13 572976]
R4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]
R4 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-03 628448]
R4 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-02-28 161560]
R4 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-02-28 363800]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
R4 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-02-09 158880]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-02-27 16152]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2012-05-30 39008]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2012-02-23 30016]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2012-05-30 30816]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2012-02-09 29344]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-01-29 31088]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2012-01-15 208168]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-02-27 356120]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-02-27 788760]
S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-11-15 111216]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-30 14:54 1165776 ----a-w- c:\program files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-30 14:13]
.
2013-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-30 14:13]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2012-05-30 14:14 750064 ----a-w- c:\programdata\Partner\Partner64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1 62.240.184.2
TCP: Interfaces\{8E0934FA-64E2-4897-820A-FD41AC6D8D63}: NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{98B20819-9A18-447A-9DC7-3F257430965C}: NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{B0D87FD9-0EAB-4652-A13F-A909E3257766}: NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{F5DCECC6-F037-4470-B942-4B5548435A71}: NameServer = 194.24.128.100 81.3.216.100
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-05-31 00:34:21
ComboFix-quarantined-files.txt 2013-05-30 22:34
.
Před spuštěním: Volných bajtů: 448 269 021 184
Po spuštění: Volných bajtů: 448 180 944 896
.
- - End Of File - - AE9E0CCD1DFFB77FF630BB1FCCF66FEE

#11 Příspěvek od **vyosek** » 31 kvě 2013 08:24

Kam mi ty logy premistujete\odmazavate?? Ja je tady chci videt

sorcer · #12 Příspěvek od **sorcer** » 31 kvě 2013 13:45

Opět doplněno.

#13 Příspěvek od **vyosek** » 01 čer 2013 20:17

Poprosim o DDS http://forum.viry.cz/viewtopic.php?f=13&t=125171

sorcer · #14 Příspěvek od **sorcer** » 01 čer 2013 22:22

DDS

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421
Run by Lukáš at 23:21:21 on 2013-06-01
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8092.6090 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Users\Lukáš\Desktop\dds.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
mStart Page = hxxp://lenovo.msn.com
BHO: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
TCP: NameServer = 192.168.1.1 62.240.184.2
TCP: Interfaces\{11350D0B-77FF-45CF-8BF7-50139BC415CB} : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{8E0934FA-64E2-4897-820A-FD41AC6D8D63} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{98B20819-9A18-447A-9DC7-3F257430965C} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{B0D87FD9-0EAB-4652-A13F-A909E3257766} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F} : DHCPNameServer = 192.168.1.1 62.240.184.2
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\44F6D616 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\874746F50323 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\94E6475627E65647 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\D497370757C696E6 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{F5DCECC6-F037-4470-B942-4B5548435A71} : NameServer = 194.24.128.100 81.3.216.100
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = hxxp://lenovo.msn.com
x64-BHO: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-3-15 16152]
R0 LHDmgr;LHDmgr;C:\Windows\System32\drivers\LhdX64.sys [2012-5-30 39008]
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2012-5-30 30016]
R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2013-5-31 28600]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 AntiVirService;Avira Real-Time Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2013-5-31 110816]
R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2013-5-31 86752]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2013-5-31 100712]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\Windows\System32\drivers\AcpiVpc.sys [2011-12-15 30816]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\System32\drivers\btath_bus.sys [2012-2-10 29344]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2011-1-29 31088]
R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2012-1-31 208168]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-3-5 331264]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-3-15 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-3-15 788760]
R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2012-2-8 111216]
S2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-2-10 106144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-19 138576]
S2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe -/service --> C:\ProgramData\DatacardService\HWDeviceService64.exe -/service [?]
S2 Mobile Partner. RunOuc;Mobile Partner. OUC;C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe --> C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [?]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-5-30 363800]
S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\System32\drivers\btath_flt.sys [2012-2-10 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\System32\drivers\btath_a2dp.sys [2012-2-10 259744]
S3 btath_avdt;Atheros Bluetooth AVDT Service;C:\Windows\System32\drivers\btath_avdt.sys [2012-2-10 109216]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\drivers\btath_hcrp.sys [2012-2-10 166048]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\System32\drivers\btath_lwflt.sys [2012-2-10 59040]
S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\drivers\btath_rcp.sys [2012-2-10 283296]
S3 BtFilter;BtFilter;C:\Windows\System32\drivers\btfilter.sys [2012-2-10 290464]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-5-30 19456]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\rtsuvstor.sys [2012-5-30 313960]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-5-30 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-5-30 30208]
S3 WatAdminSvc;Služba Technologie aktivace Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-9-9 1255736]
S4 CxAudMsg;Conexant Audio Message Service;C:\Windows\System32\CxAudMsg64.exe [2012-5-30 198784]
S4 DamageGuardSvc;Lenovo Instant Reset Service;C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [2012-5-30 572976]
S4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-5-30 13592]
S4 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-2-3 628448]
S4 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-5-30 161560]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184]
S4 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-2-10 158880]
SUnknown NisSrv;NisSrv; [x]
SUnknown Skype C2C Service;Skype C2C Service; [x]
SUnknown SkypeUpdate;SkypeUpdate; [x]
.
=============== Created Last 30 ================
.
2013-06-01 21:21:22 -------- d-----w- C:\Users\LukßÜ\AppData\Local\Microsoft
2013-06-01 17:59:20 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-01 17:59:20 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-05-31 21:19:54 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Opera
2013-05-31 21:11:50 -------- d-----w- C:\Program Files\CCleaner
2013-05-31 21:10:08 -------- d-----w- C:\Program Files (x86)\The KMPlayer
2013-05-31 12:57:16 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\SUPERAntiSpyware.com
2013-05-31 12:56:56 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2013-05-31 12:56:56 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2013-05-31 05:18:26 83160 ----a-w- C:\Windows\System32\drivers\avnetflt.sys
2013-05-30 23:15:00 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Avira
2013-05-30 23:12:35 28600 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2013-05-30 23:12:35 100712 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2013-05-30 23:12:34 -------- d-----w- C:\ProgramData\Avira
2013-05-30 23:12:34 -------- d-----w- C:\Program Files (x86)\Avira
2013-05-30 22:54:12 -------- d-----w- C:\Program Files (x86)\Microsoft
2013-05-30 22:49:07 -------- d--h--w- C:\Windows\msdownld.tmp
2013-05-30 22:49:00 -------- d-----w- C:\Windows\SysWow64\directx
2013-05-30 22:45:43 -------- d-sh--w- C:\$RECYCLE.BIN
2013-05-30 22:27:15 98816 ----a-w- C:\Windows\sed.exe
2013-05-30 22:27:15 256000 ----a-w- C:\Windows\PEV.exe
2013-05-30 22:27:15 208896 ----a-w- C:\Windows\MBR.exe
2013-05-30 22:01:17 -------- d-----w- C:\Windows\System32\catroot2
2013-05-30 21:36:00 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2013-05-30 21:36:00 15360 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll
2013-05-30 21:36:00 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2013-05-30 21:36:00 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
2013-05-30 21:31:52 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2013-05-30 21:31:52 458712 ----a-w- C:\Windows\System32\drivers\cng.sys
2013-05-30 21:31:52 340992 ----a-w- C:\Windows\System32\schannel.dll
2013-05-30 21:31:52 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
2013-05-30 21:31:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2013-05-30 21:31:52 154480 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2013-05-30 21:31:52 1448448 ----a-w- C:\Windows\System32\lsasrv.dll
2013-05-30 21:31:49 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2013-05-30 21:31:49 366592 ----a-w- C:\Windows\System32\qdvd.dll
2013-05-30 20:19:00 -------- d-----w- C:\Windows\CheckSur
2013-05-30 20:14:33 8199504 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-05-30 20:14:29 9460464 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E3DA2168-7412-41C3-8020-CD917381F653}\mpengine.dll
2013-05-30 17:07:06 89360 ----a-w- C:\Windows\SysWow64\VB5DB.DLL
2013-05-30 06:55:46 -------- d-----w- C:\Program Files\trend micro
2013-05-29 20:54:50 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Adobe
2013-05-29 19:51:04 -------- d-----w- C:\FRST
.
==================== Find3M ====================
.
2013-05-02 00:06:08 278800 ------w- C:\Windows\System32\MpSigStub.exe
.
============= FINISH: 23:21:39,18 ===============
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421
Run by Lukáš at 23:21:21 on 2013-06-01
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8092.6090 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Users\Lukáš\Desktop\dds.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
mStart Page = hxxp://lenovo.msn.com
BHO: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
TCP: NameServer = 192.168.1.1 62.240.184.2
TCP: Interfaces\{11350D0B-77FF-45CF-8BF7-50139BC415CB} : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{8E0934FA-64E2-4897-820A-FD41AC6D8D63} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{98B20819-9A18-447A-9DC7-3F257430965C} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{B0D87FD9-0EAB-4652-A13F-A909E3257766} : NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F} : DHCPNameServer = 192.168.1.1 62.240.184.2
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\44F6D616 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\874746F50323 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\94E6475627E65647 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{B71CD65E-CF62-4D3B-BEC2-FCE592FE244F}\D497370757C696E6 : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{F5DCECC6-F037-4470-B942-4B5548435A71} : NameServer = 194.24.128.100 81.3.216.100
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = hxxp://lenovo.msn.com
x64-BHO: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-3-15 16152]
R0 LHDmgr;LHDmgr;C:\Windows\System32\drivers\LhdX64.sys [2012-5-30 39008]
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2012-5-30 30016]
R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2013-5-31 28600]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 AntiVirService;Avira Real-Time Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2013-5-31 110816]
R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2013-5-31 86752]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2013-5-31 100712]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\Windows\System32\drivers\AcpiVpc.sys [2011-12-15 30816]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\System32\drivers\btath_bus.sys [2012-2-10 29344]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2011-1-29 31088]
R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2012-1-31 208168]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-3-5 331264]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-3-15 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-3-15 788760]
R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2012-2-8 111216]
S2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-2-10 106144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-19 138576]
S2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe -/service --> C:\ProgramData\DatacardService\HWDeviceService64.exe -/service [?]
S2 Mobile Partner. RunOuc;Mobile Partner. OUC;C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe --> C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [?]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-5-30 363800]
S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\System32\drivers\btath_flt.sys [2012-2-10 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\System32\drivers\btath_a2dp.sys [2012-2-10 259744]
S3 btath_avdt;Atheros Bluetooth AVDT Service;C:\Windows\System32\drivers\btath_avdt.sys [2012-2-10 109216]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\drivers\btath_hcrp.sys [2012-2-10 166048]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\System32\drivers\btath_lwflt.sys [2012-2-10 59040]
S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\drivers\btath_rcp.sys [2012-2-10 283296]
S3 BtFilter;BtFilter;C:\Windows\System32\drivers\btfilter.sys [2012-2-10 290464]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-5-30 19456]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\rtsuvstor.sys [2012-5-30 313960]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-5-30 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-5-30 30208]
S3 WatAdminSvc;Služba Technologie aktivace Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-9-9 1255736]
S4 CxAudMsg;Conexant Audio Message Service;C:\Windows\System32\CxAudMsg64.exe [2012-5-30 198784]
S4 DamageGuardSvc;Lenovo Instant Reset Service;C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [2012-5-30 572976]
S4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-5-30 13592]
S4 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-2-3 628448]
S4 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-5-30 161560]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184]
S4 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-2-10 158880]
SUnknown NisSrv;NisSrv; [x]
SUnknown Skype C2C Service;Skype C2C Service; [x]
SUnknown SkypeUpdate;SkypeUpdate; [x]
.
=============== Created Last 30 ================
.
2013-06-01 21:21:22 -------- d-----w- C:\Users\LukßÜ\AppData\Local\Microsoft
2013-06-01 17:59:20 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-01 17:59:20 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-05-31 21:19:54 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Opera
2013-05-31 21:11:50 -------- d-----w- C:\Program Files\CCleaner
2013-05-31 21:10:08 -------- d-----w- C:\Program Files (x86)\The KMPlayer
2013-05-31 12:57:16 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\SUPERAntiSpyware.com
2013-05-31 12:56:56 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2013-05-31 12:56:56 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2013-05-31 05:18:26 83160 ----a-w- C:\Windows\System32\drivers\avnetflt.sys
2013-05-30 23:15:00 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Avira
2013-05-30 23:12:35 28600 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2013-05-30 23:12:35 100712 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2013-05-30 23:12:34 -------- d-----w- C:\ProgramData\Avira
2013-05-30 23:12:34 -------- d-----w- C:\Program Files (x86)\Avira
2013-05-30 22:54:12 -------- d-----w- C:\Program Files (x86)\Microsoft
2013-05-30 22:49:07 -------- d--h--w- C:\Windows\msdownld.tmp
2013-05-30 22:49:00 -------- d-----w- C:\Windows\SysWow64\directx
2013-05-30 22:45:43 -------- d-sh--w- C:\$RECYCLE.BIN
2013-05-30 22:27:15 98816 ----a-w- C:\Windows\sed.exe
2013-05-30 22:27:15 256000 ----a-w- C:\Windows\PEV.exe
2013-05-30 22:27:15 208896 ----a-w- C:\Windows\MBR.exe
2013-05-30 22:01:17 -------- d-----w- C:\Windows\System32\catroot2
2013-05-30 21:36:00 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2013-05-30 21:36:00 15360 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll
2013-05-30 21:36:00 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2013-05-30 21:36:00 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
2013-05-30 21:31:52 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2013-05-30 21:31:52 458712 ----a-w- C:\Windows\System32\drivers\cng.sys
2013-05-30 21:31:52 340992 ----a-w- C:\Windows\System32\schannel.dll
2013-05-30 21:31:52 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
2013-05-30 21:31:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2013-05-30 21:31:52 154480 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2013-05-30 21:31:52 1448448 ----a-w- C:\Windows\System32\lsasrv.dll
2013-05-30 21:31:49 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2013-05-30 21:31:49 366592 ----a-w- C:\Windows\System32\qdvd.dll
2013-05-30 20:19:00 -------- d-----w- C:\Windows\CheckSur
2013-05-30 20:14:33 8199504 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-05-30 20:14:29 9460464 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E3DA2168-7412-41C3-8020-CD917381F653}\mpengine.dll
2013-05-30 17:07:06 89360 ----a-w- C:\Windows\SysWow64\VB5DB.DLL
2013-05-30 06:55:46 -------- d-----w- C:\Program Files\trend micro
2013-05-29 20:54:50 -------- d-----w- C:\Users\Lukáš\AppData\Roaming\Adobe
2013-05-29 19:51:04 -------- d-----w- C:\FRST
.
==================== Find3M ====================
.
2013-05-02 00:06:08 278800 ------w- C:\Windows\System32\MpSigStub.exe
.
============= FINISH: 23:21:39,18 ===============

#15 Příspěvek od **vyosek** » 04 čer 2013 08:01

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

DDS::
uStart Page = hxxp://www.google.com/ig/redirectdomain ... &bmod=LENN

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

VIRY.CZ

Vir Police Čr

Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr

Re: Vir Police Čr