vir policie

Zpráva

moody55 · #1 Příspěvek od **moody55** » 26 srp 2013 14:45

dobrý den ,

jak odstranit na pc s napadeným virem "policie čr" , když nejde spustit v nouzáku a neustále se restartuje ?

děkuji za pomoc

#2 Příspěvek od **vyosek** » 26 srp 2013 14:55

Zdravim

Zkuste tento postup http://forum.viry.cz/viewtopic.php?f=13&t=130781

moody55 · #3 Příspěvek od **moody55** » 26 srp 2013 15:14

zkoušel jsem příkazový řádek, ale dle návodu "Dojde ke spuštění Nouzového režimu (černá plocha s příkazovým řádkem)."
se mi to nespustí a restartuje se ....

moody55 · #4 Příspěvek od **moody55** » 26 srp 2013 15:26

nějak jsem to provedl ...tady je log :

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-08-2013
Ran by SYSTEM on 26-08-2013 16:21:51
Running from D:\
Windows 7 Home Premium (X86) OS Language:
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.
==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKU\A\...\Run: [BlazeServoTool] - C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [ 2009-07-07] (BlazeVideo Company)
HKU\A\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10u_ActiveX.exe [ 2011-08-16] (Adobe Systems, Inc.)
HKU\A\...\Winlogon: [Shell] cmd.exe [ 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\A\...\Command Processor: "C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe" <===== ATTENTION!
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()

========================== Services (Whitelisted) =================

S2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [63928 2012-01-03] (Adobe Systems Incorporated)
S3 BBSvc; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [191752 2011-06-07] (Microsoft Corporation.)
S2 BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [249648 2011-05-12] (Microsoft Corporation)
S2 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
S2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-16] (Conexant Systems Inc.)
S2 DsiWMIService; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [353360 2011-07-01] (Dritek System Inc.)
S3 EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [173424 2011-06-21] (Egis Technology Inc. )
S2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [872552 2011-08-02] (Acer Incorporated)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [655624 2011-09-22] (Acresso Software Inc.)
S3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-21] (Microsoft Corporation)
S3 GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [206072 2010-10-12] (WildTangent, Inc.)
S2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [36456 2011-05-30] (Acer Incorporated)
S3 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [856400 2010-11-21] (Microsoft Corporation)
S2 Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-09] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [501768 2011-03-17] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-10-18] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-10-18] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [161168 2011-10-18] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [116560 2009-06-10] (Microsoft Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
S3 odserv; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 SkypeUpdate; C:\Program Files (x86)\Skype\Updater\Updater.exe [160944 2012-07-13] (Skype Technologies)

==================== Drivers (Whitelisted) ====================

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [507392 2011-12-22] (ITETech )
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [114704 2011-03-30] (Advanced Micro Devices)
S3 b06bdrv; C:\Windows\system32\drivers\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl664.sys [4729408 2011-06-08] (Broadcom Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)
S0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-14] (Microsoft Corporation)
S3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRT64.sys [1495680 2011-01-11] (Conexant Systems Inc.)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [142632 2011-04-05] (ELAN Microelectronics Corp.)
S3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] (Microsoft Corporation)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [76912 2010-09-27] (Atheros Communications, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)
S1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [22648 2011-08-16] (Egis Technology Inc.)
S1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [20520 2011-08-16] (Egis Technology Inc.)
S1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [62776 2011-08-16] (Egis Technology Inc.)
S3 NTIDrvr; C:\Windows\system32\drivers\NTIDrvr.sys [18432 2011-03-10] (NTI Corporation)
S3 UBHelper; C:\Windows\system32\drivers\UBHelper.sys [17408 2011-03-10] (NTI Corporation)
S3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-08-26 16:21 - 2013-08-26 16:21 - 00000000 ____D C:\FRST
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
2013-08-19 17:57 - 2013-07-26 05:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-19 17:57 - 2013-07-26 05:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-19 17:57 - 2013-07-26 03:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-19 17:57 - 2013-07-26 03:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-19 17:57 - 2013-07-26 03:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-19 17:57 - 2013-07-26 02:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-19 17:57 - 2013-07-26 02:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-19 17:57 - 2013-07-26 01:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-19 17:56 - 2013-07-26 05:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-19 17:56 - 2013-07-26 05:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-19 17:56 - 2013-07-26 03:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-19 17:56 - 2013-07-26 03:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-19 17:56 - 2013-07-26 03:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 18:41 - 2013-07-09 05:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-16 18:41 - 2013-07-09 04:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 18:40 - 2013-07-19 01:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-16 18:40 - 2013-07-19 01:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 18:39 - 2013-07-25 09:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-16 18:39 - 2013-07-25 08:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 18:39 - 2013-07-09 05:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-16 18:39 - 2013-07-09 04:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 18:39 - 2013-07-06 06:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-16 18:39 - 2013-06-15 04:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-08-26 16:21 - 2013-08-26 16:21 - 00000000 ____D C:\FRST
2013-08-26 14:15 - 2009-07-14 04:51 - 00093993 _____ C:\Windows\setupact.log
2013-08-26 13:54 - 2009-07-14 05:13 - 01445734 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-26 13:49 - 2011-09-22 15:43 - 01583673 _____ C:\Windows\WindowsUpdate.log
2013-08-26 13:42 - 2009-07-14 04:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-26 13:42 - 2009-07-14 04:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
2013-08-24 10:28 - 2011-08-16 08:06 - 00001832 _____ C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
2013-08-19 18:54 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-19 18:17 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\SysWOW64

Files to move or delete:
====================
C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\ApnStub.exe
C:\Users\A\AppData\Local\Temp\DevSetup32.dll
C:\Users\A\AppData\Local\Temp\DevSetup64.dll
C:\Users\A\AppData\Local\Temp\DriverInstall32.exe
C:\Users\A\AppData\Local\Temp\DriverInstall64.exe
C:\Users\A\AppData\Local\Temp\ose00000.exe
C:\Users\A\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\~convert3355677032899799826.exe
C:\Users\A\AppData\Local\Temp\~convert3489013962979702606.exe
C:\Users\A\AppData\Local\Temp\~convert5102852234649812584.exe
C:\Users\A\AppData\Local\Temp\~convert5820696981388311661.exe
C:\Users\A\AppData\Local\Temp\~convert6394538878999565410.exe
C:\Users\A\AppData\Local\Temp\~convert7438168547712612209.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AF15BDAEX.dll
C:\Users\Aa\AppData\Local\Temp\drivers\AF9015\Win32\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\IA64\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AMD64\DPInst.exe
C:\Users\A\AppData\Local\Temp\clear.fiClient\cabarc.exe

==================== Known DLLs (Whitelisted) ============

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-14 05:30] - [2011-07-14 05:30] - 2871808 ____A (Microsoft Corporation)

C:\Windows\System32\winlogon.exe
[2010-11-21 03:24] - [2010-11-21 03:24] - 0390656 ____A (Microsoft Corporation)

C:\Windows\System32\wininit.exe
[2009-07-13 23:52] - [2009-07-14 01:39] - 0129024 ____A (Microsoft Corporation)

C:\Windows\System32\svchost.exe
[2009-07-13 23:31] - [2009-07-14 01:39] - 0027136 ____A (Microsoft Corporation)

C:\Windows\System32\services.exe
[2009-07-13 23:19] - [2009-07-14 01:39] - 0328704 ____A (Microsoft Corporation)

C:\Windows\System32\User32.dll
[2010-11-21 03:24] - [2010-11-21 03:24] - 1008128 ____A (Microsoft Corporation)

C:\Windows\System32\userinit.exe
[2010-11-21 03:24] - [2010-11-21 03:24] - 0030720 ____A (Microsoft Corporation)

C:\Windows\System32\Drivers\volsnap.sys
[2010-11-21 03:23] - [2010-11-21 03:23] - 0295808 ____A (Microsoft Corporation)

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-26 10:11:54
Restore point made on: 2013-01-11 13:01:15
Restore point made on: 2013-02-15 12:41:06
Restore point made on: 2013-03-15 14:51:48
Restore point made on: 2013-04-04 09:31:37
Restore point made on: 2013-04-10 10:16:50
Restore point made on: 2013-04-29 10:32:29
Restore point made on: 2013-05-16 11:13:26
Restore point made on: 2013-05-17 11:44:27
Restore point made on: 2013-06-02 07:01:13
Restore point made on: 2013-06-15 18:05:10
Restore point made on: 2013-06-16 05:24:37
Restore point made on: 2013-07-21 06:58:39
Restore point made on: 2013-08-19 17:50:51

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 3322.84 MB
Available physical RAM: 2958.63 MB
Total Pagefile: 3093.47 MB
Available Pagefile: 2095.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 2000.05 MB

==================== Drives ================================

Drive b: (RamDrive) (Fixed) (Total:0.91 GB) (Free:0.9 GB) NTFS
Drive c: (Acer) (Fixed) (Total:450.66 GB) (Free:397.76 GB) NTFS
Drive d: (K3) (Removable) (Total:3.92 GB) (Free:3.88 GB) FAT32
Drive g: (HBCD 15.0) (CDROM) (Total:0.52 GB) (Free:0 GB) CDFS
Drive x: (Mini Xp) (Fixed) (Total:0.23 GB) (Free:0.23 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 23D6C8B0)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 70F34DAA)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)

LastRegBack: 2013-01-14 14:42

==================== End Of Log ============================

#5 Příspěvek od **vyosek** » 26 srp 2013 21:33

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Start
HKU\A\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10u_ActiveX.exe [ 2011-08-16] (Adobe Systems, Inc.)
HKU\A\...\Winlogon: [Shell] cmd.exe [ 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\A\...\Command Processor: "C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe" <===== ATTENTION!
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\ApnStub.exe
C:\Users\A\AppData\Local\Temp\DevSetup32.dll
C:\Users\A\AppData\Local\Temp\DevSetup64.dll
C:\Users\A\AppData\Local\Temp\DriverInstall32.exe
C:\Users\A\AppData\Local\Temp\DriverInstall64.exe
C:\Users\A\AppData\Local\Temp\ose00000.exe
C:\Users\A\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\~convert3355677032899799826.exe
C:\Users\A\AppData\Local\Temp\~convert3489013962979702606.exe
C:\Users\A\AppData\Local\Temp\~convert5102852234649812584.exe
C:\Users\A\AppData\Local\Temp\~convert5820696981388311661.exe
C:\Users\A\AppData\Local\Temp\~convert6394538878999565410.exe
C:\Users\A\AppData\Local\Temp\~convert7438168547712612209.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AF15BDAEX.dll
C:\Users\Aa\AppData\Local\Temp\drivers\AF9015\Win32\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\IA64\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AMD64\DPInst.exe
C:\Users\A\AppData\Local\Temp\clear.fiClient\cabarc.exe
Hosts:
End

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny log na flashku k FRST

Spustte znovu FRST.exe na tom poskozenem PC

Kliknete na Fix
Probehne oprava a na flash disku se vytvori log Fixlog.txt

Pokuste se nastartovat do bezneho rezimu

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784

moody55 · #6 Příspěvek od **moody55** » 27 srp 2013 13:02

Povedlo se , vkládám LOG...
-------------------------------------------

Logfile of random's system information tool 1.09 (written by random/random)
Run by Adélka at 2013-08-27 13:45:47
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 407 GB (88%) free of 461 GB
Total RAM: 3819 MB (65% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 26146416
\??\C:\Windows\system32\conhost.exe "-113741786127969670-1902278196-27168916138194959141698991610659418161665304685
"C:\Windows\system32\Dwm.exe"
cmd.exe
\??\C:\Windows\system32\conhost.exe "20276041432011791246341163249-1387016411-1496144387-1693994082-768930640-1102357477
C:\Windows\System32\spoolsv.exe
taskeng.exe {6D38637F-63BD-464F-A968-3D1C79AFFF58}
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe"
"C:\Program Files (x86)\Launch Manager\LMworker.exe"
"C:\Program Files (x86)\Launch Manager\LMutilps32.exe" --system-level-mutex="Local\{B904A927-FE6B-48fd-8C83-6B807BED1F9C}" --enable-wmi-window
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Acer\Registration\GREGsvc.exe"
"C:\Program Files\Acer\Acer Updater\UpdaterService.exe"
"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc
"C:\Windows\system32\mfevtps.exe"
"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE
"C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe"
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\x64\saHook.dll", saHooker_Initialize_and_Wait
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe"
"C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe"
taskeng.exe {4869A3B5-6F95-4E78-B78E-23EAB4BE4307}
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe"
C:\Windows\servicing\TrustedInstaller.exe
taskeng.exe {DC06C19A-3AD8-4E56-8668-664F80988D0C}
"C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"
explorer
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
"C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe"
"C:\Program Files\mcafee.com\agent\mcagent.exe" /runkey
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
"C:\Program Files (x86)\Launch Manager\LManager.exe"
"C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
"C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe -Embedding
taskhost.exe $(Arg0)
"C:\Program Files\Common Files\McAfee\Core\mchost.exe" {a5bf70ba-d688-4f57-b4c5-2ab50d11fdce} /pid=4800
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-6bb0dd3f-0f8d-496f-8b46-89e2310089c9 -SystemEventPortName:HostProcess-2cfccf28-3a6f-49d3-b758-539fb51fe068 -IoCancelEventPortName:HostProcess-da8cd2d3-d3f4-4e57-b129-ee67fc3b1aca -NonStateChangingEventPortName:HostProcess-1ad0956c-3ee7-45cd-a758-3560a40e1e04 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:128383d0-acd0-4697-881e-6e545dc7d83f
wmiadap.exe /R /T
"E:\RSITx64.exe"
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" /uilaunched
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120212100049.dll [2011-12-06 94688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2013-05-22 298312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-03-18 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120212100049.dll [2011-12-06 79744]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2013-05-22 249872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07 1152264]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-03-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2013-05-22 298312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2013-05-22 249872]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07 1152264]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2011-04-05 2589992]
"Power Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-08-02 1831016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BlazeServoTool"=C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2011-11-22 1675160]
"SuiteTray"=C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2011-06-22 341360]
"Norton Online Backup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-06-02 1155928]
"BackupManagerTray"=C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [2011-04-24 297280]
"LManager"=C:\Program Files (x86)\Launch Manager\LManager.exe [2011-07-01 1103440]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-25 336384]
"ArcadeMovieService"=C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [2011-05-10 177448]
"HP Software Update"=C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
""= []
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"ApnUpdater"=C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2012-01-03 1391272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfevtp]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-08-27 13:45:49 ----D---- C:\Program Files\trend micro
2013-08-27 13:45:47 ----D---- C:\rsit
2013-08-26 18:21:33 ----D---- C:\FRST
2013-08-26 10:33:59 ----A---- C:\Windows\ntbtlog.txt
2013-08-19 19:57:04 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-08-19 19:57:03 ----A---- C:\Windows\system32\ieui.dll
2013-08-19 19:57:01 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-08-19 19:57:01 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-08-19 19:57:01 ----A---- C:\Windows\system32\iesetup.dll
2013-08-19 19:57:01 ----A---- C:\Windows\system32\iernonce.dll
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-08-19 19:57:00 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-19 19:57:00 ----A---- C:\Windows\system32\iesysprep.dll
2013-08-19 19:57:00 ----A---- C:\Windows\system32\ie4uinit.exe
2013-08-19 19:56:58 ----A---- C:\Windows\system32\iertutil.dll
2013-08-19 19:56:56 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-08-19 19:56:56 ----A---- C:\Windows\system32\msfeeds.dll
2013-08-19 19:56:55 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-08-19 19:56:55 ----A---- C:\Windows\system32\jscript.dll
2013-08-19 19:56:53 ----A---- C:\Windows\system32\jscript9.dll
2013-08-19 19:56:51 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-08-19 19:56:50 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-08-19 19:56:49 ----A---- C:\Windows\system32\urlmon.dll
2013-08-19 19:56:47 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-08-19 19:56:47 ----A---- C:\Windows\system32\jsproxy.dll
2013-08-19 19:56:46 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-08-19 19:56:45 ----A---- C:\Windows\system32\wininet.dll
2013-08-19 19:56:43 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-08-19 19:56:40 ----A---- C:\Windows\system32\ieframe.dll
2013-08-19 19:56:38 ----A---- C:\Windows\system32\mshtml.dll
2013-08-19 19:56:32 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-08-16 20:41:39 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-08-16 20:41:39 ----A---- C:\Windows\system32\crypt32.dll
2013-08-16 20:41:38 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2013-08-16 20:41:38 ----A---- C:\Windows\system32\wintrust.dll
2013-08-16 20:41:37 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2013-08-16 20:41:36 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2013-08-16 20:41:36 ----A---- C:\Windows\system32\cryptsvc.dll
2013-08-16 20:41:36 ----A---- C:\Windows\system32\cryptnet.dll
2013-08-16 20:40:14 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-08-16 20:40:14 ----A---- C:\Windows\system32\tzres.dll
2013-08-16 20:39:24 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2013-08-16 20:39:24 ----A---- C:\Windows\system32\WMVDECOD.DLL
2013-08-16 20:39:21 ----A---- C:\Windows\system32\rpcrt4.dll
2013-08-16 20:39:20 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2013-08-16 20:39:16 ----A---- C:\Windows\system32\drivers\tssecsrv.sys
2013-08-16 20:39:12 ----A---- C:\Windows\system32\drivers\tcpip.sys

======List of files/folders modified in the last 1 month======

2013-08-27 15:25:26 ----D---- C:\Windows\system32\drivers\etc
2013-08-27 13:45:49 ----RD---- C:\Program Files
2013-08-27 13:45:30 ----D---- C:\Windows\Temp
2013-08-27 13:42:14 ----D---- C:\ProgramData\clear.fi
2013-08-27 13:40:26 ----D---- C:\Windows\System32
2013-08-27 13:40:26 ----D---- C:\Windows\inf
2013-08-27 13:40:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-08-27 13:15:55 ----D---- C:\Windows\system32\config
2013-08-27 12:31:56 ----RSD---- C:\Windows\assembly
2013-08-27 12:17:07 ----D---- C:\Windows\Microsoft.NET
2013-08-26 10:33:59 ----D---- C:\Windows
2013-08-24 12:47:19 ----HD---- C:\ProgramData
2013-08-19 20:20:16 ----D---- C:\Windows\winsxs
2013-08-19 20:17:20 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-08-19 20:17:20 ----D---- C:\Windows\SysWOW64
2013-08-19 20:17:19 ----D---- C:\Windows\system32\cs-CZ
2013-08-19 20:17:18 ----D---- C:\Program Files (x86)\Internet Explorer
2013-08-19 20:17:15 ----D---- C:\Program Files\Internet Explorer
2013-08-19 20:17:01 ----D---- C:\Windows\system32\drivers
2013-08-19 19:57:59 ----D---- C:\Windows\system32\catroot
2013-08-19 19:57:58 ----D---- C:\Windows\system32\catroot2
2013-08-19 19:55:56 ----SHD---- C:\Windows\Installer
2013-08-19 19:55:33 ----D---- C:\ProgramData\Microsoft Help
2013-08-19 19:51:13 ----SHD---- C:\System Volume Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2011-10-15 647080]
R0 mfewfpk;McAfee Inc. mfewfpk; C:\Windows\system32\drivers\mfewfpk.sys [2011-10-15 284648]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 mfenlfk;McAfee NDIS Light Filter; C:\Windows\system32\DRIVERS\mfenlfk.sys [2011-10-15 75808]
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2011-08-16 22648]
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2011-08-16 20520]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-08-16 62776]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 309760]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2011-06-08 4729408]
R3 cfwids;McAfee Inc. cfwids; C:\Windows\system32\drivers\cfwids.sys [2011-10-15 65264]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-01-11 1495680]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2011-04-05 142632]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-09-27 76912]
R3 mfeapfk;McAfee Inc. mfeapfk; C:\Windows\system32\drivers\mfeapfk.sys [2011-10-15 160280]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2011-10-15 229528]
R3 mfefirek;McAfee Inc. mfefirek; C:\Windows\system32\drivers\mfefirek.sys [2011-10-15 481768]
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-03-10 18432]
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-03-10 17408]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-15 47232]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2011-12-22 507392]
S3 mfeavfk01;McAfee Inc.; C:\Windows\system32\drivers\mfeavfk01.sys []
S3 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys [2011-10-15 100912]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-06-17 246376]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 204288]
R2 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-13 249648]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-07-01 353360]
R2 ePowerSvc;ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-08-02 872552]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]
R2 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McMPFSvc;McAfee Personal Firewall Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 mcmscsvc;McAfee Services; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McNASvc;McAfee Network Agent; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McProxy;McAfee Proxy Service; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McShield;McAfee McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [2011-10-18 199272]
R2 mfefire;McAfee Firewall Core Service; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe [2011-10-18 161168]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-06-02 2804568]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]
S3 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-09-22 655624]
S3 GamesAppService;GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McAWFwk;McAfee Activation Service; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-03-09 224704]
S3 McODS;McAfee Scanner; C:\Program Files\mcafee\VirusScan\mcods.exe [2011-03-18 501768]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-02-12 1255736]
S3 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-29 2292096]
S4 McOobeSv;McAfee OOBE Service; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------

moody55 · #7 Příspěvek od **moody55** » 27 srp 2013 15:09

a OS se spustí tak , že vyběhne DOS okno kam napíšu "explorer" , aby se ukázala plocha a ikony .....

#8 Příspěvek od **vyosek** » 29 srp 2013 10:15

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

moody55 · #9 Příspěvek od **moody55** » 03 zář 2013 08:40

díky, za pomoc , pomohl COMBOFIX

, prosím uzavřít

#10 Příspěvek od **vyosek** » 03 zář 2013 20:12

Log je jeste potreba docistit!!!

Dejte mi sem jeho log, c:\combofix.txt

VIRY.CZ

vir policie

vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie

Re: vir policie