vir policie

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

vir policie

#1 Příspěvek od moody55 »

dobrý den ,

jak odstranit na pc s napadeným virem "policie čr" , když nejde spustit v nouzáku a neustále se restartuje ?

děkuji za pomoc
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: vir policie

#2 Příspěvek od vyosek »

Zdravim :)

Zkuste tento postup http://forum.viry.cz/viewtopic.php?f=13&t=130781
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

Re: vir policie

#3 Příspěvek od moody55 »

zkoušel jsem příkazový řádek, ale dle návodu "Dojde ke spuštění Nouzového režimu (černá plocha s příkazovým řádkem)."
se mi to nespustí a restartuje se ....
Nahoru
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

Re: vir policie

#4 Příspěvek od moody55 »

nějak jsem to provedl ...tady je log :

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-08-2013
Ran by SYSTEM on 26-08-2013 16:21:51
Running from D:\
Windows 7 Home Premium (X86) OS Language:
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.
==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKU\A\...\Run: [BlazeServoTool] - C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [ 2009-07-07] (BlazeVideo Company)
HKU\A\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10u_ActiveX.exe [ 2011-08-16] (Adobe Systems, Inc.)
HKU\A\...\Winlogon: [Shell] cmd.exe [ 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\A\...\Command Processor: "C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe" <===== ATTENTION!
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()

========================== Services (Whitelisted) =================

S2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [63928 2012-01-03] (Adobe Systems Incorporated)
S3 BBSvc; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [191752 2011-06-07] (Microsoft Corporation.)
S2 BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [249648 2011-05-12] (Microsoft Corporation)
S2 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
S2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-16] (Conexant Systems Inc.)
S2 DsiWMIService; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [353360 2011-07-01] (Dritek System Inc.)
S3 EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [173424 2011-06-21] (Egis Technology Inc. )
S2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [872552 2011-08-02] (Acer Incorporated)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [655624 2011-09-22] (Acresso Software Inc.)
S3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-21] (Microsoft Corporation)
S3 GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [206072 2010-10-12] (WildTangent, Inc.)
S2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [36456 2011-05-30] (Acer Incorporated)
S3 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [856400 2010-11-21] (Microsoft Corporation)
S2 Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-09] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [501768 2011-03-17] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-10-18] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-10-18] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [161168 2011-10-18] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [116560 2009-06-10] (Microsoft Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
S3 odserv; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 SkypeUpdate; C:\Program Files (x86)\Skype\Updater\Updater.exe [160944 2012-07-13] (Skype Technologies)

==================== Drivers (Whitelisted) ====================

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [507392 2011-12-22] (ITETech )
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [114704 2011-03-30] (Advanced Micro Devices)
S3 b06bdrv; C:\Windows\system32\drivers\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl664.sys [4729408 2011-06-08] (Broadcom Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)
S0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-14] (Microsoft Corporation)
S3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRT64.sys [1495680 2011-01-11] (Conexant Systems Inc.)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [142632 2011-04-05] (ELAN Microelectronics Corp.)
S3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] (Microsoft Corporation)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [76912 2010-09-27] (Atheros Communications, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)
S1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [22648 2011-08-16] (Egis Technology Inc.)
S1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [20520 2011-08-16] (Egis Technology Inc.)
S1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [62776 2011-08-16] (Egis Technology Inc.)
S3 NTIDrvr; C:\Windows\system32\drivers\NTIDrvr.sys [18432 2011-03-10] (NTI Corporation)
S3 UBHelper; C:\Windows\system32\drivers\UBHelper.sys [17408 2011-03-10] (NTI Corporation)
S3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-26 16:21 - 2013-08-26 16:21 - 00000000 ____D C:\FRST
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
2013-08-19 17:57 - 2013-07-26 05:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-19 17:57 - 2013-07-26 05:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-19 17:57 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-19 17:57 - 2013-07-26 03:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-19 17:57 - 2013-07-26 03:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-19 17:57 - 2013-07-26 03:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-19 17:57 - 2013-07-26 03:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-19 17:57 - 2013-07-26 02:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-19 17:57 - 2013-07-26 02:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-19 17:57 - 2013-07-26 01:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-19 17:56 - 2013-07-26 05:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-19 17:56 - 2013-07-26 05:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-19 17:56 - 2013-07-26 05:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-19 17:56 - 2013-07-26 03:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-19 17:56 - 2013-07-26 03:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-19 17:56 - 2013-07-26 03:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-19 17:56 - 2013-07-26 03:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 18:41 - 2013-07-09 05:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-16 18:41 - 2013-07-09 05:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-16 18:41 - 2013-07-09 04:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 18:41 - 2013-07-09 04:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 18:40 - 2013-07-19 01:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-16 18:40 - 2013-07-19 01:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 18:39 - 2013-07-25 09:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-16 18:39 - 2013-07-25 08:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 18:39 - 2013-07-09 05:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-16 18:39 - 2013-07-09 04:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 18:39 - 2013-07-06 06:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-16 18:39 - 2013-06-15 04:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-08-26 16:21 - 2013-08-26 16:21 - 00000000 ____D C:\FRST
2013-08-26 14:15 - 2009-07-14 04:51 - 00093993 _____ C:\Windows\setupact.log
2013-08-26 13:54 - 2009-07-14 05:13 - 01445734 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-26 13:49 - 2011-09-22 15:43 - 01583673 _____ C:\Windows\WindowsUpdate.log
2013-08-26 13:42 - 2009-07-14 04:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-26 13:42 - 2009-07-14 04:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
2013-08-24 10:28 - 2011-08-16 08:06 - 00001832 _____ C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
2013-08-19 18:54 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-19 18:17 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\SysWOW64

Files to move or delete:
====================
C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\ApnStub.exe
C:\Users\A\AppData\Local\Temp\DevSetup32.dll
C:\Users\A\AppData\Local\Temp\DevSetup64.dll
C:\Users\A\AppData\Local\Temp\DriverInstall32.exe
C:\Users\A\AppData\Local\Temp\DriverInstall64.exe
C:\Users\A\AppData\Local\Temp\ose00000.exe
C:\Users\A\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\~convert3355677032899799826.exe
C:\Users\A\AppData\Local\Temp\~convert3489013962979702606.exe
C:\Users\A\AppData\Local\Temp\~convert5102852234649812584.exe
C:\Users\A\AppData\Local\Temp\~convert5820696981388311661.exe
C:\Users\A\AppData\Local\Temp\~convert6394538878999565410.exe
C:\Users\A\AppData\Local\Temp\~convert7438168547712612209.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AF15BDAEX.dll
C:\Users\Aa\AppData\Local\Temp\drivers\AF9015\Win32\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\IA64\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AMD64\DPInst.exe
C:\Users\A\AppData\Local\Temp\clear.fiClient\cabarc.exe

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-14 05:30] - [2011-07-14 05:30] - 2871808 ____A (Microsoft Corporation)

C:\Windows\System32\winlogon.exe
[2010-11-21 03:24] - [2010-11-21 03:24] - 0390656 ____A (Microsoft Corporation)

C:\Windows\System32\wininit.exe
[2009-07-13 23:52] - [2009-07-14 01:39] - 0129024 ____A (Microsoft Corporation)

C:\Windows\System32\svchost.exe
[2009-07-13 23:31] - [2009-07-14 01:39] - 0027136 ____A (Microsoft Corporation)

C:\Windows\System32\services.exe
[2009-07-13 23:19] - [2009-07-14 01:39] - 0328704 ____A (Microsoft Corporation)

C:\Windows\System32\User32.dll
[2010-11-21 03:24] - [2010-11-21 03:24] - 1008128 ____A (Microsoft Corporation)

C:\Windows\System32\userinit.exe
[2010-11-21 03:24] - [2010-11-21 03:24] - 0030720 ____A (Microsoft Corporation)

C:\Windows\System32\Drivers\volsnap.sys
[2010-11-21 03:23] - [2010-11-21 03:23] - 0295808 ____A (Microsoft Corporation)


==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-26 10:11:54
Restore point made on: 2013-01-11 13:01:15
Restore point made on: 2013-02-15 12:41:06
Restore point made on: 2013-03-15 14:51:48
Restore point made on: 2013-04-04 09:31:37
Restore point made on: 2013-04-10 10:16:50
Restore point made on: 2013-04-29 10:32:29
Restore point made on: 2013-05-16 11:13:26
Restore point made on: 2013-05-17 11:44:27
Restore point made on: 2013-06-02 07:01:13
Restore point made on: 2013-06-15 18:05:10
Restore point made on: 2013-06-16 05:24:37
Restore point made on: 2013-07-21 06:58:39
Restore point made on: 2013-08-19 17:50:51

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 3322.84 MB
Available physical RAM: 2958.63 MB
Total Pagefile: 3093.47 MB
Available Pagefile: 2095.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 2000.05 MB

==================== Drives ================================

Drive b: (RamDrive) (Fixed) (Total:0.91 GB) (Free:0.9 GB) NTFS
Drive c: (Acer) (Fixed) (Total:450.66 GB) (Free:397.76 GB) NTFS
Drive d: (K3) (Removable) (Total:3.92 GB) (Free:3.88 GB) FAT32
Drive g: (HBCD 15.0) (CDROM) (Total:0.52 GB) (Free:0 GB) CDFS
Drive x: (Mini Xp) (Fixed) (Total:0.23 GB) (Free:0.23 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 23D6C8B0)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 70F34DAA)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)


LastRegBack: 2013-01-14 14:42

==================== End Of Log ============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: vir policie

#5 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKU\A\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10u_ActiveX.exe [ 2011-08-16] (Adobe Systems, Inc.)
HKU\A\...\Winlogon: [Shell] cmd.exe [ 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\A\...\Command Processor: "C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe" <===== ATTENTION!
2013-08-24 10:47 - 2013-08-24 10:47 - 01029480 _____ C:\Users\A\AppData\Local\2433f433
2013-08-24 10:47 - 2013-08-24 10:47 - 01029448 _____ C:\Users\A\AppData\Roaming\2433f433
C:\Users\A~1\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\ApnStub.exe
C:\Users\A\AppData\Local\Temp\DevSetup32.dll
C:\Users\A\AppData\Local\Temp\DevSetup64.dll
C:\Users\A\AppData\Local\Temp\DriverInstall32.exe
C:\Users\A\AppData\Local\Temp\DriverInstall64.exe
C:\Users\A\AppData\Local\Temp\ose00000.exe
C:\Users\A\AppData\Local\Temp\rtuubnoxrdsxhootm.exe
C:\Users\A\AppData\Local\Temp\~convert3355677032899799826.exe
C:\Users\A\AppData\Local\Temp\~convert3489013962979702606.exe
C:\Users\A\AppData\Local\Temp\~convert5102852234649812584.exe
C:\Users\A\AppData\Local\Temp\~convert5820696981388311661.exe
C:\Users\A\AppData\Local\Temp\~convert6394538878999565410.exe
C:\Users\A\AppData\Local\Temp\~convert7438168547712612209.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AF15BDAEX.dll
C:\Users\Aa\AppData\Local\Temp\drivers\AF9015\Win32\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\IA64\DPInst.exe
C:\Users\A\AppData\Local\Temp\drivers\AF9015\AMD64\DPInst.exe
C:\Users\A\AppData\Local\Temp\clear.fiClient\cabarc.exe
Hosts:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny log na flashku k FRST
:arrow: Spustte znovu FRST.exe na tom poskozenem PC
  • Kliknete na Fix
  • Probehne oprava a na flash disku se vytvori log Fixlog.txt
:arrow: Pokuste se nastartovat do bezneho rezimu

:arrow: Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

Re: vir policie

#6 Příspěvek od moody55 »

Povedlo se , vkládám LOG...
-------------------------------------------

Logfile of random's system information tool 1.09 (written by random/random)
Run by Adélka at 2013-08-27 13:45:47
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 407 GB (88%) free of 461 GB
Total RAM: 3819 MB (65% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 26146416
\??\C:\Windows\system32\conhost.exe "-113741786127969670-1902278196-27168916138194959141698991610659418161665304685
"C:\Windows\system32\Dwm.exe"
cmd.exe
\??\C:\Windows\system32\conhost.exe "20276041432011791246341163249-1387016411-1496144387-1693994082-768930640-1102357477
C:\Windows\System32\spoolsv.exe
taskeng.exe {6D38637F-63BD-464F-A968-3D1C79AFFF58}
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe"
"C:\Program Files (x86)\Launch Manager\LMworker.exe"
"C:\Program Files (x86)\Launch Manager\LMutilps32.exe" --system-level-mutex="Local\{B904A927-FE6B-48fd-8C83-6B807BED1F9C}" --enable-wmi-window
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Acer\Registration\GREGsvc.exe"
"C:\Program Files\Acer\Acer Updater\UpdaterService.exe"
"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc
"C:\Windows\system32\mfevtps.exe"
"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE
"C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe"
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\x64\saHook.dll", saHooker_Initialize_and_Wait
"C:\Windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe"
"C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe"
taskeng.exe {4869A3B5-6F95-4E78-B78E-23EAB4BE4307}
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe"
C:\Windows\servicing\TrustedInstaller.exe
taskeng.exe {DC06C19A-3AD8-4E56-8668-664F80988D0C}
"C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"
explorer
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
"C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe"
"C:\Program Files\mcafee.com\agent\mcagent.exe" /runkey
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
"C:\Program Files (x86)\Launch Manager\LManager.exe"
"C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
"C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
"C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe -Embedding
taskhost.exe $(Arg0)
"C:\Program Files\Common Files\McAfee\Core\mchost.exe" {a5bf70ba-d688-4f57-b4c5-2ab50d11fdce} /pid=4800
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-6bb0dd3f-0f8d-496f-8b46-89e2310089c9 -SystemEventPortName:HostProcess-2cfccf28-3a6f-49d3-b758-539fb51fe068 -IoCancelEventPortName:HostProcess-da8cd2d3-d3f4-4e57-b129-ee67fc3b1aca -NonStateChangingEventPortName:HostProcess-1ad0956c-3ee7-45cd-a758-3560a40e1e04 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:128383d0-acd0-4697-881e-6e545dc7d83f
wmiadap.exe /R /T
"E:\RSITx64.exe"
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" /uilaunched
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120212100049.dll [2011-12-06 94688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2013-05-22 298312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-03-18 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120212100049.dll [2011-12-06 79744]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2013-05-22 249872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07 1152264]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-03-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2013-05-22 298312]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2013-05-22 249872]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-06-07 1152264]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2011-04-05 2589992]
"Power Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-08-02 1831016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BlazeServoTool"=C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"mcui_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2011-11-22 1675160]
"SuiteTray"=C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2011-06-22 341360]
"Norton Online Backup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-06-02 1155928]
"BackupManagerTray"=C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [2011-04-24 297280]
"LManager"=C:\Program Files (x86)\Launch Manager\LManager.exe [2011-07-01 1103440]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-25 336384]
"ArcadeMovieService"=C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [2011-05-10 177448]
"HP Software Update"=C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
""= []
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"ApnUpdater"=C:\Program Files (x86)\Ask.com\Updater\Updater.exe [2012-01-03 1391272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfevtp]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-08-27 13:45:49 ----D---- C:\Program Files\trend micro
2013-08-27 13:45:47 ----D---- C:\rsit
2013-08-26 18:21:33 ----D---- C:\FRST
2013-08-26 10:33:59 ----A---- C:\Windows\ntbtlog.txt
2013-08-19 19:57:04 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-08-19 19:57:03 ----A---- C:\Windows\system32\ieui.dll
2013-08-19 19:57:01 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-08-19 19:57:01 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-08-19 19:57:01 ----A---- C:\Windows\system32\iesetup.dll
2013-08-19 19:57:01 ----A---- C:\Windows\system32\iernonce.dll
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-08-19 19:57:00 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-08-19 19:57:00 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-19 19:57:00 ----A---- C:\Windows\system32\iesysprep.dll
2013-08-19 19:57:00 ----A---- C:\Windows\system32\ie4uinit.exe
2013-08-19 19:56:58 ----A---- C:\Windows\system32\iertutil.dll
2013-08-19 19:56:56 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-08-19 19:56:56 ----A---- C:\Windows\system32\msfeeds.dll
2013-08-19 19:56:55 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-08-19 19:56:55 ----A---- C:\Windows\system32\jscript.dll
2013-08-19 19:56:53 ----A---- C:\Windows\system32\jscript9.dll
2013-08-19 19:56:51 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-08-19 19:56:50 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-08-19 19:56:49 ----A---- C:\Windows\system32\urlmon.dll
2013-08-19 19:56:47 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-08-19 19:56:47 ----A---- C:\Windows\system32\jsproxy.dll
2013-08-19 19:56:46 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-08-19 19:56:45 ----A---- C:\Windows\system32\wininet.dll
2013-08-19 19:56:43 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-08-19 19:56:40 ----A---- C:\Windows\system32\ieframe.dll
2013-08-19 19:56:38 ----A---- C:\Windows\system32\mshtml.dll
2013-08-19 19:56:32 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-08-16 20:41:39 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-08-16 20:41:39 ----A---- C:\Windows\system32\crypt32.dll
2013-08-16 20:41:38 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2013-08-16 20:41:38 ----A---- C:\Windows\system32\wintrust.dll
2013-08-16 20:41:37 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2013-08-16 20:41:36 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2013-08-16 20:41:36 ----A---- C:\Windows\system32\cryptsvc.dll
2013-08-16 20:41:36 ----A---- C:\Windows\system32\cryptnet.dll
2013-08-16 20:40:14 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-08-16 20:40:14 ----A---- C:\Windows\system32\tzres.dll
2013-08-16 20:39:24 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2013-08-16 20:39:24 ----A---- C:\Windows\system32\WMVDECOD.DLL
2013-08-16 20:39:21 ----A---- C:\Windows\system32\rpcrt4.dll
2013-08-16 20:39:20 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2013-08-16 20:39:16 ----A---- C:\Windows\system32\drivers\tssecsrv.sys
2013-08-16 20:39:12 ----A---- C:\Windows\system32\drivers\tcpip.sys

======List of files/folders modified in the last 1 month======

2013-08-27 15:25:26 ----D---- C:\Windows\system32\drivers\etc
2013-08-27 13:45:49 ----RD---- C:\Program Files
2013-08-27 13:45:30 ----D---- C:\Windows\Temp
2013-08-27 13:42:14 ----D---- C:\ProgramData\clear.fi
2013-08-27 13:40:26 ----D---- C:\Windows\System32
2013-08-27 13:40:26 ----D---- C:\Windows\inf
2013-08-27 13:40:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-08-27 13:15:55 ----D---- C:\Windows\system32\config
2013-08-27 12:31:56 ----RSD---- C:\Windows\assembly
2013-08-27 12:17:07 ----D---- C:\Windows\Microsoft.NET
2013-08-26 10:33:59 ----D---- C:\Windows
2013-08-24 12:47:19 ----HD---- C:\ProgramData
2013-08-19 20:20:16 ----D---- C:\Windows\winsxs
2013-08-19 20:17:20 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-08-19 20:17:20 ----D---- C:\Windows\SysWOW64
2013-08-19 20:17:19 ----D---- C:\Windows\system32\cs-CZ
2013-08-19 20:17:18 ----D---- C:\Program Files (x86)\Internet Explorer
2013-08-19 20:17:15 ----D---- C:\Program Files\Internet Explorer
2013-08-19 20:17:01 ----D---- C:\Windows\system32\drivers
2013-08-19 19:57:59 ----D---- C:\Windows\system32\catroot
2013-08-19 19:57:58 ----D---- C:\Windows\system32\catroot2
2013-08-19 19:55:56 ----SHD---- C:\Windows\Installer
2013-08-19 19:55:33 ----D---- C:\ProgramData\Microsoft Help
2013-08-19 19:51:13 ----SHD---- C:\System Volume Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2011-10-15 647080]
R0 mfewfpk;McAfee Inc. mfewfpk; C:\Windows\system32\drivers\mfewfpk.sys [2011-10-15 284648]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 mfenlfk;McAfee NDIS Light Filter; C:\Windows\system32\DRIVERS\mfenlfk.sys [2011-10-15 75808]
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2011-08-16 22648]
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2011-08-16 20520]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-08-16 62776]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 309760]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2011-06-08 4729408]
R3 cfwids;McAfee Inc. cfwids; C:\Windows\system32\drivers\cfwids.sys [2011-10-15 65264]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2011-01-11 1495680]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2011-04-05 142632]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-09-27 76912]
R3 mfeapfk;McAfee Inc. mfeapfk; C:\Windows\system32\drivers\mfeapfk.sys [2011-10-15 160280]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2011-10-15 229528]
R3 mfefirek;McAfee Inc. mfefirek; C:\Windows\system32\drivers\mfefirek.sys [2011-10-15 481768]
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-03-10 18432]
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-03-10 17408]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-15 47232]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2011-12-22 507392]
S3 mfeavfk01;McAfee Inc.; C:\Windows\system32\drivers\mfeavfk01.sys []
S3 mferkdet;McAfee Inc. mferkdet; C:\Windows\system32\drivers\mferkdet.sys [2011-10-15 100912]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-06-17 246376]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 204288]
R2 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-13 249648]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2010-12-17 198784]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-07-01 353360]
R2 ePowerSvc;ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-08-02 872552]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]
R2 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McMPFSvc;McAfee Personal Firewall Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 mcmscsvc;McAfee Services; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McNASvc;McAfee Network Agent; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McProxy;McAfee Proxy Service; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 McShield;McAfee McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [2011-10-18 199272]
R2 mfefire;McAfee Firewall Core Service; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\Windows\system32\mfevtps.exe [2011-10-18 161168]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-28 249936]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-06-02 2804568]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]
S3 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-09-22 655624]
S3 GamesAppService;GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McAWFwk;McAfee Activation Service; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-03-09 224704]
S3 McODS;McAfee Scanner; C:\Program Files\mcafee\VirusScan\mcods.exe [2011-03-18 501768]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-02-12 1255736]
S3 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-29 2292096]
S4 McOobeSv;McAfee OOBE Service; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-28 249936]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------
Nahoru
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

Re: vir policie

#7 Příspěvek od moody55 »

a OS se spustí tak , že vyběhne DOS okno kam napíšu "explorer" , aby se ukázala plocha a ikony ..... :(
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: vir policie

#8 Příspěvek od vyosek »

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
moody55
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 23 Dub 2013 10:45

Re: vir policie

#9 Příspěvek od moody55 »

díky, za pomoc , pomohl COMBOFIX :) , prosím uzavřít
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: vir policie

#10 Příspěvek od vyosek »

Log je jeste potreba docistit!!!

Dejte mi sem jeho log, c:\combofix.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“