Avast mi našel rootkit, prosím o radu

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Avast mi našel rootkit, prosím o radu

#1 Příspěvek od Abe.xxx »

Dobrý den,
při pravidelné kontrole mi avast našel 4 rootkit infekce. Předem se přiznám, že jsem soubory sice smazal pomocí ComboFix (bohužel jsem objevil toto forum až po experimentování s Combofixem a jak jsem se dočetl v pravidlech, nejspíš bych se sním neměl začínat) a avast už infekci nehlásí, nicméně mám podezření, že zbavit se jich tak snadné nebude. Je nějáká možnost jak s určitostí zjistit, jestli jsem se všech infekcí zbavil či nikoliv.
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#2 Příspěvek od Abe.xxx »

Použil jsem ho včera a dnes, ale použil jsem ho čtyřikrát, mám vložit všechny čtyři? Nebo jen první, poslední?
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#3 Příspěvek od Abe.xxx »

První:

CFScript

KillAll::

File::
c:\users\Abe\AppData\Local\Temp\jar_cache878767963434361926.tmp
c:\users\Abe\AppData\Local\Temp\kbpki\75b60e5df10530ec668c.dll
c:\users\Abe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1d25c6d1-7c875as7
c:\users\Abe\kbpki\nativLib\CMINativeLib.dll

ComboFix
ComboFix 13-11-01.03 - Abe 03.11.2013 10:51:58.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8106.6549 [GMT 1:00]
Spuštěný z: c:\users\Abe\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Abe\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\users\Abe\AppData\Local\Temp\jar_cache878767963434361926.tmp"
"c:\users\Abe\AppData\Local\Temp\kbpki\75b60e5df10530ec668c.dll"
"c:\users\Abe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1d25c6d1-7c875as7"
"c:\users\Abe\kbpki\nativLib\CMINativeLib.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Abe\AppData\Local\Temp\_MEI29042\_ctypes.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\_elementtree.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\_hashlib.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\_multiprocessing.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\_socket.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\_ssl.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\msvcp100.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\msvcr100.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\pyexpat.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\pysqlite2._sqlite.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\python27.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\pythoncom27.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\PyWinTypes27.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\select.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\unicodedata.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32api.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32com.shell.shell.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32crypt.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32event.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32file.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32inet.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32pdh.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32process.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32profile.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32security.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\win32ts.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\windows._cacheinvalidation.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._controls_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._core_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._gdi_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._html2.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._misc_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._windows_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wx._wizard.pyd
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxbase294u_net_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxbase294u_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxmsw294u_adv_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxmsw294u_core_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxmsw294u_html_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI29042\wxmsw294u_webview_vc90.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-03 do 2013-11-03 )))))))))))))))))))))))))))))))
.
.
2013-11-03 10:25 . 2013-11-03 10:25 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-03 10:25 . 2013-11-03 10:25 -------- d-----w- c:\users\UpdatusUser.ABECOMPUTER\AppData\Local\temp
2013-11-03 10:25 . 2013-11-03 10:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-03 00:08 . 2013-11-03 00:08 -------- d-----w- c:\users\Abe\AppData\Local\Max Secure Software
2013-11-03 00:07 . 2013-11-03 00:08 -------- d-----w- c:\users\Abe\AppData\Roaming\GetRightToGo
2013-11-02 21:06 . 2013-11-02 21:32 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-11-02 21:06 . 2013-11-02 21:06 116440 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-11-02 21:05 . 2013-11-02 21:05 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-11-02 10:31 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6969ED8F-0801-422A-96CA-CA1212FF5241}\mpengine.dll
2013-10-25 08:50 . 2013-10-25 08:50 -------- d-----w- c:\program files\CCleaner
2013-10-22 10:52 . 2013-10-22 15:37 -------- d-----w- c:\users\Abe\.matplotlib
2013-10-21 17:37 . 2013-10-21 17:37 -------- d-----w- c:\users\Abe\AppData\Roaming\AVAST Software
2013-10-18 15:19 . 2013-11-02 19:20 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-10-18 11:04 . 2013-10-18 12:17 -------- d-----w- c:\users\Abe\AppData\Roaming\ParaView
2013-10-15 19:41 . 2013-10-15 19:41 -------- d-----w- c:\users\Abe\AppData\Roaming\Malwarebytes
2013-10-15 19:41 . 2013-10-15 19:41 -------- d-----w- c:\programdata\Malwarebytes
2013-10-15 19:41 . 2013-10-15 19:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-10-15 19:41 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-15 19:40 . 2013-10-15 19:40 -------- d-----w- c:\users\Abe\AppData\Local\Programs
2013-10-08 20:03 . 2013-10-08 20:32 -------- d-----w- C:\AeroCAD
2013-10-05 09:37 . 2013-10-11 21:11 -------- d-----w- c:\programdata\Codemasters
2013-10-05 09:03 . 2013-10-05 09:03 -------- d-----w- c:\program files (x86)\OpenAL
2013-10-05 09:03 . 2008-04-28 10:29 805400 ----a-r- c:\windows\SysWow64\tmp454.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-21 17:32 . 2013-03-04 16:48 205320 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-10-21 17:32 . 2013-03-04 16:48 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-10-21 17:32 . 2012-07-08 12:24 409832 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-10-21 17:32 . 2012-07-08 12:24 38984 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-10-21 17:32 . 2012-07-08 12:24 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-10-21 17:32 . 2012-07-08 12:24 65264 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-10-21 17:32 . 2012-07-08 12:24 1032416 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-10-21 17:32 . 2012-07-08 12:24 84328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-10-21 17:32 . 2012-06-02 20:37 334648 ----a-w- c:\windows\system32\aswBoot.exe
2013-10-21 17:32 . 2012-07-08 12:23 43152 ----a-w- c:\windows\avastSS.scr
2013-10-11 17:31 . 2012-04-11 16:16 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-11 17:31 . 2012-04-11 16:16 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-06 18:51 . 2012-06-17 21:32 245 ----a-w- c:\windows\system32\AF15IRTBL.bin
2013-09-12 08:58 . 2013-09-28 13:21 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-09-12 08:58 . 2013-09-28 13:21 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-09-12 08:58 . 2013-09-28 13:19 15901448 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-09-12 08:58 . 2013-09-28 13:19 1412832 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-09-12 08:58 . 2013-09-28 13:19 13628208 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-09-12 08:58 . 2013-09-28 13:19 1222824 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-09-12 08:58 . 2013-09-28 13:19 7648000 ----a-w- c:\windows\system32\nvopencl.dll
2013-09-12 08:58 . 2013-09-28 13:19 6329552 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-09-12 08:58 . 2013-09-28 13:19 32032 ----a-w- c:\windows\system32\drivers\nvpciflt.sys
2013-09-12 08:58 . 2013-09-28 13:19 317472 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-09-12 08:58 . 2013-09-28 13:19 29337376 ----a-w- c:\windows\system32\nvoglv64.dll
2013-09-12 08:58 . 2013-09-28 13:19 266984 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-09-12 08:58 . 2013-09-28 13:19 22102304 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-09-12 08:58 . 2013-09-28 13:19 603424 ----a-w- c:\windows\system32\NvIFR64.dll
2013-09-12 08:58 . 2013-09-28 13:19 515360 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-09-12 08:58 . 2013-09-28 13:19 168616 ----a-w- c:\windows\system32\nvinitx.dll
2013-09-12 08:58 . 2013-09-28 13:19 141336 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-09-12 08:58 . 2013-09-28 13:19 11274528 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-09-12 08:58 . 2013-09-28 13:19 681760 ----a-w- c:\windows\system32\NvFBC64.dll
2013-09-12 08:58 . 2013-09-28 13:19 586016 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-09-12 08:58 . 2013-09-28 13:19 1884448 ----a-w- c:\windows\system32\nvdispco6432723.dll
2013-09-12 08:58 . 2013-09-28 13:19 15703688 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-09-12 08:58 . 2013-09-28 13:19 1511712 ----a-w- c:\windows\system32\nvdispgenco6432723.dll
2013-09-12 08:58 . 2013-09-28 13:19 12947360 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-09-12 08:58 . 2013-09-28 13:19 9281032 ----a-w- c:\windows\system32\nvcuda.dll
2013-09-12 08:58 . 2013-09-28 13:19 7720576 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-09-12 08:58 . 2013-09-28 13:19 2970400 ----a-w- c:\windows\system32\nvcuvid.dll
2013-09-12 08:58 . 2013-09-28 13:19 2789152 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-09-12 08:58 . 2013-09-28 13:19 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-09-12 08:58 . 2013-09-28 13:19 2367264 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-09-12 08:58 . 2013-09-28 13:19 2007328 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-09-12 08:58 . 2013-09-28 13:19 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-09-12 08:58 . 2013-09-28 13:19 2986672 ----a-w- c:\windows\system32\nvapi64.dll
2013-09-12 08:58 . 2013-09-28 13:19 2630304 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-09-12 07:25 . 2013-09-28 13:22 6599968 ----a-w- c:\windows\system32\nvcpl.dll
2013-09-12 07:25 . 2013-09-28 13:22 3452192 ----a-w- c:\windows\system32\nvsvc64.dll
2013-09-12 07:25 . 2013-09-28 13:22 920864 ----a-w- c:\windows\system32\nvvsvc.exe
2013-09-12 07:25 . 2013-09-28 13:22 67072 ----a-w- c:\windows\system32\nv3dappshextr.dll
2013-09-12 07:25 . 2013-09-28 13:22 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-09-12 07:25 . 2013-09-28 13:22 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-09-12 07:25 . 2013-09-28 13:22 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-09-12 07:25 . 2013-09-28 13:22 1042208 ----a-w- c:\windows\system32\nv3dappshext.dll
2013-09-11 22:06 . 2013-09-28 13:22 3361114 ----a-w- c:\windows\system32\nvcoproc.bin
2013-09-03 13:35 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-09-25 20133824]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-10-21 3567800]
.
c:\users\Abe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Carka mezera na carka.ahk [2013-1-5 130]
Carka mezera na mezera.ahk [2013-1-5 142]
Dropbox.lnk - c:\users\Abe\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
HST login.ahk [2012-12-12 96]
HST Site and URL.ahk [2012-10-8 134]
HST Tagy 2.ahk [2012-10-12 124]
HST Tagy.ahk [2012-10-12 84]
JZ login.ahk [2013-1-13 108]
PinkTube webmaster.ahk [2013-8-6 568]
PT login.ahk [2013-1-13 110]
RT login.ahk [2013-1-13 116]
TeamViewer.ahk [2013-9-23 72]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys;c:\windows\SYSNATIVE\drivers\papycpu.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Wisaroc;Wisaroc;c:\windows\Wisaroc.exe;c:\windows\Wisaroc.exe [x]
R3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
R3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys;c:\windows\SYSNATIVE\Drivers\lgandadb.sys [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys;c:\windows\SYSNATIVE\Drivers\IT9135BDA.sys [x]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtpt64.sys [x]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtbs64.sys [x]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys;c:\windows\SYSNATIVE\DRIVERS\lgvmdm64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]
S2 SamsungDeviceConfigurationWinService;SamsungDeviceConfiguration;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [x]
S2 SGDrv;SGDrv;c:\windows\system32\DRIVERS\SGdrv64.sys;c:\windows\SYSNATIVE\DRIVERS\SGdrv64.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-10-17 18:48 1185744 ----a-w- c:\program files (x86)\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-10-21 17:32 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-11-14 10358784]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.pinktube.com/index.php?s=user.login
mStart Page = hxxp://samsung.msn.com
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Abe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\hasplms.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\program files (x86)\Samsung\Easy Settings\SmartSetting.exe
c:\program files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
c:\program files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Samsung\Easy Settings\dmhkcore.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2013-11-03 11:32:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-03 10:32
ComboFix2.txt 2013-11-03 00:34
.
Před spuštěním: 8 752 799 744
Po spuštění: 8 683 548 672
.
- - End Of File - - B657B83AE592904A732B54F3FE6C137E
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#4 Příspěvek od Abe.xxx »

Druhý:

CFScript

KillAll::

Folder::
C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001

ComboFix

ComboFix 13-11-01.03 - Abe 03.11.2013 12:40:43.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8106.6434 [GMT 1:00]
Spuštěný z: c:\users\Abe\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Abe\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\JumpListIcons\52F7.tmp
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\JumpListIcons\5308.tmp
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Last Session
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Last Tabs
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_icmlaeflemplmjndnaapfdbbnpncnbda_0.localstorage-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_icmlaeflemplmjndnaapfdbbnpncnbda_0.localstorage
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Login Data
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\QuotaManager
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Top Sites
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Default\Web Data
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Local State
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Filter 2
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Internet Explorer\iconcache\73uxqby\largeiconcache.dat
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{1FAEC69A-BF12-11E1-87D7-DBC6E9556121}.dat
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{EC1E1744-C560-11E1-AEBB-DCA97150F66C}.dat
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{E16C93EB-BE46-11E1-B71B-CC747FD27726}.dat
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
c:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db




Druhý má přes 1700000 znaků, když jsem chtěl připojit přílohu, tak mi to napsalo, že přípona .txt není podporována
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#5 Příspěvek od Abe.xxx »

úplně první log, jsem si tedy jaksi neuložil
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#6 Příspěvek od Abe.xxx »

Poslední

ComboFix

ComboFix 13-11-01.03 - Abe 03.11.2013 18:55:43.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8106.6559 [GMT 1:00]
Spuštěný z: c:\users\Abe\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Abe\AppData\Local\Temp\_MEI25722\_ctypes.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\_elementtree.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\_hashlib.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\_multiprocessing.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\_socket.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\_ssl.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\msvcp100.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\msvcr100.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\pyexpat.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\pysqlite2._sqlite.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\python27.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\pythoncom27.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\PyWinTypes27.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\select.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\unicodedata.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32api.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32com.shell.shell.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32crypt.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32event.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32file.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32inet.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32pdh.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32process.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32profile.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32security.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\win32ts.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\windows._cacheinvalidation.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._controls_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._core_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._gdi_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._html2.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._misc_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._windows_.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wx._wizard.pyd
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxbase294u_net_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxbase294u_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxmsw294u_adv_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxmsw294u_core_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxmsw294u_html_vc90.dll
c:\users\Abe\AppData\Local\Temp\_MEI25722\wxmsw294u_webview_vc90.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-03 do 2013-11-03 )))))))))))))))))))))))))))))))
.
.
2013-11-03 18:02 . 2013-11-03 18:02 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-03 18:02 . 2013-11-03 18:02 -------- d-----w- c:\users\UpdatusUser.ABECOMPUTER\AppData\Local\temp
2013-11-03 18:02 . 2013-11-03 18:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-03 00:07 . 2013-11-03 00:08 -------- d-----w- c:\users\Abe\AppData\Roaming\GetRightToGo
2013-11-02 21:06 . 2013-11-02 21:06 116440 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-11-02 10:31 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6969ED8F-0801-422A-96CA-CA1212FF5241}\mpengine.dll
2013-10-25 08:50 . 2013-10-25 08:50 -------- d-----w- c:\program files\CCleaner
2013-10-22 10:52 . 2013-10-22 15:37 -------- d-----w- c:\users\Abe\.matplotlib
2013-10-21 17:37 . 2013-10-21 17:37 -------- d-----w- c:\users\Abe\AppData\Roaming\AVAST Software
2013-10-18 15:19 . 2013-11-02 19:20 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-10-18 11:04 . 2013-10-18 12:17 -------- d-----w- c:\users\Abe\AppData\Roaming\ParaView
2013-10-15 19:40 . 2013-10-15 19:40 -------- d-----w- c:\users\Abe\AppData\Local\Programs
2013-10-08 20:03 . 2013-10-08 20:32 -------- d-----w- C:\AeroCAD
2013-10-05 09:03 . 2013-10-05 09:03 -------- d-----w- c:\program files (x86)\OpenAL
2013-10-05 09:03 . 2008-04-28 10:29 805400 ----a-r- c:\windows\SysWow64\tmp454.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-03 13:01 . 2012-07-08 12:24 65264 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-11-03 13:01 . 2012-07-08 12:24 38984 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-11-03 13:01 . 2012-07-08 12:24 1032416 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-11-03 13:01 . 2012-07-08 12:24 84328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-11-03 13:01 . 2012-06-02 20:37 334648 ----a-w- c:\windows\system32\aswBoot.exe
2013-11-03 13:01 . 2012-07-08 12:23 43152 ----a-w- c:\windows\avastSS.scr
2013-10-21 17:32 . 2013-03-04 16:48 205320 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-10-21 17:32 . 2013-03-04 16:48 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-10-21 17:32 . 2012-07-08 12:24 409832 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-10-21 17:32 . 2012-07-08 12:24 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-10-11 17:31 . 2012-04-11 16:16 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-11 17:31 . 2012-04-11 16:16 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-06 18:51 . 2012-06-17 21:32 245 ----a-w- c:\windows\system32\AF15IRTBL.bin
2013-09-12 08:58 . 2013-09-28 13:21 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-09-12 08:58 . 2013-09-28 13:21 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-09-12 08:58 . 2013-09-28 13:19 15901448 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-09-12 08:58 . 2013-09-28 13:19 1412832 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-09-12 08:58 . 2013-09-28 13:19 13628208 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-09-12 08:58 . 2013-09-28 13:19 1222824 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-09-12 08:58 . 2013-09-28 13:19 7648000 ----a-w- c:\windows\system32\nvopencl.dll
2013-09-12 08:58 . 2013-09-28 13:19 6329552 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-09-12 08:58 . 2013-09-28 13:19 32032 ----a-w- c:\windows\system32\drivers\nvpciflt.sys
2013-09-12 08:58 . 2013-09-28 13:19 317472 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-09-12 08:58 . 2013-09-28 13:19 29337376 ----a-w- c:\windows\system32\nvoglv64.dll
2013-09-12 08:58 . 2013-09-28 13:19 266984 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-09-12 08:58 . 2013-09-28 13:19 22102304 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-09-12 08:58 . 2013-09-28 13:19 603424 ----a-w- c:\windows\system32\NvIFR64.dll
2013-09-12 08:58 . 2013-09-28 13:19 515360 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-09-12 08:58 . 2013-09-28 13:19 168616 ----a-w- c:\windows\system32\nvinitx.dll
2013-09-12 08:58 . 2013-09-28 13:19 141336 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-09-12 08:58 . 2013-09-28 13:19 11274528 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-09-12 08:58 . 2013-09-28 13:19 681760 ----a-w- c:\windows\system32\NvFBC64.dll
2013-09-12 08:58 . 2013-09-28 13:19 586016 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-09-12 08:58 . 2013-09-28 13:19 1884448 ----a-w- c:\windows\system32\nvdispco6432723.dll
2013-09-12 08:58 . 2013-09-28 13:19 15703688 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-09-12 08:58 . 2013-09-28 13:19 1511712 ----a-w- c:\windows\system32\nvdispgenco6432723.dll
2013-09-12 08:58 . 2013-09-28 13:19 12947360 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-09-12 08:58 . 2013-09-28 13:19 9281032 ----a-w- c:\windows\system32\nvcuda.dll
2013-09-12 08:58 . 2013-09-28 13:19 7720576 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-09-12 08:58 . 2013-09-28 13:19 2970400 ----a-w- c:\windows\system32\nvcuvid.dll
2013-09-12 08:58 . 2013-09-28 13:19 2789152 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-09-12 08:58 . 2013-09-28 13:19 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-09-12 08:58 . 2013-09-28 13:19 2367264 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-09-12 08:58 . 2013-09-28 13:19 2007328 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-09-12 08:58 . 2013-09-28 13:19 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-09-12 08:58 . 2013-09-28 13:19 2986672 ----a-w- c:\windows\system32\nvapi64.dll
2013-09-12 08:58 . 2013-09-28 13:19 2630304 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-09-12 07:25 . 2013-09-28 13:22 6599968 ----a-w- c:\windows\system32\nvcpl.dll
2013-09-12 07:25 . 2013-09-28 13:22 3452192 ----a-w- c:\windows\system32\nvsvc64.dll
2013-09-12 07:25 . 2013-09-28 13:22 920864 ----a-w- c:\windows\system32\nvvsvc.exe
2013-09-12 07:25 . 2013-09-28 13:22 67072 ----a-w- c:\windows\system32\nv3dappshextr.dll
2013-09-12 07:25 . 2013-09-28 13:22 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-09-12 07:25 . 2013-09-28 13:22 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-09-12 07:25 . 2013-09-28 13:22 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-09-12 07:25 . 2013-09-28 13:22 1042208 ----a-w- c:\windows\system32\nv3dappshext.dll
2013-09-11 22:06 . 2013-09-28 13:22 3361114 ----a-w- c:\windows\system32\nvcoproc.bin
2013-09-03 13:35 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-09-25 20133824]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-03 3568312]
.
c:\users\Abe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Carka mezera na carka.ahk [2013-1-5 130]
Carka mezera na mezera.ahk [2013-1-5 142]
Dropbox.lnk - c:\users\Abe\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
HST login.ahk [2012-12-12 96]
HST Site and URL.ahk [2012-10-8 134]
HST Tagy 2.ahk [2012-10-12 124]
HST Tagy.ahk [2012-10-12 84]
JZ login.ahk [2013-1-13 108]
PinkTube webmaster.ahk [2013-8-6 568]
PT login.ahk [2013-1-13 110]
RT login.ahk [2013-1-13 116]
TeamViewer.ahk [2013-9-23 72]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys;c:\windows\SYSNATIVE\drivers\papycpu.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Wisaroc;Wisaroc;c:\windows\Wisaroc.exe;c:\windows\Wisaroc.exe [x]
R3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
R3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys;c:\windows\SYSNATIVE\Drivers\lgandadb.sys [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys;c:\windows\SYSNATIVE\Drivers\IT9135BDA.sys [x]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtpt64.sys [x]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtbs64.sys [x]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys;c:\windows\SYSNATIVE\DRIVERS\lgvmdm64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]
S2 SamsungDeviceConfigurationWinService;SamsungDeviceConfiguration;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [x]
S2 SGDrv;SGDrv;c:\windows\system32\DRIVERS\SGdrv64.sys;c:\windows\SYSNATIVE\DRIVERS\SGdrv64.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-10-17 18:48 1185744 ----a-w- c:\program files (x86)\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-03 13:01 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Abe\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-09-25 15:37 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-11-14 10358784]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.pinktube.com/index.php?s=user.login
mStart Page = hxxp://samsung.msn.com
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Abe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
FF - ProfilePath - c:\users\Abe\AppData\Roaming\Mozilla\Firefox\Profiles\ik57xx02.default\
FF - ExtSQL: 2013-11-03 14:01; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\hasplms.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2013-11-03 19:10:05 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-03 18:09
ComboFix2.txt 2013-11-03 10:32
ComboFix3.txt 2013-11-03 00:34
.
Před spuštěním: 8 548 925 440
Po spuštění: 8 563 056 640
.
- - End Of File - - FEBC8237902F7FE81280F1D00A764927
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#7 Příspěvek od Abe.xxx »

Druhý:

CFScript

KillAll::

Folder::
C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001

ComboFix
Přílohy
ComboFix (2).zip
(74.48 KiB) Staženo 63 x
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#8 Příspěvek od Abe.xxx »

složku Qoobox jsem sice nemazal, nicméně v ní je pouze log ComboFix2 a ComboFix3 a další soubory, ale logy jen tyhle dva.
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#9 Příspěvek od Abe.xxx »

Naughty napsal: CACLS "C:\Qoobox\BackEnv" /T /E /G Everyone:F
Na tohle jsem dostal odpověď : Přístup byl odepřen

S tím uloadnutím složky to bude dost trvat při mém připojení, má přes 900 mega
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#10 Příspěvek od Abe.xxx »

Textové soubory v příloze
Přílohy
Qoobox.zip
(15.07 KiB) Staženo 69 x
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#11 Příspěvek od Abe.xxx »

Microsoft Windows [Verze 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Všechna práva vyhrazena.

C:\windows\system32>CACLS "C:\Qoobox\BackEnv" /T /E /G Everyone:F
Zpracovávaná složka: C:\Qoobox\BackEnv
Zpracovávaný soubor: C:\Qoobox\BackEnv\AppData.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Cache.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Cookies.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Desktop.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Favorites.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\History.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Music.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\NetHood.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Personal.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Pictures.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\PrintHood.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Profiles.Folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Programs.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Recent.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\SendTo.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\SetPath.bat
Zpracovávaný soubor: C:\Qoobox\BackEnv\StartMenu.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\StartUp.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\SysPath.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\Templates.folder.dat
Zpracovávaný soubor: C:\Qoobox\BackEnv\VikPev00

C:\windows\system32>
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#12 Příspěvek od Abe.xxx »

Avast označil tyhle soubory:

C:\Users\Abe\AppData\Local\Temp\jar_cache878767963434361926.tmp
C:\Users\Abe\AppData\Local\Temp\kbpki\75b60e5df10530ec668c.dll
C:\Users\Abe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1d25c6d1-7c875as7
C:\Users\Abe\kbpki\nativLib\CMINativeLib.dll

konkrétně v logu z avastu byly tyhle 4 soubory:

C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Temp\jar_cache878767963434361926.tmp

C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\Local\Temp\kbpki\75b60e5df10530ec668c.dll

C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1d25c6d1-7c875as7

C:\avast! sandbox\S-1-5-21-1571869238-3936240484-2151935606-1001\webStorage\C\Users\Abe\kbpki\nativLib\CMINativeLib.dll
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#13 Příspěvek od Abe.xxx »

Jelikož je avast nesmazal ani když jsem je dal smazat po restartu, tak jsem zkusil smazat napřed jen soubory, to nepomohlo ( avast pořád hlásil infekci ) pak jsem zkusil smazat celou podsožku sandboxu - nevím, jestli to byla správná úvaha. Poté jsem avast pro jistotu přeinstaloval (něják mi to přišlo správně). Ty soubory v Temp adresáři co maže Combofix pořád dokola, s tím tedy nesouvisí? Myslel jsem, že by neměl mazat nic, když není počítač infikován.
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#14 Příspěvek od Abe.xxx »

Jen pro dolnění, počítač se choval před mým počínáním, i po něm zcela neormálně, na problém mě upozornil až test avastu.
Nahoru
Abe.xxx
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 03 Lis 2013 19:56

Re: Avast mi našel rootkit, prosím o radu

#15 Příspěvek od Abe.xxx »

Zatím velice děkuji, dobrou
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“