Plné zatížení procesoru a grafické karty

Zpráva

MartasZLA · #1 Příspěvek od **MartasZLA** » 10 Led 2014 10:18

Ahoj, včera večer se u mne oběvil takový problém. Při nečinnosti mi vyskočí zatížení procesoru a grafiky na maximum, při spuštění správce úloh okamžitě zatížení klesne na klasické hodnoty. Při spuštění správce úloh mi vždy spadne grafický ovladač. Prosím o radu zkoušel jsem eset ale ten nic nenašel. Mám udělat nějaký sken? Vůbec se v tom nevyznám. Děkuji

Windows 7 Home Premium 64bit
Geforce 332.21 driver

#2 Příspěvek od **vyosek** » 10 Led 2014 11:26

Zdravim

Jelikoz nevime o Vasem PC nic a z kristalove koule se spatne vesti, sice ted v Brne sviti slunicko, ale proste tam neni nic stejne videt

Ale dosti legracek, kouknem na to

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784 - navod Vas povede...

MartasZLA · #3 Příspěvek od **MartasZLA** » 10 Led 2014 12:03

Tak tady to je

Logfile of random's system information tool 1.09 (written by random/random)
Run by Martin at 2014-01-10 12:00:50
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 57 GB (47%) free of 122 GB
Total RAM: 8147 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:01:20, on 10.1.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16750)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Seznam.cz\bin\postak.exe
D:\Hry\Steam\Steam.exe
C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe
C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files (x86)\Genius\Imperator Pro\IMProHid.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
c:\windows\core.exe
C:\windows\cuda.exe
C:\windows\proxy.exe
C:\windows\cpu.exe
C:\Program Files\trend micro\Martin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.b1.org/?bsrc=hmior&chid=c167991
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Imperator pro] "C:\Program Files (x86)\Genius\Imperator Pro\IMProhid.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax",DllRegisterServer
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files (x86)\Seznam.cz\bin\postak.exe" -s
O4 - HKCU\..\Run: [Steam] "D:\Hry\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HiSuiteOuc64.exe - Unknown owner - C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe
O23 - Service: HuaweiHiSuiteService64.exe - Unknown owner - C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11920 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
taskeng.exe {108B70FE-D9EC-4D04-9EAB-E42EE80F5D34}
"C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe" -/service
"C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe" -/service
taskeng.exe {BE37DAFA-807F-4E3E-8A3E-0875CED3A8B8}
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files (x86)\PCMeter\PCMeterV0.3.exe"
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
"C:\Program Files (x86)\uTorrent\uTorrent.exe"
"C:\Program Files (x86)\Seznam.cz\bin\postak.exe" -s
"D:\Hry\Steam\Steam.exe" -silent
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" -c
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
szndesktop.exe default start
"C:\Program Files (x86)\Genius\Imperator Pro\IMProHid.exe"
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl
"C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe" /TUStart /pid:2792
"C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
\??\C:\Windows\system32\conhost.exe "339768492-1671621082-1035782288-1400766831-661305478-242308135-1618274052333024333
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
WLIDSvcM.exe 2880
C:\Windows\system32\svchost.exe -k bthsvcs
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "-640738741543655582-16489121631361567671-20513237021382574121-17897404991253753097
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
c:\windows\core.exe
"C:\windows\cuda.exe" -o stratum+tcp://global.wemineltc.com:3334 -u chun.10nv -p x
\??\C:\Windows\system32\conhost.exe "-12926382751626368509175145447-458614916-1044145499-1551214982266018782-67340104
"C:\windows\proxy.exe" -o global.wemineltc.com -p 3333
"C:\windows\ati.exe"
\??\C:\Windows\system32\conhost.exe "-1157846862361974771482433015-1649960537-16135000901085435502101427700-770923698
\??\C:\Windows\system32\conhost.exe "-1678451328-1893396784-142671184618032924654822792051347958051884553051204707047
"C:\windows\cpu.exe" -o 127.0.0.1:8332 -u chun.10cpu -p x
\??\C:\Windows\system32\conhost.exe "1546720386-83258859410809460081145563895-1425416626-11404519511305311184-270533159
wmiadap.exe /F /T /R
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Martin\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AutoKMS.job
C:\Windows\tasks\AutoKMSDaily.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cec476fb18c5a6.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default

prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.7]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.0]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.170 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.11.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\
FirefoxAddon@similarWeb.com
{97A78363-B868-4B48-AC91-A783A31215AF}
{ea614400-e918-4741-9a97-7a972ff7c30b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2013-03-09 6669000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-01-10 1372864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2013-03-09 4171464]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-01-10 1138536]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-01-10 1372864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-01-10 1138536]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-11-26 6325936]
"Nvtmru"=C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [2013-11-08 1028384]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2013-12-10 1100248]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2012-11-05 108144]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"DAEMON Tools Pro Agent"=C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [2012-04-26 3111744]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2012-11-09 393728]
"Seznam Postak"=C:\Program Files (x86)\Seznam.cz\bin\postak.exe [2012-01-10 491040]
"Steam"=D:\Hry\Steam\steam.exe [2014-01-09 1815464]
"cz.seznam.software.autoupdate"=C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2013-04-12 92664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB3MON]
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2012-01-26 291608]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Imperator pro"=C:\Program Files (x86)\Genius\Imperator Pro\IMProhid.exe [2012-02-24 287232]
""= []
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-01-10 3764024]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"B Register C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax"=C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax,DllRegisterServer []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2012-12-12 442880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2013-03-09 6669000]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2013-03-09 4171464]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-01-10 12:00:50 ----D---- C:\rsit
2014-01-10 12:00:50 ----D---- C:\Program Files\trend micro
2014-01-10 09:53:08 ----D---- C:\Users\Martin\AppData\Roaming\AVAST Software
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswstm.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswSP.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2014-01-10 09:52:36 ----A---- C:\Windows\system32\aswBoot.exe
2014-01-10 09:52:32 ----A---- C:\Windows\avastSS.scr
2014-01-10 09:51:44 ----D---- C:\Program Files\AVAST Software
2014-01-10 09:51:04 ----D---- C:\ProgramData\AVAST Software
2014-01-10 09:50:01 ----A---- C:\Windows\cpu.exe
2014-01-10 09:32:32 ----D---- C:\ProgramData\Doctor Web
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvumdshim.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvopencl.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvoglshim32.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvinit.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\NvIFROpenGL.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\NvIFR.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\NvFBC.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvEncodeAPI.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2014-01-08 09:49:37 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvopencl.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvoglv64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvoglshim64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvinitx.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\NvIFROpenGL.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\NvIFR64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvhdap64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvhdagenco6420103.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\NvFBC64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvEncodeAPI64.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvdispgenco6433221.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvdispco6433221.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvd3dumx.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvcuvid.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvcuvenc.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvcuda.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\nvcompiler.dll
2014-01-08 09:49:37 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2014-01-08 09:49:37 ----A---- C:\Windows\system32\drivers\nvhda64v.sys
2014-01-08 09:48:34 ----D---- C:\NVIDIA
2014-01-03 15:08:02 ----A---- C:\Windows\core.exe
2014-01-03 15:05:54 ----A---- C:\Windows\cpu1.exe
2014-01-03 09:31:56 ----A---- C:\Windows\start.exe
2013-12-19 11:49:12 ----D---- C:\ProgramData\HiSuiteOuc
2013-12-19 11:49:12 ----D---- C:\ProgramData\HandSetService
2013-12-19 11:49:00 ----A---- C:\Windows\system32\drivers\WdfCoInstaller01007.dll
2013-12-19 11:05:11 ----A---- C:\Windows\system32\WdfCoInstaller01007.dll
2013-12-19 11:05:11 ----A---- C:\Windows\system32\drivers\WUDFUpdate_01007.dll
2013-12-19 11:05:11 ----A---- C:\Windows\system32\drivers\WinUSBCoInstaller.dll
2013-12-19 11:05:11 ----A---- C:\Windows\system32\drivers\hw_usbdev.sys
2013-12-19 11:05:11 ----A---- C:\Windows\system32\drivers\hw_quusbnet.sys
2013-12-19 11:05:11 ----A---- C:\Windows\system32\drivers\hw_quusbmdm.sys
2013-12-19 11:05:09 ----A---- C:\Windows\system32\WinUSBCoInstaller.dll
2013-12-19 11:05:08 ----D---- C:\Program Files (x86)\HiSuite
2013-12-18 12:35:56 ----A---- C:\Windows\SYSWOW64\nvaudcap32v.dll
2013-12-18 12:35:56 ----A---- C:\Windows\system32\drivers\nvvad64v.sys
2013-12-11 21:23:50 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-12-11 06:48:02 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2013-12-11 06:48:02 ----A---- C:\Windows\SYSWOW64\wmp.dll
2013-12-11 06:48:02 ----A---- C:\Windows\system32\wmploc.DLL
2013-12-11 06:48:01 ----A---- C:\Windows\system32\wmp.dll
2013-12-11 06:47:22 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-12-11 06:47:22 ----A---- C:\Windows\system32\ieui.dll
2013-12-11 06:47:21 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-12-11 06:47:21 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-12-11 06:47:21 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-12-11 06:47:21 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-12-11 06:47:21 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-12-11 06:47:21 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-11 06:47:21 ----A---- C:\Windows\system32\iesysprep.dll
2013-12-11 06:47:21 ----A---- C:\Windows\system32\iesetup.dll
2013-12-11 06:47:21 ----A---- C:\Windows\system32\iertutil.dll
2013-12-11 06:47:21 ----A---- C:\Windows\system32\iernonce.dll
2013-12-11 06:47:21 ----A---- C:\Windows\system32\ie4uinit.exe
2013-12-11 06:47:20 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-12-11 06:47:20 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-12-11 06:47:20 ----A---- C:\Windows\system32\msfeeds.dll
2013-12-11 06:47:20 ----A---- C:\Windows\system32\jscript9.dll
2013-12-11 06:47:20 ----A---- C:\Windows\system32\jscript.dll
2013-12-11 06:47:19 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-12-11 06:47:19 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-12-11 06:47:19 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-12-11 06:47:19 ----A---- C:\Windows\system32\urlmon.dll
2013-12-11 06:47:19 ----A---- C:\Windows\system32\jsproxy.dll
2013-12-11 06:47:18 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-12-11 06:47:18 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-12-11 06:47:18 ----A---- C:\Windows\system32\wininet.dll
2013-12-11 06:47:17 ----A---- C:\Windows\system32\ieframe.dll
2013-12-11 06:47:16 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-12-11 06:47:15 ----A---- C:\Windows\system32\mshtml.dll
2013-12-11 06:46:03 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-12-11 06:46:03 ----A---- C:\Windows\system32\WMPhoto.dll
2013-12-11 06:46:02 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-12-11 06:46:02 ----A---- C:\Windows\SYSWOW64\msieftp.dll
2013-12-11 06:46:02 ----A---- C:\Windows\system32\win32k.sys
2013-12-11 06:46:02 ----A---- C:\Windows\system32\tzres.dll
2013-12-11 06:46:02 ----A---- C:\Windows\system32\msieftp.dll
2013-12-11 06:46:00 ----A---- C:\Windows\SYSWOW64\wscript.exe
2013-12-11 06:46:00 ----A---- C:\Windows\SYSWOW64\scrrun.dll
2013-12-11 06:46:00 ----A---- C:\Windows\SYSWOW64\imagehlp.dll
2013-12-11 06:46:00 ----A---- C:\Windows\SYSWOW64\cscript.exe
2013-12-11 06:46:00 ----A---- C:\Windows\system32\wscript.exe
2013-12-11 06:46:00 ----A---- C:\Windows\system32\scrrun.dll
2013-12-11 06:46:00 ----A---- C:\Windows\system32\imagehlp.dll
2013-12-11 06:46:00 ----A---- C:\Windows\system32\drivers\portcls.sys
2013-12-11 06:46:00 ----A---- C:\Windows\system32\drivers\drmk.sys
2013-12-11 06:46:00 ----A---- C:\Windows\system32\cscript.exe

======List of files/folders modified in the last 1 month======

2014-01-10 12:01:08 ----D---- C:\Users\Martin\AppData\Roaming\uTorrent
2014-01-10 12:00:58 ----D---- C:\Windows\Temp
2014-01-10 12:00:50 ----RD---- C:\Program Files
2014-01-10 12:00:00 ----D---- C:\Windows
2014-01-10 11:59:26 ----D---- C:\Windows\system32\config
2014-01-10 11:58:30 ----A---- C:\Windows\SYSWOW64\log.txt
2014-01-10 11:14:37 ----D---- C:\Windows\system32\Tasks
2014-01-10 11:05:03 ----D---- C:\Windows\system32\drivers
2014-01-10 11:04:08 ----D---- C:\Program Files (x86)\TuneUp Utilities 2013
2014-01-10 09:55:22 ----D---- C:\Windows\System32
2014-01-10 09:55:22 ----D---- C:\Windows\inf
2014-01-10 09:55:22 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-01-10 09:54:18 ----D---- C:\Users\Martin\AppData\Roaming\Seznam.cz
2014-01-10 09:52:36 ----D---- C:\Windows\winsxs
2014-01-10 09:51:04 ----AHD---- C:\ProgramData
2014-01-10 09:49:28 ----D---- C:\Windows\Tasks
2014-01-09 15:26:55 ----D---- C:\Program Files (x86)\The KMPlayer
2014-01-09 09:17:58 ----D---- C:\Windows\system32\catroot2
2014-01-09 09:17:48 ----D---- C:\Windows\SysWOW64
2014-01-08 10:19:44 ----D---- C:\Users\Martin\AppData\Roaming\TS3Client
2014-01-08 09:50:43 ----D---- C:\Windows\system32\DriverStore
2014-01-08 09:50:43 ----D---- C:\Windows\system32\catroot
2014-01-08 09:50:40 ----D---- C:\ProgramData\NVIDIA
2014-01-03 17:40:02 ----D---- C:\Users\Martin\AppData\Roaming\vlc
2013-12-29 23:39:25 ----SHD---- C:\Windows\Installer
2013-12-21 10:14:23 ----D---- C:\Windows\Microsoft.NET
2013-12-20 23:52:38 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-12-20 23:52:28 ----RSD---- C:\Windows\assembly
2013-12-20 23:51:50 ----D---- C:\Windows\SYSWOW64\en-US
2013-12-20 23:51:50 ----D---- C:\Windows\system32\en-US
2013-12-20 15:40:59 ----D---- C:\ProgramData\WarThunder
2013-12-20 15:40:26 ----D---- C:\Windows\Logs
2013-12-19 21:33:31 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2013-12-19 21:33:31 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2013-12-19 21:33:31 ----A---- C:\Windows\system32\nvwgf2umx.dll
2013-12-19 21:33:31 ----A---- C:\Windows\system32\nvumdshimx.dll
2013-12-19 21:33:31 ----A---- C:\Windows\system32\nvapi64.dll
2013-12-19 19:53:46 ----A---- C:\Windows\system32\nvsvc64.dll
2013-12-19 19:53:46 ----A---- C:\Windows\system32\nvcpl.dll
2013-12-19 19:53:44 ----A---- C:\Windows\system32\nvvsvc.exe
2013-12-19 19:53:44 ----A---- C:\Windows\system32\nvsvcr.dll
2013-12-19 19:53:44 ----A---- C:\Windows\system32\nvshext.dll
2013-12-19 19:53:44 ----A---- C:\Windows\system32\nvmctray.dll
2013-12-19 11:07:52 ----SD---- C:\Users\Martin\AppData\Roaming\Microsoft
2013-12-19 11:05:08 ----RD---- C:\Program Files (x86)
2013-12-12 08:53:31 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-11 17:03:32 ----D---- C:\Program Files (x86)\Google
2013-12-11 07:25:42 ----D---- C:\Windows\rescache
2013-12-11 07:25:16 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-12-11 06:52:35 ----D---- C:\Windows\Panther
2013-12-11 06:52:03 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-12-11 06:52:03 ----D---- C:\Windows\system32\cs-CZ
2013-12-11 06:52:03 ----D---- C:\Program Files\Windows Media Player
2013-12-11 06:52:03 ----D---- C:\Program Files\Internet Explorer
2013-12-11 06:52:03 ----D---- C:\Program Files (x86)\Windows Media Player
2013-12-11 06:52:03 ----D---- C:\Program Files (x86)\Internet Explorer
2013-12-11 06:47:13 ----D---- C:\ProgramData\Microsoft Help
2013-12-11 06:46:50 ----D---- C:\Windows\system32\MRT
2013-12-11 06:46:13 ----D---- C:\Windows\debug
2013-12-11 06:46:12 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-01-10 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-01-10 207904]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-01-26 16152]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; \??\C:\Windows\system32\drivers\aswRdr2.sys [2014-01-10 92544]
R1 aswSnx;aswSnx; \??\C:\Windows\system32\drivers\aswSnx.sys [2014-01-10 1034464]
R1 aswSP;aswSP; \??\C:\Windows\system32\drivers\aswSP.sys [2014-01-10 422216]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-11-02 283200]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-10-08 211344]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-10-08 149592]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2014-01-10 78648]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 138744]
R3 anvsnddrv;AnvSoft Virtual Sound Device; C:\Windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]
R3 aswStm;aswStm; \??\C:\Windows\system32\drivers\aswStm.sys [2014-01-10 79672]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2011-11-30 358576]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-01-26 356120]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-01-26 787736]
R3 KYEKBPRO;IMPERATOR PRO Gaming Keyboard; C:\Windows\system32\drivers\KYEKBPRO.sys [2011-10-14 25600]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-07-17 62784]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-11-28 197408]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2013-12-05 39200]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [2012-09-19 11880]
R3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\Users\Martin\AppData\Local\Temp\tmp403A.tmp []
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 cpudrv64;cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-06-02 17864]
S3 cpuz136;cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys []
S3 DualCoreCenter;DualCoreCenter; \??\C:\Program Files (x86)\MSI\OverclockingCenter\NTGLM7X64.sys []
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-12-12 5353888]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
S3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2012-12-13 342528]
S3 MBfilt;MBfilt; C:\Windows\system32\drivers\MBfilt64.sys []
S3 MSICDSetup;MSICDSetup; \??\F:\CDriver64.sys []
S3 NTIOLib_1_0_3;NTIOLib_1_0_3; \??\C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys []
S3 NTIOLib_1_0_5;NTIOLib_1_0_5; \??\C:\Program Files (x86)\MSI\OverclockingCenter\NTIOLib_X64.sys []
S3 NTIOLib_1_0_C;NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 19968]
S3 WinUsb;Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-01-10 50344]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-11-26 1329304]
R2 HiSuiteOuc64.exe;HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [2013-07-11 137024]
R2 HuaweiHiSuiteService64.exe;HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [2013-05-02 197632]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2011-11-09 189608]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-01-20 277784]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 15129376]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-12-19 922912]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-11-23 76888]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2012-09-19 2365792]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-06-03 162408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11 257416]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-12-28 277640]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-12-17 137488]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 116648]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2013-03-09 50921648]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-11 119408]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-01-07 569768]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-11-09 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

#4 Příspěvek od **vyosek** » 10 Led 2014 12:07

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

MartasZLA · #5 Příspěvek od **MartasZLA** » 10 Led 2014 12:10

Zde je log. Mám tedy udělat i ten combofix?

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/10/2014 12:09:32 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe (PID: 1580) [AU-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 01/10/2014 12:09:46 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)

#6 Příspěvek od **vyosek** » 10 Led 2014 12:14

Ano, pokracujte ComboFixem

MartasZLA · #7 Příspěvek od **MartasZLA** » 10 Led 2014 12:15

ještě jsem sputil rkill při vypnutém správci tedy když byl vir aktivní a vypsalo to tohle:

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/10/2014 12:14:08 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* c:\windows\core.exe (PID: 5164) [WD-HEUR]
* C:\windows\cuda.exe (PID: 3492) [WD-HEUR]
* C:\windows\proxy.exe (PID: 1392) [WD-HEUR]
* C:\windows\ati.exe (PID: 4860) [WD-HEUR]
* C:\windows\cpu.exe (PID: 1512) [WD-HEUR]

5 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

#8 Příspěvek od **vyosek** » 10 Led 2014 12:16

MartasZLA napsal:ještě jsem sputil rkill při vypnutém správci tedy když byl vir aktivní

Stejnym zpusobem spustte ComboFix

MartasZLA · #9 Příspěvek od **MartasZLA** » 10 Led 2014 12:18

ještě mám dotaz na tento bod:
Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.

Mám ochrany vypnout v programech nebo ty programy ukončit přez zprávce?

#10 Příspěvek od **vyosek** » 10 Led 2014 12:19

Vypnout ochrany v programech

MartasZLA · #11 Příspěvek od **MartasZLA** » 10 Led 2014 12:32

Tady je combofix log:
ComboFix 14-01-08.03 - Martin 10.01.2014 12:23:08.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8147.6077 [GMT 1:00]
Spuštěný z: c:\users\Martin\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\Martin\AppData\Local\Minibar
c:\users\Martin\AppData\Local\Minibar\common.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome.manifest
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\content.xul
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\extension_info.json
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\icons\icon128.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\icons\icon19.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\icons\icon32.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\icons\icon48.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\initial_config.json
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\button.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.xul
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-left.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-middle.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-right.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-left.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-right.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\style.css
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-bottom.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-left.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-right.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-top.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-left.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-middle.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-right.png
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\toolbar.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\toolbar_stub.html
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango-ui\ui.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\browser.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\console.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\event_listener.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\initialize.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\io.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\jsonstorage.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\kango.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\lang.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\messaging.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\storage.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\uninstall_observer.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\userscript_engine.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\kango\xhr.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\main.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\actions.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\cachedxhr.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\config.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\homepage_helper.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\macros.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\minibar.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\search_helper.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\search_hook.js
c:\users\Martin\AppData\Local\Minibar\firefox\chrome\content\minibar\tabpage_helper.js
c:\users\Martin\AppData\Local\Minibar\firefox\install.rdf
c:\users\Martin\AppData\Local\Minibar\firefox\plugins\npMinibarPlugin.dll
c:\users\Martin\AppData\Local\Minibar\firefox_installer.js
c:\users\Martin\AppData\Local\Minibar\chrome.json
c:\users\Martin\AppData\Local\Minibar\chrome.pem
c:\users\Martin\AppData\Local\Minibar\chrome\background.html
c:\users\Martin\AppData\Local\Minibar\chrome\cached_http_request.js
c:\users\Martin\AppData\Local\Minibar\chrome\extension_info.json
c:\users\Martin\AppData\Local\Minibar\chrome\icons\icon128.png
c:\users\Martin\AppData\Local\Minibar\chrome\icons\icon19.png
c:\users\Martin\AppData\Local\Minibar\chrome\icons\icon32.png
c:\users\Martin\AppData\Local\Minibar\chrome\icons\icon48.png
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_kango.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_menu.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_messaging.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_pageutils.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_popup.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_toolbar.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_toolbar_customfixes.js
c:\users\Martin\AppData\Local\Minibar\chrome\includes\content_userscript.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango-ui\button.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango-ui\toolbar.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango-ui\ui.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\browser.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\console.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\event_listener.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\initialize.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\io.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\jsonstorage.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\kango.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\lang.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\messaging.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\userscript_engine.js
c:\users\Martin\AppData\Local\Minibar\chrome\kango\xhr.js
c:\users\Martin\AppData\Local\Minibar\chrome\main.js
c:\users\Martin\AppData\Local\Minibar\chrome\manifest.json
c:\users\Martin\AppData\Local\Minibar\chrome\minibar\actions.js
c:\users\Martin\AppData\Local\Minibar\chrome\minibar\cachedxhr.js
c:\users\Martin\AppData\Local\Minibar\chrome\minibar\config.js
c:\users\Martin\AppData\Local\Minibar\chrome\minibar\macros.js
c:\users\Martin\AppData\Local\Minibar\chrome\minibar\minibar.js
c:\users\Martin\AppData\Local\Minibar\chrome\MinibarPlugin.dll
c:\users\Martin\AppData\Local\Minibar\chrome\popup.html
c:\users\Martin\AppData\Local\Minibar\chrome\popup.js
c:\users\Martin\AppData\Local\Minibar\chrome\tab.html
c:\users\Martin\AppData\Local\Minibar\chrome\tab.js
c:\users\Martin\AppData\Local\Minibar\chrome_installer.js
c:\users\Martin\AppData\Local\Minibar\ie_installer.js
c:\users\Martin\AppData\Local\Minibar\minibar.crx
c:\users\Martin\AppData\Local\Minibar\minibar.xpi
c:\users\Martin\AppData\Local\Minibar\SettingsHelper.exe
c:\users\Martin\AppData\Local\Minibar\Uninstall.exe
c:\windows\cpu.exe
c:\windows\start.exe
c:\windows\SysWow64\frapsvid.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-10 do 2014-01-10 )))))))))))))))))))))))))))))))
.
.
2014-01-10 11:27 . 2014-01-10 11:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-10 11:19 . 2014-01-10 11:19 -------- d-s---w- c:\windows\SysWow64\Microsoft
2014-01-10 11:00 . 2014-01-10 11:01 -------- d-----w- C:\rsit
2014-01-10 11:00 . 2014-01-10 11:01 -------- d-----w- c:\program files\trend micro
2014-01-10 08:53 . 2014-01-10 08:53 -------- d-----w- c:\users\Martin\AppData\Roaming\AVAST Software
2014-01-10 08:52 . 2014-01-10 08:52 43152 ----a-w- c:\windows\avastSS.scr
2014-01-10 08:51 . 2014-01-10 08:51 -------- d-----w- c:\program files\AVAST Software
2014-01-10 08:51 . 2014-01-10 08:51 -------- d-----w- c:\programdata\AVAST Software
2014-01-10 08:32 . 2014-01-10 08:38 -------- d-----w- c:\users\Martin\Doctor Web
2014-01-10 08:32 . 2014-01-10 08:32 -------- d-----w- c:\programdata\Doctor Web
2014-01-09 23:21 . 2014-01-09 23:21 102188 ----a-w- c:\windows\litecoin-reaperv13.Intel(R)Core(TM)i5-3570KCPU@3.40GHz-256-6144-2.bin
2014-01-08 08:48 . 2014-01-08 08:48 -------- d-----w- C:\NVIDIA
2014-01-08 00:12 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0F6B978C-0CDC-47B6-8F3C-F92A0A60B826}\mpengine.dll
2014-01-03 14:08 . 2014-01-03 14:08 1050112 ----a-w- c:\windows\core.exe
2014-01-03 14:05 . 2014-01-03 14:05 190284 ----a-w- c:\windows\cpu1.exe
2013-12-30 10:20 . 2013-12-30 10:20 -------- d-----w- c:\users\Martin\AppData\Local\Targem
2013-12-21 10:26 . 2013-12-21 10:26 -------- d-----w- c:\users\Martin\AppData\Local\Setup Integrity Check
2013-12-20 22:52 . 2013-12-20 22:52 -------- d-----w- c:\users\Martin\AppData\Local\CDWLauncher
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\users\Martin\.android
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\programdata\HiSuiteOuc
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\programdata\HandSetService
2013-12-19 10:49 . 2010-02-18 23:00 1490656 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01007.dll
2013-12-19 10:05 . 2013-12-19 10:49 -------- d-----w- c:\users\Martin\AppData\Local\HiSuite
2013-12-19 10:05 . 2012-02-08 09:07 281088 ----a-w- c:\windows\system32\drivers\hw_quusbnet.sys
2013-12-19 10:05 . 2011-10-24 04:04 223232 ----a-w- c:\windows\system32\drivers\hw_quusbmdm.sys
2013-12-19 10:05 . 2011-10-24 03:51 116864 ----a-w- c:\windows\system32\drivers\hw_usbdev.sys
2013-12-19 10:05 . 2010-02-18 23:00 708168 ----a-w- c:\windows\system32\drivers\WinUSBCoInstaller.dll
2013-12-19 10:05 . 2010-02-18 23:00 1490656 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2013-12-19 10:05 . 2010-02-18 23:00 1533512 ----a-w- c:\windows\system32\drivers\WUDFUpdate_01007.dll
2013-12-19 10:05 . 2010-02-18 23:00 708168 ----a-w- c:\windows\system32\WinUSBCoInstaller.dll
2013-12-19 10:05 . 2013-12-19 10:50 -------- d-----w- c:\program files (x86)\HiSuite
2013-12-18 11:35 . 2013-12-05 08:42 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-12-18 11:35 . 2013-12-05 08:42 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-19 20:33 . 2013-09-17 20:22 18310112 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-12-19 20:33 . 2013-09-17 20:22 1436528 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-12-19 20:33 . 2013-09-17 20:22 15230352 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-12-19 20:33 . 2013-09-17 20:22 3071656 ----a-w- c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2013-09-17 20:22 2698272 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-12-19 18:53 . 2013-10-19 15:07 6671648 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2013-10-19 15:07 3490080 ----a-w- c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2013-10-19 15:07 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2013-10-19 15:07 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-12-19 18:53 . 2013-10-19 15:07 386336 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2013-10-19 15:07 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-12-19 05:01 . 2013-10-19 15:07 3539040 ----a-w- c:\windows\system32\nvcoproc.bin
2013-12-11 06:25 . 2013-01-26 22:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 06:25 . 2013-01-26 22:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-11 05:46 . 2012-11-09 17:19 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-10 02:13 . 2013-10-29 08:18 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:13 . 2013-10-29 08:18 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-10-20 08:40 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-11-30 06:43 . 2013-11-30 06:43 478208 ----a-w- c:\windows\ati.exe
2013-11-30 06:43 . 2013-11-30 06:43 348672 ----a-w- c:\windows\curl.dll
2013-11-30 06:43 . 2013-11-30 06:43 82432 ----a-w- c:\windows\pthread.dll
2013-11-28 16:03 . 2013-11-28 16:03 4346744 ----a-w- c:\windows\proxy.exe
2013-11-23 18:26 . 2013-12-11 05:46 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 05:46 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-23 14:52 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-11-23 14:52 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-11-23 14:49 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-11-23 14:43 . 2012-11-11 15:00 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut3_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut1_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\ARPPRODUCTICON.exe
2013-11-22 20:07 . 2013-11-22 20:07 86016 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-11-22 20:07 . 2013-11-22 20:07 40960 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut2_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 262144 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-11-21 21:45 . 2013-11-21 21:45 4422144 ----a-w- c:\windows\cuda.exe
2013-11-19 02:33 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-14 11:56 . 2013-11-20 09:57 1511712 ----a-w- c:\windows\system32\nvdispgenco6433182.dll
2013-11-14 11:56 . 2013-11-20 09:57 1884448 ----a-w- c:\windows\system32\nvdispco6433182.dll
2013-11-13 09:45 . 2013-11-13 09:45 15823872 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\Office 2010 Toolkit.exe
2013-11-13 09:45 . 2013-11-13 09:45 786492 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\cryptedcybertoirrent.exe
2013-11-13 09:45 . 2013-11-13 09:45 107008 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\Torrant.exe
2013-11-12 02:23 . 2013-12-11 05:46 2048 ----a-w- c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-11 05:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-10-30 02:32 . 2013-12-11 05:46 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-10-30 02:19 . 2013-12-11 05:46 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
2013-10-30 01:24 . 2013-12-11 05:46 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-10-25 06:19 . 2013-12-11 05:47 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-10-25 06:19 . 2013-12-11 05:47 2241536 ----a-w- c:\windows\system32\wininet.dll
2013-10-25 06:19 . 2013-12-11 05:47 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-10-25 06:18 . 2013-12-11 05:47 19271168 ----a-w- c:\windows\system32\mshtml.dll
2013-10-25 06:18 . 2013-12-11 05:47 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-10-25 06:17 . 2013-12-11 05:47 855552 ----a-w- c:\windows\system32\jscript.dll
2013-10-25 06:17 . 2013-12-11 05:47 3959808 ----a-w- c:\windows\system32\jscript9.dll
2013-10-25 06:17 . 2013-12-11 05:47 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-10-25 06:17 . 2013-12-11 05:47 526336 ----a-w- c:\windows\system32\ieui.dll
2013-10-25 06:17 . 2013-12-11 05:47 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-10-25 06:17 . 2013-12-11 05:47 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-10-25 06:17 . 2013-12-11 05:47 2648576 ----a-w- c:\windows\system32\iertutil.dll
2013-10-25 06:17 . 2013-12-11 05:47 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-10-25 06:17 . 2013-12-11 05:47 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-10-25 04:45 . 2013-12-11 05:47 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-10-25 04:43 . 2013-12-11 05:47 2877952 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-10-25 04:43 . 2013-12-11 05:47 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-10-25 04:43 . 2013-12-11 05:47 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-10-25 04:07 . 2013-12-11 05:47 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-10-25 03:41 . 2013-12-11 05:47 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-10-25 03:17 . 2013-12-11 05:47 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-10-25 02:49 . 2013-12-11 05:47 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-10-23 10:30 . 2013-10-29 08:20 1884448 ----a-w- c:\windows\system32\nvdispco6433165.dll
2013-10-23 10:30 . 2013-10-29 08:20 1511712 ----a-w- c:\windows\system32\nvdispgenco6433165.dll
2013-10-19 02:18 . 2013-12-11 05:46 81408 ----a-w- c:\windows\system32\imagehlp.dll
2013-10-19 01:36 . 2013-12-11 05:46 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2013-10-18 09:02 . 2013-10-18 09:02 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-10-18 09:02 . 2013-10-18 09:02 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-10-16 00:48 . 2013-10-21 18:57 1884448 ----a-w- c:\windows\system32\nvdispco6433158.dll
2013-10-16 00:48 . 2013-10-21 18:57 1511712 ----a-w- c:\windows\system32\nvdispgenco6433158.dll
2013-10-14 17:00 . 2013-11-14 08:47 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2012-04-26 3111744]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-11-09 393728]
"Seznam Postak"="c:\program files (x86)\Seznam.cz\bin\postak.exe" [2012-01-10 491040]
"Steam"="d:\hry\Steam\steam.exe" [2014-01-09 1815464]
"cz.seznam.software.autoupdate"="c:\users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" [2013-05-16 1062472]
"cz.seznam.software.szndesktop"="c:\users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-04-12 92664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Imperator pro"="c:\program files (x86)\Genius\Imperator Pro\IMProhid.exe" [2012-02-24 287232]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Tilt"=c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"amd_dc_opt"=c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
.
S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys;c:\windows\SYSNATIVE\drivers\anvsnddrv.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WINRING0_1_2_0
*Deregistered* - aswStm
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-26 06:25]
.
2014-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 10:04]
.
2014-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA1cec476fb18c5a6.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 10:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-11-26 6325936]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-08 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - ExtSQL: 2013-12-01 15:15; {ea614400-e918-4741-9a97-7a972ff7c30b}; c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
FF - ExtSQL: 2013-12-01 15:17; {97A78363-B868-4B48-AC91-A783A31215AF}; c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0]
"ImagePath"="\??\c:\users\Martin\AppData\Local\Temp\tmp403A.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e8,e5,c2,07,b5,fc,a1,bd,1c,f1,8e,6d,e7,29,eb,4a,13,d8,77,df,25,4b,dd,
b5,07,86,82,2b,85,fd,ae,e4,0c,6d,aa,30,ce,1b,74,84,fd,0b,4e,94,fe,9b,d6,27,\
"??"=hex:4b,35,b6,67,e4,2f,be,ac,3c,f2,50,a6,83,c3,2d,5e
.
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\License information*]
"datasecu"=hex:1e,88,d3,40,6f,30,c2,30,d7,43,24,49,98,ed,8b,8e,99,89,e4,15,ad,
b6,0e,32,42,90,bc,15,e2,15,1c,48,16,0b,9e,21,91,c8,17,89,9f,5b,c6,44,eb,5e,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-10 12:28:35
ComboFix-quarantined-files.txt 2014-01-10 11:28
.
Před spuštěním: Volných bajtů: 59 561 426 944
Po spuštění: Volných bajtů: 59 725 844 480
.
- - End Of File - - 6C4741D06A5296AF8CA6F90BEA745AFB
A36C5E4F47E84449FF07ED3517B43A31

MartasZLA · #12 Příspěvek od **MartasZLA** » 10 Led 2014 12:34

Kruci já zapoměl vypnout windows firewall a windows defender vadí to?

MartasZLA · #13 Příspěvek od **MartasZLA** » 10 Led 2014 15:46

Tak jsem vše udělal ještě jednou. Prvně RKil všechny programy jsem ukončil, poté jsem spustil Combofix. V tabulce bylo napsáno že maše cpu.exe ale po restartu problém přetrvává. Přidávám i poslední log:
ComboFix 14-01-08.03 - Martin 10.01.2014 15:37:05.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8147.6343 [GMT 1:00]
Spuštěný z: c:\users\Martin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\cpu.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-10 do 2014-01-10 )))))))))))))))))))))))))))))))
.
.
2014-01-10 14:40 . 2014-01-10 14:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-10 14:14 . 2014-01-10 14:14 79672 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-01-10 14:14 . 2014-01-10 08:52 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-01-10 14:14 . 2014-01-10 08:52 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-01-10 14:14 . 2014-01-10 08:52 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-01-10 14:14 . 2014-01-10 08:52 422216 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-01-10 14:14 . 2014-01-10 08:52 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-01-10 14:14 . 2014-01-10 08:52 1034464 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-01-10 14:14 . 2014-01-10 08:52 334136 ----a-w- c:\windows\system32\aswBoot.exe
2014-01-10 12:01 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9C405744-491D-44AE-BC79-0CB1F5044115}\mpengine.dll
2014-01-10 11:19 . 2014-01-10 11:19 -------- d-s---w- c:\windows\SysWow64\Microsoft
2014-01-10 11:00 . 2014-01-10 11:01 -------- d-----w- C:\rsit
2014-01-10 11:00 . 2014-01-10 11:01 -------- d-----w- c:\program files\trend micro
2014-01-10 08:53 . 2014-01-10 08:53 -------- d-----w- c:\users\Martin\AppData\Roaming\AVAST Software
2014-01-10 08:52 . 2014-01-10 08:52 43152 ----a-w- c:\windows\avastSS.scr
2014-01-10 08:51 . 2014-01-10 08:51 -------- d-----w- c:\program files\AVAST Software
2014-01-10 08:51 . 2014-01-10 08:51 -------- d-----w- c:\programdata\AVAST Software
2014-01-10 08:32 . 2014-01-10 08:38 -------- d-----w- c:\users\Martin\Doctor Web
2014-01-10 08:32 . 2014-01-10 08:32 -------- d-----w- c:\programdata\Doctor Web
2014-01-09 23:21 . 2014-01-09 23:21 102188 ----a-w- c:\windows\litecoin-reaperv13.Intel(R)Core(TM)i5-3570KCPU@3.40GHz-256-6144-2.bin
2014-01-03 14:08 . 2014-01-03 14:08 1050112 ----a-w- c:\windows\core.exe
2014-01-03 14:05 . 2014-01-03 14:05 190284 ----a-w- c:\windows\cpu1.exe
2013-12-30 10:20 . 2013-12-30 10:20 -------- d-----w- c:\users\Martin\AppData\Local\Targem
2013-12-21 10:26 . 2013-12-21 10:26 -------- d-----w- c:\users\Martin\AppData\Local\Setup Integrity Check
2013-12-20 22:52 . 2013-12-20 22:52 -------- d-----w- c:\users\Martin\AppData\Local\CDWLauncher
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\users\Martin\.android
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\programdata\HiSuiteOuc
2013-12-19 10:49 . 2013-12-19 10:49 -------- d-----w- c:\programdata\HandSetService
2013-12-19 10:49 . 2010-02-18 23:00 1490656 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01007.dll
2013-12-19 10:05 . 2013-12-19 10:49 -------- d-----w- c:\users\Martin\AppData\Local\HiSuite
2013-12-19 10:05 . 2012-02-08 09:07 281088 ----a-w- c:\windows\system32\drivers\hw_quusbnet.sys
2013-12-19 10:05 . 2011-10-24 04:04 223232 ----a-w- c:\windows\system32\drivers\hw_quusbmdm.sys
2013-12-19 10:05 . 2011-10-24 03:51 116864 ----a-w- c:\windows\system32\drivers\hw_usbdev.sys
2013-12-19 10:05 . 2010-02-18 23:00 708168 ----a-w- c:\windows\system32\drivers\WinUSBCoInstaller.dll
2013-12-19 10:05 . 2010-02-18 23:00 1490656 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2013-12-19 10:05 . 2010-02-18 23:00 1533512 ----a-w- c:\windows\system32\drivers\WUDFUpdate_01007.dll
2013-12-19 10:05 . 2010-02-18 23:00 708168 ----a-w- c:\windows\system32\WinUSBCoInstaller.dll
2013-12-19 10:05 . 2013-12-19 10:50 -------- d-----w- c:\program files (x86)\HiSuite
2013-12-18 11:35 . 2013-12-05 08:42 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-12-18 11:35 . 2013-12-05 08:42 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-19 20:33 . 2013-09-17 20:22 18310112 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-12-19 20:33 . 2013-09-17 20:22 1436528 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-12-19 20:33 . 2013-09-17 20:22 15230352 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-12-19 20:33 . 2013-09-17 20:22 3071656 ----a-w- c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2013-09-17 20:22 2698272 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-12-19 18:53 . 2013-10-19 15:07 6671648 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2013-10-19 15:07 3490080 ----a-w- c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2013-10-19 15:07 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2013-10-19 15:07 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-12-19 18:53 . 2013-10-19 15:07 386336 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2013-10-19 15:07 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-12-19 05:01 . 2013-10-19 15:07 3539040 ----a-w- c:\windows\system32\nvcoproc.bin
2013-12-11 06:25 . 2013-01-26 22:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 06:25 . 2013-01-26 22:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-11 05:46 . 2012-11-09 17:19 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-10 02:13 . 2013-10-29 08:18 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:13 . 2013-10-29 08:18 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-10-20 08:40 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-11-30 06:43 . 2013-11-30 06:43 478208 ----a-w- c:\windows\ati.exe
2013-11-30 06:43 . 2013-11-30 06:43 348672 ----a-w- c:\windows\curl.dll
2013-11-30 06:43 . 2013-11-30 06:43 82432 ----a-w- c:\windows\pthread.dll
2013-11-28 16:03 . 2013-11-28 16:03 4346744 ----a-w- c:\windows\proxy.exe
2013-11-23 18:26 . 2013-12-11 05:46 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 05:46 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-23 14:52 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-11-23 14:52 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-11-23 14:49 . 2012-11-11 15:00 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-11-23 14:43 . 2012-11-11 15:00 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut3_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut1_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 90112 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\ARPPRODUCTICON.exe
2013-11-22 20:07 . 2013-11-22 20:07 86016 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-11-22 20:07 . 2013-11-22 20:07 40960 ----a-r- c:\users\Martin\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut2_870013DB984D42A89E638673D8B2775A.exe
2013-11-22 20:07 . 2013-11-22 20:07 262144 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-11-21 21:45 . 2013-11-21 21:45 4422144 ----a-w- c:\windows\cuda.exe
2013-11-19 02:33 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-14 11:56 . 2013-11-20 09:57 1511712 ----a-w- c:\windows\system32\nvdispgenco6433182.dll
2013-11-14 11:56 . 2013-11-20 09:57 1884448 ----a-w- c:\windows\system32\nvdispco6433182.dll
2013-11-13 09:45 . 2013-11-13 09:45 15823872 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\Office 2010 Toolkit.exe
2013-11-13 09:45 . 2013-11-13 09:45 786492 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\cryptedcybertoirrent.exe
2013-11-13 09:45 . 2013-11-13 09:45 107008 ----a-w- c:\users\Martin\AppData\Roaming\Microsoft\Windows\Templates\Torrant.exe
2013-11-12 02:23 . 2013-12-11 05:46 2048 ----a-w- c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-11 05:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-10-30 02:32 . 2013-12-11 05:46 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-10-30 02:19 . 2013-12-11 05:46 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
2013-10-30 01:24 . 2013-12-11 05:46 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-10-25 06:19 . 2013-12-11 05:47 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-10-25 06:19 . 2013-12-11 05:47 2241536 ----a-w- c:\windows\system32\wininet.dll
2013-10-25 06:19 . 2013-12-11 05:47 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-10-25 06:18 . 2013-12-11 05:47 19271168 ----a-w- c:\windows\system32\mshtml.dll
2013-10-25 06:18 . 2013-12-11 05:47 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-10-25 06:17 . 2013-12-11 05:47 855552 ----a-w- c:\windows\system32\jscript.dll
2013-10-25 06:17 . 2013-12-11 05:47 3959808 ----a-w- c:\windows\system32\jscript9.dll
2013-10-25 06:17 . 2013-12-11 05:47 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-10-25 06:17 . 2013-12-11 05:47 526336 ----a-w- c:\windows\system32\ieui.dll
2013-10-25 06:17 . 2013-12-11 05:47 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-10-25 06:17 . 2013-12-11 05:47 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-10-25 06:17 . 2013-12-11 05:47 2648576 ----a-w- c:\windows\system32\iertutil.dll
2013-10-25 06:17 . 2013-12-11 05:47 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-10-25 06:17 . 2013-12-11 05:47 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-10-25 04:45 . 2013-12-11 05:47 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-10-25 04:43 . 2013-12-11 05:47 2877952 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-10-25 04:43 . 2013-12-11 05:47 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-10-25 04:43 . 2013-12-11 05:47 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-10-25 04:07 . 2013-12-11 05:47 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-10-25 03:41 . 2013-12-11 05:47 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-10-25 03:17 . 2013-12-11 05:47 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-10-25 02:49 . 2013-12-11 05:47 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-10-23 10:30 . 2013-10-29 08:20 1884448 ----a-w- c:\windows\system32\nvdispco6433165.dll
2013-10-23 10:30 . 2013-10-29 08:20 1511712 ----a-w- c:\windows\system32\nvdispgenco6433165.dll
2013-10-19 02:18 . 2013-12-11 05:46 81408 ----a-w- c:\windows\system32\imagehlp.dll
2013-10-19 01:36 . 2013-12-11 05:46 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2013-10-18 09:02 . 2013-10-18 09:02 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-10-18 09:02 . 2013-10-18 09:02 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-10-16 00:48 . 2013-10-21 18:57 1884448 ----a-w- c:\windows\system32\nvdispco6433158.dll
2013-10-16 00:48 . 2013-10-21 18:57 1511712 ----a-w- c:\windows\system32\nvdispgenco6433158.dll
2013-10-14 17:00 . 2013-11-14 08:47 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2012-04-26 3111744]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-11-09 393728]
"Seznam Postak"="c:\program files (x86)\Seznam.cz\bin\postak.exe" [2012-01-10 491040]
"Steam"="d:\hry\Steam\steam.exe" [2014-01-09 1815464]
"cz.seznam.software.autoupdate"="c:\users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" [2013-05-16 1062472]
"cz.seznam.software.szndesktop"="c:\users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-04-12 92664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Imperator pro"="c:\program files (x86)\Genius\Imperator Pro\IMProhid.exe" [2012-02-24 287232]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-01-10 3764024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Tilt"=c:\program files (x86)\GIGABYTE\GHOST\Tilt.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"amd_dc_opt"=c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HuaweiHiSuiteService64.exe;HuaweiHiSuiteService64.exe;c:\programdata\HandSetService\HuaweiHiSuiteService64.exe;c:\programdata\HandSetService\HuaweiHiSuiteService64.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 DualCoreCenter;DualCoreCenter;c:\program files (x86)\MSI\OverclockingCenter\NTGLM7X64.sys;c:\program files (x86)\MSI\OverclockingCenter\NTGLM7X64.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
R3 MSICDSetup;MSICDSetup;f:\cdriver64.sys;f:\CDriver64.sys [x]
R3 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [x]
R3 NTIOLib_1_0_5;NTIOLib_1_0_5;c:\program files (x86)\MSI\OverclockingCenter\NTIOLib_X64.sys;c:\program files (x86)\MSI\OverclockingCenter\NTIOLib_X64.sys [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;f:\ntiolib_x64.sys;f:\NTIOLib_X64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 HiSuiteOuc64.exe;HiSuiteOuc64.exe;c:\programdata\HiSuiteOuc\HiSuiteOuc64.exe;c:\programdata\HiSuiteOuc\HiSuiteOuc64.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [x]
S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys;c:\windows\SYSNATIVE\drivers\anvsnddrv.sys [x]
S3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 KYEKBPRO;IMPERATOR PRO Gaming Keyboard;c:\windows\system32\drivers\KYEKBPRO.sys;c:\windows\SYSNATIVE\drivers\KYEKBPRO.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\Martin\AppData\Local\Temp\tmp47E8.tmp;c:\users\Martin\AppData\Local\Temp\tmp47E8.tmp [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWSTM
*NewlyCreated* - WINRING0_1_2_0
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-26 06:25]
.
2014-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 10:04]
.
2014-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA1cec476fb18c5a6.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-09 10:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-01-10 08:52 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-11-26 6325936]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-08 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - ExtSQL: 2013-12-01 15:15; {ea614400-e918-4741-9a97-7a972ff7c30b}; c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
FF - ExtSQL: 2013-12-01 15:17; {97A78363-B868-4B48-AC91-A783A31215AF}; c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0]
"ImagePath"="\??\c:\users\Martin\AppData\Local\Temp\tmp47E8.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e8,e5,c2,07,b5,fc,a1,bd,1c,f1,8e,6d,e7,29,eb,4a,13,d8,77,df,25,4b,dd,
b5,07,86,82,2b,85,fd,ae,e4,0c,6d,aa,30,ce,1b,74,84,fd,0b,4e,94,fe,9b,d6,27,\
"??"=hex:4b,35,b6,67,e4,2f,be,ac,3c,f2,50,a6,83,c3,2d,5e
.
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\License information*]
"datasecu"=hex:1e,88,d3,40,6f,30,c2,30,d7,43,24,49,98,ed,8b,8e,99,89,e4,15,ad,
b6,0e,32,42,90,bc,15,e2,15,1c,48,16,0b,9e,21,91,c8,17,89,9f,5b,c6,44,eb,5e,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-01-10 15:41:19
ComboFix-quarantined-files.txt 2014-01-10 14:41
ComboFix2.txt 2014-01-10 11:49
ComboFix3.txt 2014-01-10 11:28
.
Před spuštěním: Volných bajtů: 60 404 219 904
Po spuštění: Volných bajtů: 60 343 013 376
.
- - End Of File - - 2469833213DB11C527735CD79102FD68
A36C5E4F47E84449FF07ED3517B43A31

MartasZLA · #14 Příspěvek od **MartasZLA** » 10 Led 2014 17:53

Dá se to vůbec nějakým antivirem vyléčit? Už jsem z toho na nervy

#15 Příspěvek od **vyosek** » 10 Led 2014 17:58

Kliiid, ja tu taky nemuzu byt porad. My jsme tu zdarma a ve svem volnem case

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Collect::
c:\windows\core.exe
c:\windows\cpu1.exe
c:\windows\cuda.exe
C:\windows\proxy.exe
C:\windows\ati.exe

File::
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AutoKMS.job
C:\Windows\tasks\AutoKMSDaily.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cec476fb18c5a6.job

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"=-
"uTorrent"=-
"Seznam Postak"=-
"Steam"=-
"cz.seznam.software.autoupdate"=-
"cz.seznam.software.szndesktop"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"=-
"BCSSync"=-
"NvBackend"=-
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"B Register C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax"=-

Driver::
gupdate
gupdatem
SkypeUpdate
WinRing0_1_2_0

Firefox::
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\
FF - ExtSQL: 2013-12-01 15:17; {97A78363-B868-4B48-AC91-A783A31215AF}; c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\81la4hjx.default\extensions\{97A78363-B868-4B48-AC91-A783A31215AF}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000

RegNull::
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[HKEY_USERS\S-1-5-21-4280516896-2141275730-2379777306-1000\Software\SecuROM\License information*]

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

VIRY.CZ

Plné zatížení procesoru a grafické karty

Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty

Re: Plné zatížení procesoru a grafické karty