Cpu1.exe

[Pepasdepa]

Ahoj ahoj,
Hned k problému: Po startnutí PC po chvilce vyskočí tabulka jestli správce povoluje proces cpu1.exe, poté že proces ati.exe neodpovída a ještě jednou to sáme s cuda.exe, pak mi grafika a procesor naběhnou na 100%.
Co jsem už zde četl tak jsem udělal aspoň rkill, nějáké rady dále?


Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/01/2014 10:24:55 AM in x64 mode.
Windows Version: Windows 7 Ultimate Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* c:\windows\core.exe (PID: 2080) [WD-HEUR]
* C:\windows\cuda.exe (PID: 3804) [WD-HEUR]
* C:\windows\proxy.exe (PID: 3504) [WD-HEUR]
* C:\windows\cpu.exe (PID: 324) [WD-HEUR]

4 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* Cannot edit the HOSTS file.
* Permissions could not be fixed. Use Hosts-perm.bat to fix permissions: http://www.bleepingcomputer.com/download/hosts-permbat/

Program finished at: 02/01/2014 10:25:02 AM
Execution time: 0 hours(s), 0 minute(s), and 6 seconds(s)

[Pepasdepa]

Combofix:

ComboFix 14-02-01.01 - Páníšek 01.02.2014 10:42:47.2.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.8167.6228 [GMT 1:00]
Spuštěný z: c:\users\PßnÝÜek\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-01 do 2014-02-01 )))))))))))))))))))))))))))))))
.
.
2014-02-01 09:44 . 2014-02-01 09:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-31 12:31 . 2014-01-31 12:31 -------- d-----w- c:\users\Páníšek\AppData\Roaming\Avira
2014-01-31 12:31 . 2013-12-09 10:37 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-01-31 12:31 . 2013-12-09 10:37 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2014-01-31 12:31 . 2013-12-09 10:37 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-01-31 12:31 . 2013-12-09 10:37 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-01-31 12:31 . 2014-01-31 12:31 -------- d-----w- c:\programdata\Avira
2014-01-31 12:31 . 2014-01-31 12:31 -------- d-----w- c:\program files (x86)\Avira
2014-01-31 11:23 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2014-01-31 11:23 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2014-01-31 11:23 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2014-01-31 11:23 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2014-01-31 11:23 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2014-01-31 11:23 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2014-01-31 11:23 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2014-01-31 11:21 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2014-01-31 11:20 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-01-31 11:20 . 2013-04-17 06:24 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-01-31 11:20 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
2014-01-31 11:20 . 2012-05-05 07:46 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2014-01-31 11:19 . 2011-02-18 10:51 31232 ----a-w- c:\windows\system32\prevhost.exe
2014-01-31 11:19 . 2011-02-18 05:39 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
2014-01-31 11:19 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2014-01-31 11:18 . 2014-01-31 11:18 -------- d-----w- c:\users\Páníšek\AppData\Roaming\MAXON
2014-01-31 11:13 . 2014-01-31 11:13 -------- d-----w- c:\users\Páníšek\AppData\Local\NVIDIA Corporation
2014-01-31 11:13 . 2014-01-31 11:14 -------- d-----w- c:\windows\system32\MRT
2014-01-31 11:12 . 2013-12-10 02:15 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-01-31 11:12 . 2013-12-10 02:14 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2014-01-31 11:12 . 2014-01-31 11:14 -------- d-----w- c:\users\Páníšek\AppData\Local\NVIDIA
2014-01-31 11:11 . 2013-12-19 18:53 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2014-01-31 08:43 . 2014-01-31 08:43 -------- d-----w- c:\program files\CPUID
2014-01-31 08:43 . 2013-12-16 00:54 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1E1E4EE0-58AD-4995-AF52-33141BF6F618}\mpengine.dll
2014-01-30 16:33 . 2014-01-30 16:33 -------- d-----w- c:\users\Páníšek\AppData\Local\The Witcher 2
2014-01-30 16:31 . 2006-03-31 11:40 352464 ----a-w- c:\windows\system32\xactengine2_1.dll
2014-01-30 15:53 . 2014-01-30 16:05 -------- d-----w- c:\program files (x86)\The Witcher 2 (CZ)
2014-01-29 09:13 . 2014-01-29 09:13 -------- d-----w- c:\users\Páníšek\AppData\Roaming\WinRAR
2014-01-28 19:45 . 2014-01-28 19:46 -------- d-----w- c:\users\Páníšek\AppData\Roaming\.technic
2014-01-28 18:24 . 2014-01-29 09:13 -------- d-----w- c:\program files (x86)\CarMechanic
2014-01-22 17:18 . 2014-01-22 17:36 -------- d-----w- c:\users\Páníšek\AppData\Roaming\BitTorrent
2014-01-22 15:33 . 2014-01-22 15:33 -------- d-----w- c:\program files (x86)\PFPortChecker
2014-01-21 19:24 . 2014-01-21 19:24 -------- d-----w- c:\users\Petan
2014-01-15 16:01 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 16:01 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 16:01 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 16:01 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 16:01 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 16:01 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 16:01 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 16:01 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-13 19:12 . 2014-01-13 19:12 312744 ----a-w- c:\windows\system32\javaws.exe
2014-01-13 19:12 . 2014-01-13 19:12 189352 ----a-w- c:\windows\system32\javaw.exe
2014-01-13 19:12 . 2014-01-13 19:12 189352 ----a-w- c:\windows\system32\java.exe
2014-01-13 19:12 . 2014-01-13 19:12 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-01-13 19:12 . 2014-01-13 19:12 -------- d-----w- c:\program files\Java
2014-01-06 20:18 . 2014-01-28 15:11 -------- d-----w- c:\users\Páníšek\AppData\Roaming\NVIDIA
2014-01-06 19:56 . 2014-01-28 18:45 -------- d-----w- c:\users\Páníšek\AppData\Roaming\.minecraft
2014-01-06 19:56 . 2014-01-13 19:12 -------- d-----w- c:\programdata\Oracle
2014-01-06 19:56 . 2014-01-06 19:56 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-01-06 19:56 . 2014-01-06 19:56 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-06 19:56 . 2014-01-06 19:56 -------- d-----w- c:\program files (x86)\Java
2014-01-06 19:15 . 2014-01-06 19:15 -------- d-----w- c:\programdata\T-Mobile
2014-01-06 19:14 . 2014-01-15 20:17 -------- d-----w- c:\programdata\{CC71B1CB-A2E4-4CF7-8EDB-A0E290BA1604}
2014-01-06 19:14 . 2014-01-06 19:14 -------- d-----w- c:\users\Páníšek\AppData\Roaming\T-Mobile
2014-01-06 19:14 . 2014-01-06 19:14 -------- d-----w- c:\program files (x86)\T-Mobile
2014-01-06 19:14 . 2014-01-06 19:14 -------- d-----w- c:\users\Páníšek\AppData\Roaming\Razer
2014-01-06 19:14 . 2014-01-06 19:14 -------- d-----w- c:\programdata\Gemfor
2014-01-06 19:10 . 2014-01-06 19:10 -------- d-----w- c:\programdata\Razer
2014-01-06 19:09 . 2009-10-16 20:09 29952 ----a-w- c:\windows\system32\drivers\Lachesis.sys
2014-01-06 19:09 . 2014-01-06 19:09 -------- d-----w- c:\program files (x86)\Razer
2014-01-05 17:45 . 2014-01-05 17:45 -------- d-----w- c:\windows\system32\wbem\Framework
2014-01-05 14:56 . 2014-01-05 14:56 -------- d-----w- c:\users\Páníšek\AppData\Local\Programs
2014-01-05 14:48 . 2014-01-05 14:48 -------- d-----w- c:\program files (x86)\DAEMON Tools Toolbar
2014-01-05 14:48 . 2014-01-05 14:48 834544 ----a-w- c:\windows\system32\drivers\sptd.sys
2014-01-05 14:48 . 2014-01-05 14:48 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2014-01-05 14:47 . 2014-01-05 14:54 -------- d-----w- c:\users\Páníšek\AppData\Roaming\DAEMON Tools Lite
2014-01-05 14:47 . 2014-01-05 14:47 -------- d-----w- c:\programdata\DAEMON Tools Lite
2014-01-03 14:08 . 2014-01-03 14:08 1050112 ----a-w- c:\windows\core.exe
2014-01-03 14:05 . 2014-01-03 14:05 190284 ----a-w- c:\windows\cpu1.exe
2014-01-02 11:36 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2014-01-02 11:33 . 2014-01-02 11:33 327168 ----a-w- c:\windows\system32\mswsock.dll
2014-01-02 11:33 . 2014-01-02 11:33 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2014-01-02 11:33 . 2014-01-02 11:33 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-02 11:34 . 2014-01-02 11:34 243200 ----a-w- c:\windows\system32\webcheck.dll
2014-01-02 11:34 . 2014-01-02 11:34 208384 ----a-w- c:\windows\SysWow64\webcheck.dll
2014-01-02 11:34 . 2014-01-02 11:34 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-12-31 14:52 . 2013-12-31 14:52 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2013-12-31 14:52 . 2013-12-31 14:52 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2013-12-31 14:52 . 2013-12-31 14:52 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-12-31 14:52 . 2013-12-31 14:52 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3928064 ----a-w- c:\windows\system32\d2d1.dll
2013-12-31 14:52 . 2013-12-31 14:52 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2013-12-31 14:52 . 2013-12-31 14:52 363008 ----a-w- c:\windows\system32\dxgi.dll
2013-12-31 14:52 . 2013-12-31 14:52 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll
2013-12-31 14:52 . 2013-12-31 14:52 333312 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-12-31 14:52 . 2013-12-31 14:52 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 296960 ----a-w- c:\windows\system32\d3d10core.dll
2013-12-31 14:52 . 2013-12-31 14:52 293376 ----a-w- c:\windows\SysWow64\dxgi.dll
2013-12-31 14:52 . 2013-12-31 14:52 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2013-12-31 14:52 . 2013-12-31 14:52 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2013-12-31 14:52 . 2013-12-31 14:52 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
2013-12-31 14:52 . 2013-12-31 14:52 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2013-12-31 14:52 . 2013-12-31 14:52 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2013-12-31 14:52 . 2013-12-31 14:52 221184 ----a-w- c:\windows\system32\UIAnimation.dll
2013-12-31 14:52 . 2013-12-31 14:52 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll
2013-12-31 14:52 . 2013-12-31 14:52 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll
2013-12-31 14:52 . 2013-12-31 14:52 1988096 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2013-12-31 14:52 . 2013-12-31 14:52 194560 ----a-w- c:\windows\system32\d3d10_1.dll
2013-12-31 14:52 . 2013-12-31 14:52 187392 ----a-w- c:\windows\SysWow64\UIAnimation.dll
2013-12-31 14:52 . 2013-12-31 14:52 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
2013-12-31 14:52 . 2013-12-31 14:52 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-12-31 14:52 . 2013-12-31 14:52 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2013-12-31 14:52 . 2013-12-31 14:52 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-12-31 14:52 . 2013-12-31 14:52 1238528 ----a-w- c:\windows\system32\d3d10.dll
2013-12-31 14:52 . 2013-12-31 14:52 1175552 ----a-w- c:\windows\system32\FntCache.dll
2013-12-31 14:52 . 2013-12-31 14:52 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2013-12-31 14:52 . 2013-12-31 14:52 1080832 ----a-w- c:\windows\SysWow64\d3d10.dll
2013-12-31 14:52 . 2013-12-31 14:52 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-31 14:52 . 2013-12-31 14:52 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-31 14:51 . 2013-12-31 14:51 1887232 ----a-w- c:\windows\system32\d3d11.dll
2013-12-31 14:51 . 2013-12-31 14:51 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2013-12-31 11:28 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2013-12-31 11:28 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2013-12-19 20:33 . 2013-12-30 11:12 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-12-19 20:33 . 2013-12-30 11:12 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-12-19 20:33 . 2013-12-30 10:53 9700224 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-12-19 20:33 . 2013-12-30 10:53 3071656 ----a-w- c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2013-12-30 10:53 2698272 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-12-19 20:33 . 2013-12-30 10:53 18310112 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-12-19 20:33 . 2013-12-30 10:53 15230352 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-12-19 20:33 . 2013-12-30 10:53 1436528 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-12-19 18:53 . 2013-12-30 11:12 6671648 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2013-12-30 11:12 3490080 ----a-w- c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2013-12-30 11:12 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2013-12-30 11:12 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-12-19 18:53 . 2013-12-30 11:12 386336 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 11:20 . 2013-12-19 11:20 590112 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-12-19 05:01 . 2013-12-30 11:12 3539040 ----a-w- c:\windows\system32\nvcoproc.bin
2013-12-18 05:13 . 2013-12-29 19:14 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-05 08:42 . 2013-12-30 10:53 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-11-30 06:43 . 2013-11-30 06:43 478208 ----a-w- c:\windows\ati.exe
2013-11-30 06:43 . 2013-11-30 06:43 348672 ----a-w- c:\windows\curl.dll
2013-11-30 06:43 . 2013-11-30 06:43 82432 ----a-w- c:\windows\pthread.dll
2013-11-28 16:03 . 2013-11-28 16:03 4346744 ----a-w- c:\windows\proxy.exe
2013-11-21 21:45 . 2013-11-21 21:45 4422144 ----a-w- c:\windows\cuda.exe
2013-11-14 11:55 . 2013-12-30 10:53 1510176 ----a-w- c:\windows\system32\nvhdagenco64.dll
2013-11-14 11:55 . 2013-12-30 10:53 1884448 ----a-w- c:\windows\system32\nvdispco6433182.dll
2013-11-14 11:55 . 2013-12-30 10:53 1511712 ----a-w- c:\windows\system32\nvdispgenco6433182.dll
2013-11-12 02:23 . 2013-12-31 13:07 2048 ----a-w- c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-31 13:07 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"T-Mobile CManager"="c:\program files (x86)\T-Mobile\Web'n'walk Manager\Manager.exe" [2013-10-31 2166552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"Lachesis"="c:\program files (x86)\Razer\Lachesis\razerhid.exe" [2009-11-10 248320]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MbnExt;Mobile Broadband Extension Service;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\KMPService.exe;c:\program files (x86)\PANDORA.TV\PanService\KMPService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys;c:\windows\SYSNATIVE\drivers\Lachesis.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
MbnExt REG_MULTI_SZ MbnExt
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-29 09:53 1211672 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.102\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 18:41]
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 18:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: WikiKomentáře Google... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{B561BA22-B536-4BC8-81B9-F0916FC35E8D}: NameServer = 93.153.117.1 93.153.117.33
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-02-01 10:45:24
ComboFix-quarantined-files.txt 2014-02-01 09:45
ComboFix2.txt 2014-02-01 09:32
.
Před spuštěním: Volných bajtů: 292 035 760 128
Po spuštění: Volných bajtů: 291 596 341 248
.
- - End Of File - - 019A972C955BAF705202CC873ADA242F
A36C5E4F47E84449FF07ED3517B43A31

[vyosek]

Zdravim

Moc jste toho neprecetl, ale k tomu se dostaneme

Jen se zeptam pouzivate legalni operacni system, nejvyssi licence Ultimate zrovna neni bezna doamci verze

:arrow:Co se tyce ComboFixu, ktery jste pouzil, tak na zaklade licence a pravidel fora ptam, umite s nim pracovat (spusteni, rozlusteni logu, napsani skriptu)?

Licencni podminky ComboFixu hovori jasne "Nikdy by nemel byt pouzit v prostredi bez dozoru zkusene osoby"


Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

[Pepasdepa]

To se omlouvám, byl jsem hrr, chci se toho co nejdříve zbavit a vám sem nechtěl brát zbytečný čas, nakonec to bude naopak.
Upřímně, legální windows nemám.
Omlouvám se tedy za porušení zdejších pravidel.

[vyosek]

Ten ComboFix bych jeste prekousnul, ale nelegalni windows nikoli. Pravidla fora a charat mezinarodni aliance ASAP jejiz jsme cleny hovori jasne - nepodporuje piratsky SW a tim pachani trestneho cinu.

Je mi lito...