Nelze nainstalovat žádný funkční antivir

Zpráva

bobikwc40 · #1 Příspěvek od **bobikwc40** » 27 bře 2014 11:00

Zdravím vás po letech mé nepřítomnosti,
bohužel se musím obrátit na vás a požádat vás o pomoc.

Nejsem schopen nainstalovat žádný funkční free antivirus. Bohužel jsem si toho všiml až dnes, že AV nefunguje. Zkoušel jsem AVG, AVAST, AVIRA a pokaždé, když je nainstaluji -nefunguje rezidentní štít i ostatní štíty například v AVASTu, nelze spustit aktualizace, u AVASTu konkrétně mimo nouzový režim nelze spustit ani test počítače. V nastavení se vše tváří, že je povoleno, ale stav AV hlásí, že nefunguje defacto nic a nelze žádnou část AV spustit.
Spustil jsem v nouzovém režimu test a našel pouze nějaké dva rootkity, byly smazány, podle všeho. CCleanerem jsem opravil registry, vyčistil počítač, pokoušel se i hledat na uncle google, ale bohužel aztím bez výsledku.

Poslední, co jsem s PC dělal byla výměna HDD za SSD a přemístění OS. Jednou se objevil policejní virus, ale byla to asi nějaká lehčí verze a po ukončení v task manageru a restartu zmizel.

Btw, doufám, že je téma správně ve fóru AV, kdyžtak jej přesunte prosím.

Děkuji předem za pomoc

#2 Příspěvek od **vyosek** » 27 bře 2014 11:02

Zdravim

Mrknem co vse tam mate a jestli se nam nekde neco neskryva

Poprosim o log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784

Stahnete SecurityCheck http://screen317.spywareinfoforum.org/SecurityCheck.exe

Ulozte nejlepe na Plochu
Spustte tradicne dvouklikem a postupujte dle pokynu utility
Po dokonceni skenu se vytvori a otevre log, ten mi sem vlozte

bobikwc40 · #3 Příspěvek od **bobikwc40** » 27 bře 2014 11:10

Logfile of random's system information tool 1.09 (written by random/random)
Run by Robin at 2014-03-27 11:11:26
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 44 GB (38%) free of 114 GB
Total RAM: 3325 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:12:31, on 27.3.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16736)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Canon\Solution Menu EX\CNSEUPDT.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Program Files\AVAST Software\Avast\avastUi.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Opera\20.0.1387.82\opera.exe
C:\Users\Robin\Desktop\RSIT.exe
C:\Program Files\trend micro\Robin.exe
C:\Users\Robin\Desktop\SecurityCheck.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conhost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [ShadowPlay] C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Cadence License Manager - Flexera Software, Inc. - C:\Cadence\LicenseManager\lmgrd.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--
End of file - 7406 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-11-08 202144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-03-27 597816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-11-08 1619352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2011-03-14 2565520]
"CanonSolutionMenuEx"=C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [2011-08-04 1612920]
"IJNetworkScannerSelectorEX"=C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [2011-01-15 452016]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2013-03-29 11930696]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]
"ShadowPlay"=C:\Windows\system32\nvspcap.dll [2013-12-10 982232]
"itype"=C:\Program Files\Microsoft IntelliType Pro\itype.exe [2011-08-10 1313640]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-03-27 3854640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-07-04 148776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-03-14 3672640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM tray]
C:\Program Files\EaseUS\EaseUS Partition Master 9.3.0\bin\EpmNews.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-07-04 161064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nvtmru]
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [2013-07-03 1028896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]
C:\Program Files\AVG SafeGuard toolbar\vprot.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"[INSTALLDIR]64b\lmgrd.exe"="[INSTALLDIR]64b\lmgrd.exe:*:Enabled:lmgrd.exe (CadenceLicenseManager)"
"[INSTALLDIR]64b\lmtools.exe"="[INSTALLDIR]64b\lmtools.exe:*:Enabled:lmtools.exe (CadenceLicenseManager)"
"[INSTALLDIR]64b\lmutil.exe"="[INSTALLDIR]64b\lmutil.exe:*:Enabled:lmutil.exe (CadenceLicenseManager)"
"[INSTALLDIR]CKOUT.exe"="[INSTALLDIR]CKOUT.exe:*:Enabled:CKOUT.exe (CadenceLicenseManager)"
"[INSTALLDIR]NEOLINLD.exe"="[INSTALLDIR]NEOLINLD.exe:*:Enabled:NEOLINLD.exe (CadenceLicenseManager)"
"[INSTALLDIR]alta.exe"="[INSTALLDIR]alta.exe:*:Enabled:alta.exe (CadenceLicenseManager)"
"[INSTALLDIR]ambitd.exe"="[INSTALLDIR]ambitd.exe:*:Enabled:ambitd.exe (CadenceLicenseManager)"
"[INSTALLDIR]axislmd.exe"="[INSTALLDIR]axislmd.exe:*:Enabled:axislmd.exe (CadenceLicenseManager)"
"[INSTALLDIR]cadmosd.exe"="[INSTALLDIR]cadmosd.exe:*:Enabled:cadmosd.exe (CadenceLicenseManager)"
"[INSTALLDIR]cdslmd.exe"="[INSTALLDIR]cdslmd.exe:*:Enabled:cdslmd.exe (CadenceLicenseManager)"
"[INSTALLDIR]dailmd.exe"="[INSTALLDIR]dailmd.exe:*:Enabled:dailmd.exe (CadenceLicenseManager)"
"[INSTALLDIR]dsmtlmd.exe"="[INSTALLDIR]dsmtlmd.exe:*:Enabled:dsmtlmd.exe (CadenceLicenseManager)"
"[INSTALLDIR]flexid\FLEXId_Dongle_Driver_Installer.exe"="[INSTALLDIR]flexid\FLEXId_Dongle_Driver_Installer.exe:*:Enabled:FLEXId_Dongle_Driver_Installer.exe (CadenceLicenseManager)"
"[INSTALLDIR]g2c_d.exe"="[INSTALLDIR]g2c_d.exe:*:Enabled:g2c_d.exe (CadenceLicenseManager)"
"[INSTALLDIR]hlds.exe"="[INSTALLDIR]hlds.exe:*:Enabled:hlds.exe (CadenceLicenseManager)"
"[INSTALLDIR]installs.exe"="[INSTALLDIR]installs.exe:*:Enabled:installs.exe (CadenceLicenseManager)"
"[INSTALLDIR]k2techld.exe"="[INSTALLDIR]k2techld.exe:*:Enabled:k2techld.exe (CadenceLicenseManager)"
"[INSTALLDIR]lmCheckExpiration.exe"="[INSTALLDIR]lmCheckExpiration.exe:*:Enabled:lmCheckExpiration.exe (CadenceLicenseManager)"
"[INSTALLDIR]lmgrd.exe"="[INSTALLDIR]lmgrd.exe:*:Enabled:lmgrd.exe (CadenceLicenseManager)"
"[INSTALLDIR]lmtools.exe"="[INSTALLDIR]lmtools.exe:*:Enabled:lmtools.exe (CadenceLicenseManager)"
"[INSTALLDIR]lmutil.exe"="[INSTALLDIR]lmutil.exe:*:Enabled:lmutil.exe (CadenceLicenseManager)"
"[INSTALLDIR]perf_test.exe"="[INSTALLDIR]perf_test.exe:*:Enabled:perf_test.exe (CadenceLicenseManager)"
"[INSTALLDIR]platod.exe"="[INSTALLDIR]platod.exe:*:Enabled:platod.exe (CadenceLicenseManager)"
"[INSTALLDIR]qtdaemon.exe"="[INSTALLDIR]qtdaemon.exe:*:Enabled:qtdaemon.exe (CadenceLicenseManager)"
"[INSTALLDIR]qtrekd.exe"="[INSTALLDIR]qtrekd.exe:*:Enabled:qtrekd.exe (CadenceLicenseManager)"
"[INSTALLDIR]simplexlmd.exe"="[INSTALLDIR]simplexlmd.exe:*:Enabled:simplexlmd.exe (CadenceLicenseManager)"
"[INSTALLDIR]spdaemon.exe"="[INSTALLDIR]spdaemon.exe:*:Enabled:spdaemon.exe (CadenceLicenseManager)"
"[INSTALLDIR]speedd.exe"="[INSTALLDIR]speedd.exe:*:Enabled:speedd.exe (CadenceLicenseManager)"
"[INSTALLDIR]verisityd.exe"="[INSTALLDIR]verisityd.exe:*:Enabled:verisityd.exe (CadenceLicenseManager)"
"[INSTALLDIR]verplex.exe"="[INSTALLDIR]verplex.exe:*:Enabled:verplex.exe (CadenceLicenseManager)"
"[INSTALLDIR]LicenseClientConfiguration.exe"="[INSTALLDIR]LicenseClientConfiguration.exe:*:Enabled:LicenseClientConfiguration.exe (CadenceLicenseManager)"
"[INSTALLDIR]LicenseServerConfiguration.exe"="[INSTALLDIR]LicenseServerConfiguration.exe:*:Enabled:LicenseServerConfiguration.exe (CadenceLicenseManager)"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"VIDC.FFDS"=C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-03-27 11:11:26 ----D---- C:\rsit
2014-03-27 11:11:26 ----D---- C:\Program Files\trend micro
2014-03-27 10:57:15 ----D---- C:\Users\Robin\AppData\Roaming\AVAST Software
2014-03-27 10:55:55 ----A---- C:\Windows\system32\drivers\aswStm.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswSP.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2014-03-27 10:55:54 ----A---- C:\Windows\system32\aswBoot.exe
2014-03-27 10:55:54 ----A---- C:\Windows\avastSS.scr
2014-03-27 10:55:27 ----D---- C:\Program Files\AVAST Software
2014-03-27 10:49:55 ----D---- C:\Program Files\CCleaner
2014-03-27 10:44:41 ----D---- C:\Program Files\Your Uninstaller! 7
2014-03-27 10:44:34 ----D---- C:\Users\Robin\AppData\Roaming\URSoft
2014-03-27 10:44:34 ----AD---- C:\ProgramData\TEMP
2014-03-27 10:03:45 ----D---- C:\OETemp
2014-03-27 09:56:04 ----D---- C:\ProgramData\AVAST Software
2014-03-27 09:48:07 ----SHD---- C:\Config.Msi
2014-03-19 10:57:13 ----D---- C:\Program Files\Mozilla Thunderbird
2014-03-06 11:23:15 ----A---- C:\Windows\system32\drivers\58252a2db285f13c.sys
2014-03-04 22:10:32 ----D---- C:\Users\Robin\AppData\Roaming\Opera Software
2014-03-03 09:10:40 ----D---- C:\Program Files\XPS to JPG

======List of files/folders modified in the last 1 month======

2014-03-27 11:11:26 ----RD---- C:\Program Files
2014-03-27 10:56:15 ----D---- C:\Windows\inf
2014-03-27 10:55:59 ----D---- C:\Windows\system32\Tasks
2014-03-27 10:55:55 ----D---- C:\Windows\system32\drivers
2014-03-27 10:55:54 ----D---- C:\Windows\System32
2014-03-27 10:55:54 ----AD---- C:\Windows
2014-03-27 10:55:27 ----SHD---- C:\System Volume Information
2014-03-27 10:52:32 ----D---- C:\ProgramData\NVIDIA
2014-03-27 10:52:07 ----D---- C:\Windows\system32\catroot2
2014-03-27 10:51:59 ----D---- C:\Users\Robin\AppData\Roaming\uTorrent
2014-03-27 10:51:38 ----D---- C:\Users\Robin\AppData\Roaming\TS3Client
2014-03-27 10:51:38 ----D---- C:\Users\Robin\AppData\Roaming\Media Player Classic
2014-03-27 10:51:38 ----D---- C:\Users\Robin\AppData\Roaming\DAEMON Tools Lite
2014-03-27 10:51:38 ----D---- C:\Users\Robin\AppData\Roaming\AIMP3
2014-03-27 10:51:38 ----D---- C:\Program Files\Steam
2014-03-27 10:51:36 ----D---- C:\Windows\Temp
2014-03-27 10:51:36 ----D---- C:\Windows\SoftwareDistribution
2014-03-27 10:51:36 ----D---- C:\Windows\Logs
2014-03-27 10:44:34 ----HD---- C:\ProgramData
2014-03-27 09:57:37 ----D---- C:\Windows\winsxs
2014-03-27 09:56:31 ----SHD---- C:\Windows\Installer
2014-03-27 09:50:57 ----D---- C:\ProgramData\MFAData
2014-03-27 09:50:57 ----D---- C:\ProgramData\AVG2014
2014-03-27 09:48:07 ----D---- C:\Windows\system32\catroot
2014-03-26 23:08:39 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-03-26 21:42:21 ----D---- C:\Users\Robin\AppData\Roaming\Skype
2014-03-22 21:48:41 ----D---- C:\Users\Robin\AppData\Roaming\vlc
2014-03-22 21:33:05 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-03-21 09:03:03 ----D---- C:\Program Files\Opera
2014-03-20 15:18:29 ----D---- C:\Windows\system32\config
2014-03-19 17:58:24 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-03-16 12:39:53 ----A---- C:\Windows\Capture.INI
2014-03-13 11:53:32 ----D---- C:\ProgramData\Microsoft Help
2014-03-12 23:00:30 ----SD---- C:\Users\Robin\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-05-30 242240]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver; \??\C:\Windows\system32\drivers\HWiNFO32.SYS [2013-12-20 22560]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 dc3d;MS Hardware Device Detection Driver (USB); C:\Windows\system32\DRIVERS\dc3d.sys [2011-08-10 45288]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2013-03-29 2646088]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2013-11-28 162592]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad32v.sys [2013-12-05 34080]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
S0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-03-27 49944]
S0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-03-27 180760]
S1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-03-27 81768]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-03-27 776976]
S1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-03-27 411552]
S2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-03-27 67824]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 AIDA64Driver;FinalWire AIDA64 Kernel Driver; \??\C:\Program Files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [2013-01-28 31128]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-03-27 67264]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTCFilterService;USB Networking Driver Filter Service; C:\Windows\system32\DRIVERS\motfilt.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 motccgp;Motorola USB Composite Device Driver; C:\Windows\system32\DRIVERS\motccgp.sys []
S3 motccgpfl;MotCcgpFlService; C:\Windows\system32\DRIVERS\motccgpfl.sys []
S3 motmodem;Motorola USB CDC ACM Driver; C:\Windows\system32\DRIVERS\motmodem.sys []
S3 MotoSwitchService;MotoSwitch Service; C:\Windows\system32\DRIVERS\motswch.sys []
S3 Motousbnet;Motorola USB Networking Driver Service; C:\Windows\system32\DRIVERS\Motousbnet.sys []
S3 motusbdevice;Motorola USB Dev Driver; C:\Windows\system32\DRIVERS\motusbdevice.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2013-11-15 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-11-15 49664]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-11-15 27136]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 Cadence License Manager;Cadence License Manager; C:\Cadence\LicenseManager\lmgrd.exe [2011-02-02 1379664]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 14658848]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-12-19 664352]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-12-19 411936]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 1713904]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-03-27 50344]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-27 116648]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-27 116648]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-06-02 1343400]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-19 257928]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-03-19 119408]
S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 nlsX86cc;Nalpeiron Licensing Service; C:\Windows\system32\nlssrv32.exe [2012-07-05 66560]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-07-04 267560]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-09-05 171680]
S4 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-11-19 489256]

-----------------EOF-----------------

bobikwc40 · #4 Příspěvek od **bobikwc40** » 27 bře 2014 11:10

Results of screen317's Security Check version 0.99.81
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
AVG AntiVirus Free Edition 2014
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java 7 Update 45
Java version out of Date!
Adobe Flash Player 12.0.0.77
Adobe Reader XI
Mozilla Thunderbird (24.4.0)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast avastUi.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

bobikwc40 · #5 Příspěvek od **bobikwc40** » 27 bře 2014 11:11

Ted vidím ze security checku, že těch bezpečnostních mezer bude povícero, dám se do jejich napravení. Pokud to půjde...

--- aktualizace - ani windows update nelze spustit...ani po restartu

#6 Příspěvek od **vyosek** » 27 bře 2014 11:19

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

bobikwc40 · #7 Příspěvek od **bobikwc40** » 27 bře 2014 11:46

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 03/27/2014 11:52:25 AM in x86 mode.
Windows Version: Windows 7 Professional Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* Centrum zabezpečení (wscsvc) is not Running.
Startup Type set to: Disabled

* Centrum zabezpečení (wuauserv) is not Running.
Startup Type set to: Disabled

Searching for Missing Digital Signatures:

#8 Příspěvek od **vyosek** » 27 bře 2014 11:50

Pokracujte ComboFixem

bobikwc40 · #9 Příspěvek od **bobikwc40** » 27 bře 2014 11:56

ComboFix 14-03-24.01 - Robin 27.03.2014 11:56:21.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3325.2834 [GMT 1:00]
Spuštěný z: c:\users\Robin\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\58252a2db285f13c.sys
.
Nakažená kopie c:\windows\system32\Drivers\Volsnap.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volsnap.sys
Nakažená kopie c:\windows\system32\drivers\AGP440.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
Nakažená kopie c:\windows\system32\drivers\asyncmac.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\winsxs\x86_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.1.7600.16385_none_242e2506962cd3e0\asyncmac.sys
Nakažená kopie c:\windows\system32\drivers\cdrom.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.sys
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_58252a2db285f13c
-------\Service_58252a2db285f13c
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-27 do 2014-03-27 )))))))))))))))))))))))))))))))
.
.
2014-03-27 10:59 . 2014-03-27 11:01 -------- d-----w- c:\users\Robin\AppData\Local\temp
2014-03-27 10:44 . 2014-03-04 11:32 599840 ----a-w- c:\windows\system32\nvStreaming.exe
2014-03-27 10:44 . 2014-03-04 12:34 4348704 ----a-w- c:\windows\system32\nvcpl.dll
2014-03-27 10:44 . 2014-03-04 12:34 3044696 ----a-w- c:\windows\system32\nvsvc.dll
2014-03-27 10:44 . 2014-03-04 12:34 663896 ----a-w- c:\windows\system32\nvvsvc.exe
2014-03-27 10:44 . 2014-03-04 12:34 62752 ----a-w- c:\windows\system32\nvshext.dll
2014-03-27 10:44 . 2014-03-04 12:34 2556360 ----a-w- c:\windows\system32\nvsvcr.dll
2014-03-27 10:44 . 2014-03-04 12:34 375128 ----a-w- c:\windows\system32\nvmctray.dll
2014-03-27 10:44 . 2014-03-04 05:35 3649185 ----a-w- c:\windows\system32\nvcoproc.bin
2014-03-27 10:44 . 2014-03-04 14:29 53024 ----a-w- c:\windows\system32\OpenCL.dll
2014-03-27 10:37 . 2014-03-27 10:37 -------- d-----w- c:\program files\AGEIA Technologies
2014-03-27 10:35 . 2014-03-04 14:29 10523480 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2014-03-27 10:22 . 2014-03-27 10:22 -------- d-----w- C:\NVIDIA
2014-03-27 10:11 . 2014-03-27 10:12 -------- d-----w- C:\rsit
2014-03-27 10:11 . 2014-03-27 10:12 -------- d-----w- c:\program files\trend micro
2014-03-27 09:57 . 2014-03-27 09:57 -------- d-----w- c:\users\Robin\AppData\Roaming\AVAST Software
2014-03-27 09:55 . 2014-03-27 09:55 67264 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-03-27 09:55 . 2014-03-27 09:55 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-03-27 09:55 . 2014-03-27 09:55 776976 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-03-19 09:57 . 2014-03-27 09:49 -------- d-----w- c:\program files\Mozilla Thunderbird
2014-03-04 21:10 . 2014-03-04 21:10 -------- d-----w- c:\users\Robin\AppData\Roaming\Opera Software
2014-03-04 21:10 . 2014-03-04 21:10 -------- d-----w- c:\users\Robin\AppData\Local\Opera Software
2014-03-03 08:10 . 2014-03-03 08:10 -------- d-----w- c:\program files\XPS to JPG
2014-02-27 09:19 . 2014-02-27 09:19 -------- d-----w- c:\programdata\RELOADED
2014-02-27 08:56 . 2014-02-27 08:56 -------- d-----w- c:\program files\1C Company
2014-02-25 21:05 . 2014-02-25 21:05 -------- d-----w- c:\users\Robin\AppData\Local\World in Conflict
2014-02-25 20:59 . 2014-02-25 20:59 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2014-02-25 20:59 . 2014-02-25 20:59 -------- d--h--r- c:\users\Robin\AppData\Roaming\SecuROM
2014-02-25 20:54 . 2007-03-15 15:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2014-02-25 20:54 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
2014-02-25 20:54 . 2007-03-12 15:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2014-02-25 20:54 . 2006-11-29 12:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2014-02-25 20:54 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2014-02-25 20:54 . 2014-02-25 20:54 -------- d-----w- c:\programdata\Media Center Programs
2014-02-25 20:53 . 2014-02-25 20:53 -------- d-----w- c:\program files\Sierra Entertainment
2014-02-25 20:52 . 2014-02-25 20:52 -------- d-----w- c:\users\Robin\AppData\Roaming\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-19 16:58 . 2013-05-30 18:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-19 16:58 . 2013-05-30 18:27 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-03-27 09:55 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-14 2565520]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-03-29 11930696]
"NvBackend"="c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap.dll" [2013-12-10 982232]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-03-27 3854640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-11-21 16:57 959904 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-07-04 13:01 148776 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2013-03-14 08:23 3672640 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-07-04 13:20 161064 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nvtmru]
2013-07-03 21:39 1028896 ----a-w- c:\program files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-07-02 07:16 254336 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWRVRT
*NewlyCreated* - ASWSNX
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWSTM
*NewlyCreated* - ASWVMM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\SPB_16.5]
2011-04-14 07:47 930 ----a-w- c:\cadence\SPB_16.5\tools\ConfigUtility\CreateShortcut.vbs
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-30 16:58]
.
2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-27 12:40]
.
2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-27 12:40]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.2.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-EaseUS EPM tray - c:\program files\EaseUS\EaseUS Partition Master 9.3.0\bin\EpmNews.exe
MSConfigStartUp-vProt - c:\program files\AVG SafeGuard toolbar\vprot.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AIDA64Driver]
"ImagePath"="\??\c:\program files\FinalWire\AIDA64 Extreme Edition\kerneld.x32"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3876280091-2513157152-1840497086-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ae,94,19,67,00,f0,05,eb,1d,93,2e,e0,c2,4d,62,11,bf,f3,f8,9e,11,e3,25,
f8,57,f8,e8,26,89,9d,88,0d,99,5e,15,5e,04,ae,a2,fb,2d,9c,2e,3a,29,46,43,72,\
"??"=hex:8e,d7,f1,31,77,85,e6,95,c8,5f,35,52,cf,c7,c8,7d
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5304)
c:\program files\Common Files\Ahead\Lib\MediaLibraryNSE.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\cadence\LicenseManager\lmgrd.exe
c:\windows\system32\conhost.exe
c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe
c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
c:\windows\system32\conhost.exe
c:\cadence\LicenseManager\lmgrd.exe
c:\cadence\LicenseManager\cdslmd.exe
c:\windows\system32\PrintIsolationHost.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Canon\Solution Menu EX\CNSEUPDT.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2014-03-27 12:02:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-27 11:02
.
Před spuštěním: Volných bajtů: 43 087 114 240
Po spuštění: Volných bajtů: 42 548 150 272
.
- - End Of File - - 0CD797E9331794089AD9684657EA6C5D
A36C5E4F47E84449FF07ED3517B43A31

bobikwc40 · #10 Příspěvek od **bobikwc40** » 27 bře 2014 11:59

Všechno již nabíhá, Windows Update, i AVAST. Tak se zdá, že je vše vyřešeno.
Já mnohokrát děkuji za rychlou a účinnou pomoc, nemám ji bohužel jak oplatit, kromě díků.

P.S. Nevíte co to bylo za potvoru? O něčem, co zabalokuje snad všechno a nakonec i ovladač grafické karty jsem neslyšel či dostatečně nehledal...

#11 Příspěvek od **vyosek** » 27 bře 2014 12:09

Jeste tam s dovolenim drobne upravy a korekce udelame

Jinak byly nakazene systemove soubory a nejake rootkity se tam ukryvaly

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

SecCenter::
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
{0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
{B5F5C120-2089-702E-0001-553BB0D5A664}

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nvtmru]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

RegNull::
[HKEY_USERS\S-1-5-21-3876280091-2513157152-1840497086-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

File::
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

Folder::
C:\Program Files\AVG SafeGuard toolbar
C:\ProgramData\MFAData
C:\ProgramData\AVG2014

Collect::
C:\Windows\system32\drivers\58252a2db285f13c.sys

Rootkit::
C:\Windows\system32\drivers\58252a2db285f13c.sys

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

bobikwc40 · #12 Příspěvek od **bobikwc40** » 27 bře 2014 12:36

Klidně i bez dovolení

, zdálo se mi, že hlavní část práce je za námi, proto ty díky.

ComboFix 14-03-24.01 - Robin 27.03.2014 12:21:36.2.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3325.2115 [GMT 1:00]
Spuštěný z: c:\users\Robin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Robin\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\AVG2014
c:\programdata\AVG2014\$AVG\$VAULT\vault.db
c:\programdata\MFAData
c:\programdata\MFAData\avibackup\iavichjw.avm
c:\programdata\MFAData\avibackup\incavi.avm
c:\programdata\MFAData\public_installation_log.xml
c:\programdata\MFAData\uninstall
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-27 do 2014-03-27 )))))))))))))))))))))))))))))))
.
.
2014-03-27 11:26 . 2014-03-27 11:40 -------- d-----w- c:\users\Robin\AppData\Local\temp
2014-03-27 11:26 . 2014-03-27 11:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-27 11:14 . 2013-12-04 02:03 87040 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2014-03-27 11:14 . 2013-12-04 02:03 87040 ----a-w- c:\windows\system32\secproc_ssp.dll
2014-03-27 11:14 . 2013-12-04 02:03 423936 ----a-w- c:\windows\system32\secproc_isv.dll
2014-03-27 11:14 . 2013-12-04 02:03 428032 ----a-w- c:\windows\system32\secproc.dll
2014-03-27 11:14 . 2013-12-04 02:02 390144 ----a-w- c:\windows\system32\msdrm.dll
2014-03-27 11:14 . 2013-12-04 01:54 510976 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2014-03-27 11:14 . 2013-12-04 01:54 594944 ----a-w- c:\windows\system32\RMActivate_isv.exe
2014-03-27 11:14 . 2013-12-04 01:54 572416 ----a-w- c:\windows\system32\RMActivate.exe
2014-03-27 11:14 . 2013-12-04 01:54 508928 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2014-03-27 10:44 . 2014-03-04 11:32 599840 ----a-w- c:\windows\system32\nvStreaming.exe
2014-03-27 10:44 . 2014-03-04 12:34 4348704 ----a-w- c:\windows\system32\nvcpl.dll
2014-03-27 10:44 . 2014-03-04 12:34 3044696 ----a-w- c:\windows\system32\nvsvc.dll
2014-03-27 10:44 . 2014-03-04 12:34 663896 ----a-w- c:\windows\system32\nvvsvc.exe
2014-03-27 10:44 . 2014-03-04 12:34 62752 ----a-w- c:\windows\system32\nvshext.dll
2014-03-27 10:44 . 2014-03-04 12:34 2556360 ----a-w- c:\windows\system32\nvsvcr.dll
2014-03-27 10:44 . 2014-03-04 12:34 375128 ----a-w- c:\windows\system32\nvmctray.dll
2014-03-27 10:44 . 2014-03-04 05:35 3649185 ----a-w- c:\windows\system32\nvcoproc.bin
2014-03-27 10:44 . 2014-03-04 14:29 53024 ----a-w- c:\windows\system32\OpenCL.dll
2014-03-27 10:37 . 2014-03-27 10:37 -------- d-----w- c:\program files\AGEIA Technologies
2014-03-27 10:35 . 2014-03-04 14:29 10523480 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2014-03-27 10:22 . 2014-03-27 10:22 -------- d-----w- C:\NVIDIA
2014-03-27 10:11 . 2014-03-27 10:12 -------- d-----w- C:\rsit
2014-03-27 10:11 . 2014-03-27 10:12 -------- d-----w- c:\program files\trend micro
2014-03-27 09:57 . 2014-03-27 09:57 -------- d-----w- c:\users\Robin\AppData\Roaming\AVAST Software
2014-03-27 09:55 . 2014-03-27 09:55 67264 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-03-27 09:55 . 2014-03-27 09:55 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-03-27 09:55 . 2014-03-27 09:55 776976 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-03-19 09:57 . 2014-03-27 09:49 -------- d-----w- c:\program files\Mozilla Thunderbird
2014-03-04 21:10 . 2014-03-04 21:10 -------- d-----w- c:\users\Robin\AppData\Roaming\Opera Software
2014-03-04 21:10 . 2014-03-04 21:10 -------- d-----w- c:\users\Robin\AppData\Local\Opera Software
2014-03-03 08:10 . 2014-03-03 08:10 -------- d-----w- c:\program files\XPS to JPG
2014-02-27 09:19 . 2014-02-27 09:19 -------- d-----w- c:\programdata\RELOADED
2014-02-27 08:56 . 2014-02-27 08:56 -------- d-----w- c:\program files\1C Company
2014-02-25 21:05 . 2014-02-25 21:05 -------- d-----w- c:\users\Robin\AppData\Local\World in Conflict
2014-02-25 20:59 . 2014-02-25 20:59 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2014-02-25 20:59 . 2014-02-25 20:59 -------- d--h--r- c:\users\Robin\AppData\Roaming\SecuROM
2014-02-25 20:54 . 2007-03-15 15:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2014-02-25 20:54 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
2014-02-25 20:54 . 2007-03-12 15:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2014-02-25 20:54 . 2006-11-29 12:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2014-02-25 20:54 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2014-02-25 20:54 . 2014-02-25 20:54 -------- d-----w- c:\programdata\Media Center Programs
2014-02-25 20:53 . 2014-02-25 20:53 -------- d-----w- c:\program files\Sierra Entertainment
2014-02-25 20:52 . 2014-02-25 20:52 -------- d-----w- c:\users\Robin\AppData\Roaming\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-19 16:58 . 2013-05-30 18:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-19 16:58 . 2013-05-30 18:27 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-03-27 09:55 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-14 2565520]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-03-29 11930696]
"NvBackend"="c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap.dll" [2013-12-10 982232]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-03-27 3854640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:\program files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [2013-01-28 31128]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-03-27 67264]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2013-11-15 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-11-15 49664]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2013-11-15 27136]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2013-06-02 1343400]
R4 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\nlssrv32.exe [2012-07-05 66560]
R4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-03-27 776976]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-03-27 411552]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-05-30 242240]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\system32\drivers\HWiNFO32.SYS [2013-12-20 22560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-03-27 67824]
S2 Cadence License Manager;Cadence License Manager;c:\cadence\LicenseManager\lmgrd.exe [2011-02-02 1379664]
S2 NvNetworkService;NVIDIA Network Service;c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 14658848]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-03-04 411936]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-08-10 45288]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-12-05 34080]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\SPB_16.5]
2011-04-14 07:47 930 ----a-w- c:\cadence\SPB_16.5\tools\ConfigUtility\CreateShortcut.vbs
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-30 16:58]
.
2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-27 12:40]
.
2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-27 12:40]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.2.1
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AIDA64Driver]
"ImagePath"="\??\c:\program files\FinalWire\AIDA64 Extreme Edition\kerneld.x32"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
c:\windows\system32\PrintIsolationHost.exe
c:\program files\Canon\Solution Menu EX\CNSEUPDT.EXE
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\cadence\LicenseManager\cdslmd.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
c:\program files\Opera\20.0.1387.82\opera.exe
.
**************************************************************************
.
Celkový čas: 2014-03-27 12:42:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-27 11:42
ComboFix2.txt 2014-03-27 11:02
.
Před spuštěním: Volných bajtů: 43 956 940 800
Po spuštění: Volných bajtů: 43 578 310 656
.
- - End Of File - - F5D2666624C8F4CA1599D1EA09931658
A36C5E4F47E84449FF07ED3517B43A31

#13 Příspěvek od **vyosek** » 28 bře 2014 01:26

Tak jeste uklidime

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

VIRY.CZ

Nelze nainstalovat žádný funkční antivir

Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir

Re: Nelze nainstalovat žádný funkční antivir