není platná aplikace typu win32, chyba připojení SSL

[patricie]

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : user [Práva správce]
Mód : Oprava HOSTS -- Datum : 04/21/2014 12:08:48
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost


Dokončeno : << RKreport[0]_H_04212014_120848.txt >>
RKreport[0]_D_04212014_120111.txt;RKreport[0]_D_04212014_120733.txt;RKreport[0]_S_04212014_114149.txt
RKreport[0]_S_04212014_120621.txt

[Márty84]

Zkuste ted vytvorit log z teto verze RSIT http://images.malwareremoval.com/random/RSIT.exe . Nezapomente ho spustit jako spravce.

[patricie]

Logfile of random's system information tool 1.09 (written by random/random)
Run by user at 2014-04-21 12:16:46
Microsoft Windows 7 Starter Service Pack 1
System drive C: has 71 GB (70%) free of 102 GB
Total RAM: 1012 MB (23% free)

HijackThis download failed

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rkxrwbvy.default-1373972667653

prefs.js - "browser.startup.homepage" - "about:home"
prefs.js - "keyword.URL" - "https://www.google.com/search"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 13.0.0.182 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-04-20 436600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D381FF29-7CFB-4D4E-B92A-C4EDDC696614}]
Windows 7 Starter Helper - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll [2009-12-09 137904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2012-02-27 135168]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2012-02-27 168960]
"Persistence"=C:\windows\system32\igfxpers.exe [2012-02-27 161280]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2011-09-02 10828392]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-05-05 2262312]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-04-20 3873704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSPRP]
C:\Program Files\ASUS\APRP\APRP.EXE [2012-03-31 3331312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSWebStorage]
C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [2011-07-29 737104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapsHook]
AsusSender.exe C:\Program Files\ASUS\CapsHook\CapsHook.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eee Docking]
C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [2011-07-14 417456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GfxServiceInstall]
C:\windows\system32\GfxCUIServiceInstall.vbs [2012-02-27 131]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyMon]
AsusSender.exe C:\Program Files\ASUS\HotkeyService\HotKeyMon.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyService]
AsusSender.exe C:\Program Files\ASUS\HotkeyService\HotkeyService.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveUpdate]
AsusSender.exe C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperHybridEngine]
AsusSender.exe C:\Program Files\ASUS\SHE\SuperHybridEngine.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAWinAgent]
C:\ExpressGateUtil\VAWinAgent.exe [2012-01-13 45448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AsusVibeLauncher.lnk]
C:\PROGRA~1\Asus\AsusVibe\ASUSVI~2.EXE /start []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2012-02-27 224768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=iyvu9_32.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"msacm.siren"=sirenacm.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"vidc.iv41"=ir41_32.ax
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-04-21 12:16:46 ----D---- C:\rsit
2014-04-21 12:16:46 ----D---- C:\Program Files\trend micro
2014-04-21 11:09:14 ----A---- C:\ComboFix.txt
2014-04-21 11:03:18 ----D---- C:\$RECYCLE.BIN
2014-04-21 09:38:26 ----A---- C:\windows\zip.exe
2014-04-21 09:38:26 ----A---- C:\windows\SWSC.exe
2014-04-21 09:38:26 ----A---- C:\windows\SWREG.exe
2014-04-21 09:38:26 ----A---- C:\windows\sed.exe
2014-04-21 09:38:26 ----A---- C:\windows\PEV.exe
2014-04-21 09:38:26 ----A---- C:\windows\NIRCMD.exe
2014-04-21 09:38:26 ----A---- C:\windows\MBR.exe
2014-04-21 09:38:26 ----A---- C:\windows\grep.exe
2014-04-21 09:37:47 ----D---- C:\Qoobox
2014-04-21 09:36:15 ----D---- C:\windows\erdnt
2014-04-20 16:30:56 ----A---- C:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-20 16:30:23 ----D---- C:\ProgramData\Malwarebytes
2014-04-20 14:51:41 ----D---- C:\FRST
2014-04-20 14:38:14 ----A---- C:\windows\ntbtlog.txt
2014-04-20 12:31:39 ----A---- C:\windows\system32\drivers\aswHwid.sys
2014-04-20 12:31:33 ----A---- C:\windows\avastSS.scr
2014-04-19 21:22:58 ----D---- C:\windows\SoftwareDistribution
2014-04-19 20:19:36 ----D---- C:\Program Files\VideoLAN
2014-04-18 21:44:14 ----A---- C:\windows\system32\qdvd.dll
2014-04-18 20:09:38 ----A---- C:\windows\system32\vbscript.dll
2014-04-18 20:09:35 ----A---- C:\windows\system32\ieui.dll
2014-04-18 20:09:19 ----A---- C:\windows\system32\ieetwcollectorres.dll
2014-04-18 20:09:18 ----A---- C:\windows\system32\ieapfltr.dll
2014-04-18 20:09:13 ----A---- C:\windows\system32\msrating.dll
2014-04-18 20:09:13 ----A---- C:\windows\system32\msfeeds.dll
2014-04-18 20:09:13 ----A---- C:\windows\system32\jsproxy.dll
2014-04-18 20:09:09 ----A---- C:\windows\system32\dxtmsft.dll
2014-04-18 20:09:08 ----A---- C:\windows\system32\dxtrans.dll
2014-04-18 20:09:07 ----A---- C:\windows\system32\ie4uinit.exe
2014-04-18 20:09:06 ----A---- C:\windows\system32\ieUnatt.exe
2014-04-18 20:09:05 ----A---- C:\windows\system32\iesetup.dll
2014-04-18 20:09:05 ----A---- C:\windows\system32\iernonce.dll
2014-04-18 20:09:03 ----A---- C:\windows\system32\JavaScriptCollectionAgent.dll
2014-04-18 20:09:02 ----A---- C:\windows\system32\jscript9diag.dll
2014-04-18 20:09:02 ----A---- C:\windows\system32\ieetwproxystub.dll
2014-04-18 20:09:02 ----A---- C:\windows\system32\ieetwcollector.exe
2014-04-18 20:09:01 ----A---- C:\windows\system32\MsSpellCheckingFacility.exe
2014-04-18 20:08:48 ----A---- C:\windows\system32\iertutil.dll
2014-04-18 20:08:46 ----A---- C:\windows\system32\wininet.dll
2014-04-18 20:08:45 ----A---- C:\windows\system32\urlmon.dll
2014-04-18 20:08:40 ----A---- C:\windows\system32\ieframe.dll
2014-04-18 20:08:37 ----A---- C:\windows\system32\mshtml.dll
2014-04-18 20:08:31 ----A---- C:\windows\system32\jscript9.dll
2014-04-11 13:55:07 ----A---- C:\windows\system32\drivers\storport.sys
2014-04-11 13:55:07 ----A---- C:\windows\system32\drivers\msiscsi.sys
2014-04-11 13:55:06 ----A---- C:\windows\system32\drivers\Diskdump.sys
2014-04-11 13:54:57 ----A---- C:\windows\system32\iologmsg.dll
2014-04-11 13:51:03 ----A---- C:\windows\system32\drivers\ntfs.sys
2014-04-11 13:50:53 ----A---- C:\windows\system32\kernel32.dll
2014-03-25 13:41:47 ----A---- C:\windows\system32\drivers\wStLibG.sys

======List of files/folders modified in the last 1 month======

2014-04-21 12:16:46 ----RD---- C:\Program Files
2014-04-21 12:16:42 ----D---- C:\windows\Temp
2014-04-21 12:16:10 ----D---- C:\windows\System32
2014-04-21 12:06:07 ----D---- C:\windows\system32\drivers
2014-04-21 11:03:34 ----D---- C:\Windows
2014-04-21 11:03:34 ----A---- C:\windows\system.ini
2014-04-21 11:03:07 ----D---- C:\windows\system32\drivers\etc
2014-04-21 11:01:03 ----D---- C:\windows\system32\config
2014-04-21 10:49:58 ----D---- C:\windows\AppPatch
2014-04-21 10:49:50 ----D---- C:\Program Files\Common Files
2014-04-21 09:30:44 ----D---- C:\windows\cs-CZ
2014-04-20 22:24:27 ----SHD---- C:\windows\ftpcache
2014-04-20 22:22:49 ----D---- C:\windows\inf
2014-04-20 16:36:14 ----A---- C:\windows\win.ini
2014-04-20 16:30:23 ----D---- C:\ProgramData
2014-04-20 12:31:42 ----D---- C:\windows\system32\Tasks
2014-04-20 12:31:33 ----A---- C:\windows\system32\aswBoot.exe
2014-04-20 12:28:47 ----SHD---- C:\System Volume Information
2014-04-19 20:43:05 ----D---- C:\Program Files\The KMPlayer
2014-04-19 15:46:56 ----A---- C:\windows\system32\PerfStringBackup.INI
2014-04-19 13:17:01 ----D---- C:\windows\winsxs
2014-04-19 12:46:34 ----D---- C:\windows\system32\catroot
2014-04-19 12:46:32 ----D---- C:\windows\system32\catroot2
2014-04-18 21:23:20 ----D---- C:\windows\system32\NDF
2014-04-18 20:27:30 ----D---- C:\windows\system32\it-IT
2014-04-18 20:27:30 ----D---- C:\windows\system32\en-US
2014-04-18 20:27:30 ----D---- C:\windows\system32\de-DE
2014-04-18 20:27:30 ----D---- C:\windows\system32\cs-CZ
2014-04-18 20:27:30 ----D---- C:\windows\PolicyDefinitions
2014-04-18 20:27:29 ----D---- C:\Program Files\Internet Explorer
2014-04-17 16:17:58 ----A---- C:\windows\system32\FlashPlayerApp.exe
2014-04-16 19:18:21 ----D---- C:\Users\user\AppData\Roaming\Skype
2014-04-12 12:28:07 ----D---- C:\windows\system32\DriverStore
2014-04-11 21:26:30 ----SHD---- C:\windows\Installer
2014-04-11 21:26:27 ----D---- C:\ProgramData\Microsoft Help
2014-04-11 21:25:45 ----D---- C:\windows\system32\MRT
2014-04-11 21:21:44 ----A---- C:\windows\system32\MRT.exe
2014-04-11 12:57:02 ----D---- C:\windows\Tasks
2014-04-11 12:57:02 ----D---- C:\windows\system32\wfp
2014-04-11 12:56:57 ----D---- C:\windows\system32\wbem
2014-04-11 12:56:17 ----D---- C:\ExpressGateUtil
2014-04-11 12:56:16 ----D---- C:\windows\system32\CodeIntegrity
2014-04-11 12:56:10 ----D---- C:\windows\registration
2014-03-31 09:35:10 ----N---- C:\windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2014-04-20 49944]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2014-04-20 180632]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\drivers\iaStor.sys [2010-11-06 354840]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 AsIO;AsIO; C:\windows\system32\drivers\AsIO.sys [2010-06-28 11456]
R1 AsUpIO;AsUpIO; C:\windows\system32\drivers\AsUpIO.sys [2010-08-03 11832]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2014-04-20 81768]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2014-04-20 776976]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2014-04-20 411552]
R1 aswTdi;avast! Network Shield Support; C:\windows\system32\drivers\aswTdi.sys [2013-12-19 56080]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-03-02 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2014-04-20 24184]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2014-04-20 67824]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athr.sys [2012-01-11 2231808]
R3 igddim32;igddim32; C:\windows\system32\DRIVERS\igddim32.sys [2012-02-27 1344512]
R3 igdkmd32;igdkmd32; C:\windows\system32\DRIVERS\igdkmd32.sys [2012-02-27 419328]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2011-08-30 3659240]
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2011-06-09 278528]
R3 kbfiltr;Keyboard Filter; C:\windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 13880]
R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller; C:\windows\system32\DRIVERS\L1C62x86.sys [2011-11-01 91760]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2011-05-05 1344560]
S2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2014-04-20 67776]
S2 Parvdm;Parvdm; C:\windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 catchme;catchme; \??\C:\Users\user\AppData\Local\Temp\catchme.sys []
S3 Dot4;MS IEEE-1284.4 Driver; C:\windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
S3 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr.sys [2011-05-14 39272]
S3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2012-02-27 419328]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [2014-04-21 107736]
S3 mbr;mbr; \??\C:\Users\user\AppData\Local\Temp\mbr.sys []
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 sisagp;SIS AGP Bus Filter; C:\windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 viaagp;VIA AGP Bus Filter; C:\windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\windows\system32\drivers\viac7.sys [2009-07-14 52736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 ASUS InstantOn;ASUS InstantOn Service; C:\Program Files\ASUS\InstantOn for EPC\InsOnSrv.exe [2011-12-01 92800]
R2 AsusService;Asus Launcher Service; C:\windows\system32\AsusService.exe [2011-08-09 224680]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-04-20 50344]
R2 VideAceWindowsService;VideAceWindowsService; C:\ExpressGateUtil\VAWinService.exe [2011-03-26 91464]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-29 1713536]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-15 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-17 257712]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2011-05-14 1492840]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-15 116648]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-10-01 118680]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 51040]

-----------------EOF-----------------

[Márty84]

Jeste jeden sken a budem mazat.


Jestli bude Avast rvat, ze to chce otevrit v sandboxu, nedovolte to! Vyberte moznost Otevrit normalne
Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce
Oznacte polozky (dejte tam zatrzitka) Pro všechny uživatele, Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Do spodniho okna vlozte nasledujici text

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c

type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5

*crack* /s
*keygen* /s
*AntiWPA* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

Kliknete na Prohledat
Po skenu se vytvori dva logy (OTL.Txt a Extras.txt), oba sem vlozte (kdyz budou dlouhe, rozdelte je do vice prispevku).

[patricie]

dala jsem prohledat a zasekl se mi celý NTB, zmizel mi i kurzor, jinak to nic nedělá, mám to nechat?

[Márty84]

Pokud je to seknute, tak nema smysl cekat.


Spustte ho podle stejneho navodu jeste jednou, ale s timto upravenym skriptem

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

*crack* /s
*keygen* /s
*AntiWPA* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

Kdyby to zase neslo, zkuste to jeste v nouzovem rezimu.

[patricie]

nejde mi to ani v nouzovém rezimu zmizely prvni 4 radky skriptu a pred /md5start se to zas zaseklo

[Márty84]

Nevadi, tak momentik, sepisu mazaci skript aspon z logu RSIT.

[Márty84]

Jestli bude Avast rvat, ze to chce otevrit v sandboxu, nedovolte to! Vyberte moznost Otevrit normalne
Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe a ulozte nejlepe na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Do leveho okna zkopirujte tento skript (vcetne te dvojtecky pred slovem commands)

Kód: Vybrat vše

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[Purity]
[CreateRestorePoint]

:services
AdobeARMservice
gupdate
AdobeFlashPlayerUpdateSvc
gupdatem

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp
C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Kliknete na MoveIt a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu sem dejte log, ktery na vas vyskoci, nebo bude zde C:\_OTM\MovedFiles\xxxxxxxx_xxxxxx (misto tech x budou cisla, predstavujici datum a cas spusteni)

[patricie]

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 294887 bytes
->Flash cache emptied: 57882 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: user
->Temp folder emptied: 1289096 bytes
->Temporary Internet Files folder emptied: 1639350 bytes
->FireFox cache emptied: 35436324 bytes
->Google Chrome cache emptied: 11980524 bytes
->Flash cache emptied: 72927 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 802298 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 29367618 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 77,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: user
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Restore point Set: OTM Restore Point
========== SERVICES/DRIVERS ==========
Service AdobeARMservice stopped successfully!
Service AdobeARMservice deleted successfully!
Service gupdate stopped successfully!
Service gupdate deleted successfully!
Service AdobeFlashPlayerUpdateSvc stopped successfully!
Service AdobeFlashPlayerUpdateSvc deleted successfully!
Service gupdatem stopped successfully!
Service gupdatem deleted successfully!
========== FILES ==========
File/Folder C:\windows\system32\*.tmp.dll not found.
File/Folder C:\windows\system32\SET*.tmp not found.
File/Folder C:\windows\*.tmp not found.
C:\windows\tasks\Adobe Flash Player Updater.job moved successfully.
C:\windows\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\windows\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.

OTM by OldTimer - Version 3.1.21.0 log created on 04212014_144238

Files moved on Reboot...
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\windows\temp\_avast_\AvastLock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[Márty84]

Fajn, program provedl co mel.

Jak je na tom zatim pocitac? Nastala nejaka zmena?

[patricie]

Tak vyborne . Dekuju mockrat. Zmena je uz jen v zapnuti internetu, nehaze to tam chybove hlasky a sly mi spustit ty posledni programy, predtim jsem musela stahovat pres druhy pocitac takze uzasny. Myslite ze uz tam nic neni?

[Márty84]

No, tyto logy uz vypadaji ciste Takze uklidime a pak se uvidi, jak bude pc slapat. Kdyby se objevil problem, pujdme jeste hloubeji.


Vsechny tyto programy - vcetne pripadne instalace - spoustejte jako spravce (kliknete na ne pravym mysidlem a zvolte - Spustit jako spravce)

Prejmenujte ComboFix na Uninstall a spustte ho. CF by se mel odinstalovat.

T-Cleaner http://tharifas.sweb.cz/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry mohou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

Stahnete OTC http://oldtimer.geekstogo.com/OTC.exe , ulozte a spustte.
Kliknete na napis CleanUp a pote OK - Po uklidu dojde k restartu pc.

Stahnete TFC http://oldtimer.geekstogo.com/TFC.exe , ulozte a spustte
Kliknete na START a pote OK - Po uklidu dojde k restartu pc.
Po pouziti muzete programek smazat

Stahnete Ccleaner http://www.piriform.com/ccleaner/download/slim a spustte.
Pri instalaci pozor na toolbar (ci jine doplnky), jestli vam nabidne jeho instalaci, tak zruste zatrzitko.
Po spusteni se ocitnete ve funkci Cistic. Vlevo je spousta zatrzitek. Pozor dejte hlavne na kos, pokud nechate zatrzene, vzdy ho vysype.
Dale, podle toho jak je nastaven, smaze vsechna hesla ulozena na netu!!! Takze jestli mate nastavene, at si pocitac hesla pamatuje (coz neni pro bezpecnost dobre), budete je muset pak napsat znova rucne (napr mail, facebook, ruzna fora atd.)
Kliknete na Analyzovat a az dokonci analyzu, kliknete na Spustit Cleaner.
Potom kliknete vlevo na funkci Registry
Kliknete na Hledej problemy, kdyz najde, kliknete na Opravit problemy. Nabidne Vam zalohu, tu udelejte a ulozte ji tak, at ji v pripade potreby najdete.
Funkce Nastroje umoznuje odinstalovani programu. Je dukladnejsi nez samotny windows!

Defragmentujte disk(y)
Stahnete program Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
Pri instalaci opet pozor na toolbar
Po nainstalovani program spustte a kliknete na Analyzovat, po analyze kliknete na Defragmentovat a programek odvede svou praci.




Pak napiste, jak je na tom pc.

[patricie]

Tak zatim je to úžasný . Moc děkuju . Udělalo mi to i spoustu volného místa . Moc děkuju že jste se mi takhle věnoval. Určitě Vás doporučím dál! Jen jsem se chtěla zeptat na nějakou prevenci aby se mi tohle zas nestalo, třeba nějaký program nebo tak

[Márty84]

To mam radost, ze se nam to povedlo a jste spokojena

Ale ten uklid urcite udelejte, vcetne te defragmentace, ktera muze trvat i nekolik hodin. Tak az budete mit cas, nebo to nechte pres noc...

Neni vubec zac, rado se stalo!

Ono 100% prevence je jen jedna, nezapinat pc

Ale jinak dulezita vec je mit aktualizovany system a antivir, na netu neklikat na kdejakou blbost, obcas to procistit CCleanerem, pripadne ADWCleanerem, no a taky pri instalacich ruznych programu pozorne cist. Casto instalator nabidne i nejaky pridavek (toolbar, nebo jinou blbost), ktery pc vubec neprospiva. Casto staci zrusit u toho zatrzitko a instalace probehne jak ma, tedy ze se nainstaluje opravdu jen ten pozadovany program. Ovsem uzivatele casto jen zbesile klikaji na Dalsi Dalsi Dalsi a problem je na svete


Tema necham zatim otevrene a az pc poradne vyzkousite, dejte vedet jak to vypada, OK?