Problém s viry. Bit Coiner, Dropper - gen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Problém s viry. Bit Coiner, Dropper - gen

#1 Příspěvek od Wraith »

Dobrý den, včera na mě vystartovalo upozornění při spouštění aplikace o přítomnosti viru. Dlouhodobě ověřená aplikace, která z ničeho nic obsahuje virus. Kontrola Avastu ukázala Dropper - gen ve složce Sound Volume Information, po 15ti minutách Bit Coiner v systému... Pokud mi nějakým způsobem poradíte, snažte se "po lopatě" aby nedošlo k nedorozumění.. Předem děkuji :(
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#2 Příspěvek od Wraith »

Přikládám RSIT log:
Logfile of random's system information tool 1.06 (written by random/random)
Run by admin at 2014-06-27 10:13:36
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 13 GB (19%) free of 70 GB
Total RAM: 2047 MB (64% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
C:\WINDOWS\tasks\update-S-1-5-21-1292428093-1965331169-682003330-1006.job
C:\WINDOWS\tasks\update-sys.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-11-20 606544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-10-09 4502400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-11-20 606544]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-10 16861184]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [2007-02-04 79400]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2013-11-20 3568312]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"LogMeIn Hamachi Ui"=D:\Programy\Hamachi\hamachi-2-ui.exe [2014-06-23 3816272]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools Lite"=D:\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2013-11-18 20587168]
"LightShot"=C:\Documents and Settings\admin\Local Settings\Data aplikací\Skillbrains\lightshot\Lightshot.exe [2014-03-06 226592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
D:\samsung\NPSAgent.exe [2009-05-13 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2007-04-03 1603152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-14 644696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
D:\Program Files\ICQ7.7\ICQ.exe [2012-01-23 127040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
C:\Program Files\Samsung\Kies\KiesHelper.exe /s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
D:\Hamachi\hamachi-2-ui.exe --auto-start []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mncgtghxgSrv]
C:\WINDOWS\inf\mncgtghxg.vbe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSStp]
C:\WINDOWS\system32\msstp.vbe [2014-01-19 1419]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NPSStartup]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Autoupdate]
D:\Program Files\Zoner Photo Studio - 16.0.1.2 Pro CZ + Aktivator\Photo Studio 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Service 16]
D:\Program Files\Zoner Photo Studio - 16.0.1.2 Pro CZ + Aktivator\Photo Studio 16\Program32\ZPSTRAY.EXE [2013-09-16 800280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Steam Client Service"=3
"Bonjour Service"=2
"Autodesk Content Service"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\Documents and Settings\admin\Dokumenty\Stažené soubory\skype-100-funkcni-cz.exe"="C:\Documents and Settings\admin\Dokumenty\Stažené soubory\skype-100-funkcni-cz.exe:*:Enabled:skype-100-funkcni-cz"
"C:\Documents and Settings\admin\Plocha\Skype.exe"="C:\Documents and Settings\admin\Plocha\Skype.exe:*:Enabled:Skype"
"D:\Samsung\npsasvr.exe"="D:\Samsung\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"D:\Samsung\npsvsvr.exe"="D:\Samsung\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"D:\Program Files\ICQ7.7\ICQ.exe"="D:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"D:\FlatOut2\FlatOut2.exe"="D:\FlatOut2\FlatOut2.exe:*:Enabled:FlatOut2"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\Program Files\Java\jre7\bin\javaw.exe"="C:\Program Files\Java\jre7\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\ FAR CRY 2\bin\FarCry2.exe"="D:\ FAR CRY 2\bin\FarCry2.exe:*:Enabled:Far Cry 2"
"D:\ FAR CRY 2\bin\FC2Launcher.exe"="D:\ FAR CRY 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"
"D:\ FAR CRY 2\bin\FC2Editor.exe"="D:\ FAR CRY 2\bin\FC2Editor.exe:*:Enabled:Editor"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Metin2\metin2client.bin"="D:\Metin2\metin2client.bin:*:Enabled:Metin2Client"
"D:\DeadIsland\Steam.exe"="D:\DeadIsland\Steam.exe:*:Enabled:Steam"
"D:\Dead Island\Dead Island\deadislandgame.exe"="D:\Dead Island\Dead Island\deadislandgame.exe:*:Enabled:DeadIsland"
"D:\WorldOfTanks\WoTLauncher.exe"="D:\WorldOfTanks\WoTLauncher.exe:*:Enabled:World of Tanks Launcher"
"D:\WorldOfTanks\WorldOfTanks.exe"="D:\WorldOfTanks\WorldOfTanks.exe:*:Enabled:World of Tanks"
"D:\Dishonered\Binaries\Win32\Dishonored.exe"="D:\Dishonered\Binaries\Win32\Dishonored.exe:*:Enabled:Dishonored"
"D:\Dishonored\Binaries\Win32\Dishonored.exe"="D:\Dishonored\Binaries\Win32\Dishonored.exe:*:Enabled:Dishonored"
"D:\quake3.exe"="D:\quake3.exe:*:Enabled:quake3"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\Metin2 Sindicate\client.bin"="D:\Metin2 Sindicate\client.bin:*:Enabled:client"
"D:\AgeOfEmpires\empires2.exe"="D:\AgeOfEmpires\empires2.exe:*:Enabled:Age of Empires II"
"C:\Program Files\Java\jre7\bin\java.exe"="C:\Program Files\Java\jre7\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Test Drive Unlimited\TestDriveUnlimited.exe"="D:\Test Drive Unlimited\TestDriveUnlimited.exe:*:Enabled:Test Drive Unlimited"
"D:\Valve\hl.exe"="D:\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Documents and Settings\admin\Local Settings\Temp\DSOClient\dlcache\app.n3app"="C:\Documents and Settings\admin\Local Settings\Temp\DSOClient\dlcache\app.n3app:*:Enabled:Drakensang Online"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP (HP Deskjet 3520 series)"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:Síťový komunikační program HP (HP Deskjet 3520 series)"
"D:\AgeofEmpires Conquerors\Age Of Empires 2 CZ!!!!\age2_x1.exe"="D:\AgeofEmpires Conquerors\Age Of Empires 2 CZ!!!!\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"D:\uTorrent\uTorrent.exe"="D:\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Counter-Strike 1.6\csko.exe"="D:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Documents and Settings\admin\Plocha\uTorrent.exe"="C:\Documents and Settings\admin\Plocha\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"E:\EasySetupAssistant\wr841n\EasySetupAssistant.exe"="E:\EasySetupAssistant\wr841n\EasySetupAssistant.exe:*:Enabled:TP-LINK Easy Setup Assistant"
"D:\World_of_Tanks\WoTLauncher.exe"="D:\World_of_Tanks\WoTLauncher.exe:*:Enabled:World of Tanks Launcher"
"D:\Metin2 Sindicate\game.exe"="D:\Metin2 Sindicate\game.exe:*:Enabled:game"
"D:\Counter-Strike 1.6\hl.exe"="D:\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Hry\Far_Cry_2\bin\farcry2.exe"="D:\Hry\Far_Cry_2\bin\farcry2.exe:*:Enabled:Far Cry® 2"
"D:\Hry\Age of Empires - Conquerors\Age Of Empires 2 CZ!!!!\age2_x1.exe"="D:\Hry\Age of Empires - Conquerors\Age Of Empires 2 CZ!!!!\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\Hry\Age of Empires - Conquerors\Age Of Empires 2 CZ!!!!\empires2.exe"="D:\Hry\Age of Empires - Conquerors\Age Of Empires 2 CZ!!!!\empires2.exe:*:Enabled:Age of Empires II"
"D:\Hry\CoD - Modern Warfare\iw3mp.exe"="D:\Hry\CoD - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"D:\Hry\World_of_Tanks\WOTLauncher.exe"="D:\Hry\World_of_Tanks\WOTLauncher.exe:*:Enabled:World of Tanks Launcher"
"D:\Hry\World_of_Tanks\WorldOfTanks.exe"="D:\Hry\World_of_Tanks\WorldOfTanks.exe:*:Enabled:World of Tanks"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\ICQ7.7\ICQ.exe"="D:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f72e8a83-fe65-11e1-98bd-002421f0d638}]
shell\AutoRun\command - F:\setup\rsrc\Autorun.exe
shell\dinstall\command - F:\Directx\dxsetup.exe


======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2014-06-22 23:01:38 ----D---- C:\Documents and Settings\admin\Data aplikací\Notepad++
2014-06-11 08:26:58 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 months======

2014-06-27 10:13:37 ----D---- C:\Program Files\trend micro
2014-06-27 10:01:25 ----D---- C:\WINDOWS\Temp
2014-06-27 09:59:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-06-27 09:59:24 ----D---- C:\WINDOWS\system32\drivers
2014-06-27 09:54:41 ----RD---- C:\Program Files
2014-06-27 09:44:35 ----D---- C:\WINDOWS\Prefetch
2014-06-27 00:38:43 ----D---- C:\Documents and Settings\admin\Data aplikací\Skype
2014-06-27 00:35:56 ----HD---- C:\WINDOWS\inf
2014-06-27 00:14:04 ----D---- C:\WINDOWS
2014-06-27 00:10:59 ----SHD---- C:\System Volume Information
2014-06-27 00:10:59 ----D---- C:\WINDOWS\system32\Restore
2014-06-26 23:48:41 ----D---- C:\Documents and Settings\admin\Data aplikací\.minecraft
2014-06-25 10:37:03 ----SHD---- C:\WINDOWS\Installer
2014-06-25 04:06:02 ----D---- C:\WINDOWS\system32\CatRoot2
2014-06-24 21:06:23 ----D---- C:\Documents and Settings\admin\Data aplikací\GHISLER
2014-06-21 16:52:11 ----D---- C:\WINDOWS\Microsoft.NET
2014-06-21 13:32:06 ----D---- C:\Documents and Settings\admin\Data aplikací\TS3Client
2014-06-21 13:01:39 ----D---- C:\WINDOWS\system32
2014-06-21 13:01:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-06-21 13:01:29 ----RSD---- C:\WINDOWS\assembly
2014-06-21 13:01:24 ----D---- C:\WINDOWS\WinSxS
2014-06-16 21:36:05 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2014-06-15 17:17:59 ----D---- C:\Documents and Settings\admin\Data aplikací\vlc
2014-06-14 13:01:45 ----D---- C:\WINDOWS\system32\MRT
2014-06-14 13:01:44 ----D---- C:\WINDOWS\Debug
2014-06-14 13:01:03 ----A---- C:\WINDOWS\system32\MRT.exe
2014-06-11 17:49:05 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-19 36864]
R1 aswRdr;aswRdr; \??\C:\WINDOWS\system32\drivers\aswRdr.sys []
R1 aswSnx;aswSnx; \??\C:\WINDOWS\system32\drivers\aswSnx.sys []
R1 aswSP;aswSP; \??\C:\WINDOWS\system32\drivers\aswSP.sys []
R1 aswTdi;aswTdi; \??\C:\WINDOWS\system32\drivers\aswTdi.sys []
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2012-09-14 242240]
R2 aswFsBlk;aswFsBlk; \??\C:\WINDOWS\system32\drivers\aswFsBlk.sys []
R2 aswMonFlt;aswMonFlt; \??\C:\WINDOWS\system32\drivers\aswMonFlt.sys []
R2 Dokan;Dokan; \??\C:\WINDOWS\system32\drivers\dokan.sys []
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-17 4707328]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2013-02-08 12648960]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-31 117888]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2009-03-18 30336]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-07-13 91904]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\WINDOWS\System32\Drivers\ssadadb.sys [2010-12-21 30312]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudbus.sys [2011-02-18 66112]
S3 EagleXNt;EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2010-12-21 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2010-12-21 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2010-12-21 123648]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\ssadbus.sys [2011-01-03 121192]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\WINDOWS\system32\DRIVERS\ssadmdfl.sys [2011-01-03 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\WINDOWS\system32\DRIVERS\ssadmdm.sys [2011-01-03 136680]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\WINDOWS\system32\DRIVERS\ssadserd.sys [2011-01-03 114152]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2013-02-12 12928]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2009-07-14 444136]
S3 WinUSB;WinUSB Driver; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2006-11-02 39368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-07-13 132224]
S3 ZSMC303;VIMICRO USB PC Camera (ZC0301PLH); C:\WINDOWS\System32\Drivers\usbVM303.sys [2007-02-02 389788]
S4 aswKbd;aswKbd; \??\C:\WINDOWS\system32\drivers\aswKbd.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-11-20 50344]
R2 DokanMounter;DokanMounter; C:\Program Files\Dokan\DokanLibrary\mounter.exe [2011-01-10 25088]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-05-11 233472]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; D:\Programy\Hamachi\hamachi-2.exe [2014-06-23 1889616]
R2 IJPLMSVC;PIXMA Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 97432]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-12-18 182696]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-08 2253120]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2014-05-18 66872]
R2 Skype C2C Service;Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-09 3275136]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2011-10-08 298304]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-09-05 171680]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15 257712]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2013-10-02 1044816]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-12-08 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-11 119408]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-07-20 756392]
S4 avast! Firewall;avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe []
S4 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-03-16 407336]

-----------------EOF-----------------
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s viry. Bit Coiner, Dropper - gen

#3 Příspěvek od vyosek »

Zdravim :)

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
:arrow: Udelejte MBAM dle tohoto http://forum.viry.cz/viewtopic.php?f=29&t=137928
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#4 Příspěvek od Wraith »

# AdwCleaner v3.213 - Report created 27/06/2014 at 11:39:37
# Updated 23/06/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : admin - SYSTEM-A2
# Running from : C:\Documents and Settings\admin\Dokumenty\Stažené soubory\adwcleaner_3.213.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\Ask
Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Folder Deleted : C:\Program Files\ICQ6Toolbar
Folder Deleted : C:\Program Files\Skillbrains
Folder Deleted : C:\Documents and Settings\admin\Local Settings\Data aplikací\Skillbrains
Folder Deleted : C:\Documents and Settings\admin\Data aplikací\Iminent
Folder Deleted : C:\Documents and Settings\PC\Local Settings\Data aplikací\AskToolbar
Folder Deleted : C:\Documents and Settings\PC\Data aplikací\Iminent
Folder Deleted : C:\Documents and Settings\PC\Data aplikací\Mozilla\Firefox\Profiles\iuu9bubj.default\Extensions\05dd836e-2cbd-4204-9ff3-2f8a8665967d@a8876730-fb0c-4057-a2fc-f9c09d438e81.com
Folder Deleted : C:\Documents and Settings\PC\Data aplikací\Mozilla\Firefox\Profiles\iuu9bubj.default\Extensions\staged\05dd836e-2cbd-4204-9ff3-2f8a8665967d@a8876730-fb0c-4057-a2fc-f9c09d438e81.com
File Deleted : C:\DOCUME~1\admin\LOCALS~1\Temp\Uninstall.exe
File Deleted : C:\Documents and Settings\admin\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
File Deleted : C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\jlwz9t4c.default-1377018778734\searchplugins\bingp.xml
File Deleted : C:\WINDOWS\Tasks\update-sys.job

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [D:\Samsung\npsasvr.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [D:\Samsung\npsvsvr.exe]
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\Crossrider
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\installedbrowserextensions
Key Deleted : HKCU\Software\SkillBrains
Key Deleted : HKLM\Software\ICQ\ICQToolbar
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\Software\SkillBrains
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\IMBoosterARP
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

-\\ Mozilla Firefox v30.0 (cs)

[ File : C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\jlwz9t4c.default-1377018778734\prefs.js ]


[ File : C:\Documents and Settings\PC\Data aplikací\Mozilla\Firefox\Profiles\iuu9bubj.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Line Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Line Deleted : user_pref("browser.search.order.1", "Ask.com");
Line Deleted : user_pref("browser.search.selectedEngine", "Ask.com");
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.asyncdb.rules.value", "%5B%5B%22%5E%28www.%29%3F%28bet365.com%29%24%22%2C%22hxxp%3A//s.mgkaxjfwfc.[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.js", "\n\n /************************************************************************************\[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return app[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_122.code", "if(!(/^hxxps\\:\\/\\//.test(document.location.href))){appAPI.dom.addRem[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_13.name", "CrossriderAppUtils");
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_137.code", "(function() {\n function injectScript(geo) {\n var prot = window.locat[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_14.name", "CrossriderUtils");
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_17.code", "if(typeof window!==\"undefined\"){\n/*!\n * jQuery JavaScript Library v1[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.a[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.que[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_con[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_31.code", "if (!appAPI.monetize || appAPI.monetize.isNeedToRun(\"monitzation_80\"))[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());[...]
Line Deleted : user_pref("extensions.a05dd836e2cbd42049ff32f8a8665967da8876730fb0c4057a2fcf9c09d438e81com35382.35382.plugins.plugin_78.name", "CrossriderInfo");
Line Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");
Line Deleted : user_pref("extensions.crossrider.bic", "14277029866bf68a4653c17e82b01784");
Line Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000027&locale=en_EU&apn_uid=558448A9-CC68-4238-B89C-2BE0860C92B0&apn_ptnrs=U3&apn_sauid=A582A7B7-7F43-4607-A443[...]

-\\ Google Chrome v35.0.1916.153

[ File : C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]


[ File : C:\Documents and Settings\PC\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [13577 octets] - [27/06/2014 11:37:40]
AdwCleaner[S0].txt - [13603 octets] - [27/06/2014 11:39:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [13664 octets] ##########
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#5 Příspěvek od Wraith »

Při instalaci MBAM vyskočí celkem 3 okna s chybou, číslem a run time.. nelze spustit
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s viry. Bit Coiner, Dropper - gen

#6 Příspěvek od vyosek »

Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#7 Příspěvek od Wraith »

při otevření http://vyosek.tym.cz/pro_usery/FRSTLauncher.exe avast zablokoval virus? :D je to možné?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by admin (administrator) on SYSTEM-A2 on 27-06-2014 12:01:26
Running from C:\Documents and Settings\admin\Dokumenty\Stažené soubory
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Čeština
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) D:\Programy\Hamachi\hamachi-2-ui.exe
(DT Soft Ltd) D:\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Program Files\Dokan\DokanLibrary\mounter.exe
(Teruten) C:\WINDOWS\system32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(LogMeIn, Inc.) D:\Programy\Hamachi\LMIGuardianSvc.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
() C:\WINDOWS\system32\PnkBstrA.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(LogMeIn Inc.) D:\Programy\Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Programy\Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16861184 2008-04-10] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [79400 2007-02-04] (Nuance Communications, Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [69632 2005-05-03] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LogMeIn Hamachi Ui] => D:\Programy\Hamachi\hamachi-2-ui.exe [3816272 2014-06-23] (LogMeIn Inc.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [LightShot] => C:\Documents and Settings\admin\Local Settings\Data aplikací\Skillbrains\lightshot\Lightshot.exe Flags: uninsdeletevalue
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\MountPoints2: {f72e8a83-fe65-11e1-98bd-002421f0d638} - F:\setup\rsrc\Autorun.exe
Startup: C:\Documents and Settings\PC\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
URLSearchHook: HKCU - (No Name) - {95289393-33EA-4F8D-B952-483415B9C955} - No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - E478E738E0594F9CAB782E50909E5983 URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {CD6A975A-A823-49CD-8B23-3D6E77641E29} URL = http://websearch.ask.com/redirect?clien ... B8B43BC1E3
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)

FireFox:
========
FF ProfilePath: C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\jlwz9t4c.default-1377018778734
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxp://www.seznam.cz/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-12-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-05-16]

Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: http://www.bing.com/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-08-04]
CHR Extension: (Peněženka Google) - C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
S4 Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [229376 2006-02-28] (Apple Computer, Inc.) [File not signed]
R2 DokanMounter; C:\Program Files\Dokan\DokanLibrary\mounter.exe [25088 2011-01-10] () [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2013-10-02] (Flexera Software, Inc.)
R2 FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [233472 2009-05-11] (Teruten) [File not signed]
R2 Hamachi2Svc; D:\Programy\Hamachi\hamachi-2.exe [1889616 2014-06-23] (LogMeIn Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [97432 2007-04-13] () [File not signed]
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2013-12-18] (Oracle Corporation)
R2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2253120 2011-10-08] (NVIDIA Corporation)
R2 PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [66872 2014-05-18] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3275136 2013-10-09] (Skype Technologies S.A.)
U4 avast! Firewall; "C:\Program Files\AVAST Software\Avast\afwServ.exe" [X]

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [36864 2006-06-19] (Advanced Micro Devices) [File not signed]
R2 aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [35656 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [70384 2013-11-20] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [54832 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944 2013-11-20] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [774392 2013-11-20] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [403440 2013-11-20] (AVAST Software)
R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57672 2013-11-20] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [178304 2013-11-20] ()
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
R2 Dokan; C:\WINDOWS\system32\drivers\dokan.sys [91904 2011-01-10] (Windows (R) Win 7 DDK provider) [File not signed]
R1 dtsoftbus01; C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys [242240 2012-09-14] (DT Soft Ltd)
R3 FsUsbExDisk; C:\WINDOWS\system32\FsUsbExDisk.SYS [36608 2009-05-11] () [File not signed]
R3 hamachi; C:\WINDOWS\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R0 sfhlp02; C:\WINDOWS\System32\drivers\sfhlp02.sys [6656 2005-05-16] (Protection Technology) [File not signed]
R0 sfsync02; C:\WINDOWS\System32\drivers\sfsync02.sys [19968 2006-02-21] (Protection Technology) [File not signed]
S3 ss_bbus; C:\WINDOWS\System32\DRIVERS\ss_bbus.sys [98432 2010-12-21] (MCCI)
S3 ss_bmdfl; C:\WINDOWS\System32\DRIVERS\ss_bmdfl.sys [14848 2010-12-21] (MCCI Corporation)
S3 ss_bmdm; C:\WINDOWS\System32\DRIVERS\ss_bmdm.sys [123648 2010-12-21] (MCCI Corporation)
S3 ZSMC303; C:\WINDOWS\System32\Drivers\usbVM303.sys [389788 2007-02-02] (Vimicro Corporation) [File not signed]
U4 aswKbd; \??\C:\WINDOWS\system32\drivers\aswKbd.sys [X]
S3 EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys [X]
S4 IntelIde; No ImagePath
U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-27 12:00 - 2014-06-27 12:01 - 00000000 ____D () C:\FRST
2014-06-27 11:46 - 2014-06-27 11:46 - 00000777 _____ () C:\Documents and Settings\All Users\Plocha\Malwarebytes Anti-Malware.lnk
2014-06-27 11:46 - 2014-06-27 11:46 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Malwarebytes Anti-Malware
2014-06-27 11:45 - 2014-06-27 11:46 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-27 11:45 - 2014-06-27 11:45 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2014-06-27 11:45 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-06-27 11:45 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-06-27 11:38 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\system32\sqlite3.dll
2014-06-27 11:36 - 2014-06-27 11:39 - 00000000 ____D () C:\AdwCleaner
2014-06-27 00:14 - 2014-06-27 00:14 - 00000060 _____ () C:\WINDOWS\setupact.log
2014-06-27 00:14 - 2014-06-27 00:14 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-06-26 23:39 - 2014-06-26 23:39 - 00027438 ____H () C:\treeinfo.wc
2014-06-26 23:24 - 2014-06-26 23:24 - 00016821 _____ () C:\Documents and Settings\admin\Plocha\ChestCommands-BB.rar
2014-06-26 18:52 - 2014-06-26 22:20 - 00011406 _____ () C:\Documents and Settings\admin\Plocha\Plná moc k přepisu vozidla.odt
2014-06-26 17:55 - 2014-06-26 17:59 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\ChestCommands-Kity
2014-06-25 01:27 - 2014-06-25 01:28 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\LogMeIn Hamachi
2014-06-24 23:59 - 2014-06-24 23:59 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\Nová složka
2014-06-24 22:12 - 2014-06-25 00:27 - 00001611 _____ () C:\Documents and Settings\admin\Plocha\Pravidla.txt
2014-06-22 23:01 - 2014-06-22 23:08 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\Notepad++
2014-06-22 23:01 - 2014-06-22 23:01 - 00000615 _____ () C:\Documents and Settings\admin\Plocha\Notepad++.lnk
2014-06-22 23:01 - 2014-06-22 23:01 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Notepad++
2014-06-22 23:01 - 2014-06-22 23:01 - 00000000 ____D () C:\Documents and Settings\admin\Nabídka Start\Programy\Notepad++
2014-06-17 20:57 - 2014-06-17 20:57 - 00335360 _____ () C:\Documents and Settings\admin\Plocha\Vestibul.ppt
2014-06-14 18:05 - 2014-06-27 11:42 - 00000000 ____D () C:\Documents and Settings\admin\Local Settings\Data aplikací\LogMeIn Hamachi
2014-06-11 08:26 - 2014-06-11 08:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-02 22:01 - 2014-06-02 22:01 - 00000000 ____D () C:\Documents and Settings\NetworkService\Nabídka Start\Programy
2014-06-02 22:01 - 2014-06-02 22:01 - 00000000 ____D () C:\Documents and Settings\NetworkService\Nabídka Start
2014-05-30 22:03 - 2014-05-30 22:03 - 00000000 _____ () C:\Documents and Settings\admin\Plocha\Nový objekt - Textový dokument (2).txt
2014-05-30 21:57 - 2014-05-30 21:57 - 00000556 _____ () C:\Documents and Settings\admin\Plocha\EVEREST Ultimate Edition.lnk
2014-05-30 21:57 - 2014-05-30 21:57 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Lavalys
2014-05-30 15:41 - 2014-05-30 15:41 - 00000533 _____ () C:\Documents and Settings\admin\Plocha\Fraps.lnk
2014-05-30 15:41 - 2014-05-30 15:41 - 00000000 ____D () C:\Documents and Settings\admin\Nabídka Start\Programy\Fraps
2014-05-30 10:26 - 2014-05-30 10:32 - 116106267 _____ () C:\Documents and Settings\admin\Plocha\Hrdina-počítačový-hry-jde-do-světa.zip

==================== One Month Modified Files and Folders =======

2014-06-27 12:02 - 2011-12-08 18:39 - 00000000 ____D () C:\Documents and Settings\admin\Local Settings\Temp
2014-06-27 12:01 - 2014-06-27 12:00 - 00000000 ____D () C:\FRST
2014-06-27 12:01 - 2011-12-08 19:13 - 00000000 ____D () C:\Documents and Settings\admin\Dokumenty\Stažené soubory
2014-06-27 11:47 - 2012-07-20 17:49 - 00000364 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job
2014-06-27 11:46 - 2014-06-27 11:46 - 00000777 _____ () C:\Documents and Settings\All Users\Plocha\Malwarebytes Anti-Malware.lnk
2014-06-27 11:46 - 2014-06-27 11:46 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Malwarebytes Anti-Malware
2014-06-27 11:46 - 2014-06-27 11:45 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-27 11:46 - 2012-09-26 18:04 - 00000914 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-06-27 11:46 - 2011-12-07 19:54 - 00000000 ___RD () C:\Documents and Settings\All Users\Nabídka Start\Programy
2014-06-27 11:46 - 2011-12-07 19:54 - 00000000 ____D () C:\Documents and Settings\All Users\Plocha
2014-06-27 11:45 - 2014-06-27 11:45 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2014-06-27 11:45 - 2011-12-07 19:54 - 00000000 __RHD () C:\Documents and Settings\All Users\Data aplikací
2014-06-27 11:44 - 2011-12-07 19:07 - 01609725 _____ () C:\WINDOWS\WindowsUpdate.log
2014-06-27 11:42 - 2014-06-14 18:05 - 00000000 ____D () C:\Documents and Settings\admin\Local Settings\Data aplikací\LogMeIn Hamachi
2014-06-27 11:42 - 2012-07-01 21:45 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
2014-06-27 11:42 - 2011-12-07 20:00 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-06-27 11:42 - 2011-12-07 20:00 - 00000049 _____ () C:\WINDOWS\wiaservc.log
2014-06-27 11:41 - 2014-03-23 13:13 - 00000222 _____ () C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
2014-06-27 11:41 - 2011-12-08 17:58 - 00000928 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-27 11:41 - 2011-12-07 19:12 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-06-27 11:40 - 2011-12-08 18:39 - 00000178 ___SH () C:\Documents and Settings\admin\ntuser.ini
2014-06-27 11:40 - 2011-12-07 19:12 - 00032480 _____ () C:\WINDOWS\SchedLgU.Txt
2014-06-27 11:39 - 2014-06-27 11:36 - 00000000 ____D () C:\AdwCleaner
2014-06-27 11:39 - 2012-01-02 13:14 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\ICQ
2014-06-27 11:39 - 2011-12-08 18:39 - 00000000 __RHD () C:\Documents and Settings\admin\Data aplikací
2014-06-27 11:39 - 2011-12-08 18:39 - 00000000 ___HD () C:\Documents and Settings\admin\Local Settings\Data aplikací
2014-06-27 11:39 - 2011-12-08 17:14 - 00000178 ___SH () C:\Documents and Settings\UpdatusUser\ntuser.ini
2014-06-27 11:39 - 2011-12-08 00:59 - 00000000 __RHD () C:\Documents and Settings\PC\Data aplikací
2014-06-27 11:39 - 2011-12-08 00:59 - 00000000 ___HD () C:\Documents and Settings\PC\Local Settings\Data aplikací
2014-06-27 11:32 - 2011-12-08 17:58 - 00000932 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-27 11:01 - 2011-12-08 19:20 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\Skype
2014-06-27 10:13 - 2013-11-20 15:39 - 00000000 ____D () C:\Program Files\trend micro
2014-06-27 10:10 - 2013-08-11 17:10 - 00000452 _____ () C:\WINDOWS\Tasks\At1.job
2014-06-27 09:22 - 2013-12-24 18:46 - 00000376 _____ () C:\WINDOWS\Tasks\update-S-1-5-21-1292428093-1965331169-682003330-1006.job
2014-06-27 09:11 - 2012-05-13 18:46 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\David
2014-06-27 09:11 - 2011-12-08 18:39 - 00000000 ____D () C:\Documents and Settings\admin\Plocha
2014-06-27 00:14 - 2014-06-27 00:14 - 00000060 _____ () C:\WINDOWS\setupact.log
2014-06-27 00:14 - 2014-06-27 00:14 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-06-27 00:10 - 2011-12-07 19:06 - 00000000 ____D () C:\WINDOWS\system32\Restore
2014-06-26 23:48 - 2013-07-06 20:53 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\.minecraft
2014-06-26 23:48 - 2011-12-08 18:39 - 00000000 ___RD () C:\Documents and Settings\admin\Nabídka Start\Programy
2014-06-26 23:39 - 2014-06-26 23:39 - 00027438 ____H () C:\treeinfo.wc
2014-06-26 23:24 - 2014-06-26 23:24 - 00016821 _____ () C:\Documents and Settings\admin\Plocha\ChestCommands-BB.rar
2014-06-26 22:20 - 2014-06-26 18:52 - 00011406 _____ () C:\Documents and Settings\admin\Plocha\Plná moc k přepisu vozidla.odt
2014-06-26 20:40 - 2013-08-11 17:10 - 00000452 _____ () C:\WINDOWS\Tasks\At2.job
2014-06-26 19:59 - 2012-03-20 15:12 - 00002283 _____ () C:\Documents and Settings\All Users\Plocha\Skype.lnk
2014-06-26 17:59 - 2014-06-26 17:55 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\ChestCommands-Kity
2014-06-26 17:10 - 2013-08-11 17:10 - 00000452 _____ () C:\WINDOWS\Tasks\At3.job
2014-06-26 14:00 - 2013-08-11 17:10 - 00000452 _____ () C:\WINDOWS\Tasks\At4.job
2014-06-25 01:28 - 2014-06-25 01:27 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\LogMeIn Hamachi
2014-06-25 01:28 - 2014-05-17 23:35 - 00011620 _____ () C:\WINDOWS\setupapi.log
2014-06-25 00:27 - 2014-06-24 22:12 - 00001611 _____ () C:\Documents and Settings\admin\Plocha\Pravidla.txt
2014-06-24 23:59 - 2014-06-24 23:59 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\Nová složka
2014-06-24 21:06 - 2011-12-08 18:42 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\GHISLER
2014-06-22 23:08 - 2014-06-22 23:01 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\Notepad++
2014-06-22 23:01 - 2014-06-22 23:01 - 00000615 _____ () C:\Documents and Settings\admin\Plocha\Notepad++.lnk
2014-06-22 23:01 - 2014-06-22 23:01 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Notepad++
2014-06-22 23:01 - 2014-06-22 23:01 - 00000000 ____D () C:\Documents and Settings\admin\Nabídka Start\Programy\Notepad++
2014-06-22 22:59 - 2011-12-11 19:24 - 00342528 ___SH () C:\Documents and Settings\admin\Plocha\Thumbs.db
2014-06-22 12:34 - 2008-04-14 13:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-06-21 16:52 - 2012-02-02 19:51 - 00000000 ____D () C:\WINDOWS\Microsoft.NET
2014-06-21 13:32 - 2012-09-28 16:37 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\TS3Client
2014-06-21 13:01 - 2011-12-07 19:54 - 01231878 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-06-17 20:57 - 2014-06-17 20:57 - 00335360 _____ () C:\Documents and Settings\admin\Plocha\Vestibul.ppt
2014-06-17 16:24 - 2012-09-14 14:47 - 00000565 _____ () C:\Documents and Settings\All Users\Plocha\DAEMON Tools Lite.lnk
2014-06-16 21:36 - 2014-05-17 23:34 - 00022328 _____ () C:\WINDOWS\system32\Drivers\PnkBstrK.sys
2014-06-16 21:36 - 2012-05-14 13:17 - 00103736 _____ () C:\WINDOWS\system32\PnkBstrB.exe
2014-06-15 17:17 - 2011-12-08 18:49 - 00000000 ____D () C:\Documents and Settings\admin\Data aplikací\vlc
2014-06-14 13:04 - 2013-07-27 13:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-14 13:01 - 2012-02-23 13:34 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-13 22:28 - 2011-12-08 17:59 - 00001813 _____ () C:\Documents and Settings\All Users\Plocha\Google Chrome.lnk
2014-06-12 23:17 - 2011-12-10 20:46 - 00085504 _____ () C:\Documents and Settings\admin\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-12 17:54 - 2012-02-17 00:46 - 00001324 _____ () C:\WINDOWS\system32\d3d9caps.dat
2014-06-12 13:30 - 2013-01-07 00:42 - 00000000 ___RD () C:\Documents and Settings\admin\Plocha\Hry
2014-06-11 17:49 - 2012-04-25 09:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-11 08:27 - 2014-06-11 08:26 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-08 15:06 - 2014-03-23 13:13 - 00000216 _____ () C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
2014-06-06 21:14 - 2014-05-17 22:19 - 00000000 ____D () C:\Documents and Settings\admin\Plocha\CALL-OF-DUTY-4-Modern-Warfare+(CZ).L79
2014-06-03 09:32 - 2013-12-24 18:46 - 00000502 _____ () C:\Documents and Settings\admin\Local Settings\Data aplikací\UserProducts.xml
2014-06-03 09:14 - 2013-12-24 18:45 - 00000000 ____D () C:\Documents and Settings\admin\Nabídka Start\Programy\LightShot
2014-06-02 22:01 - 2014-06-02 22:01 - 00000000 ____D () C:\Documents and Settings\NetworkService\Nabídka Start\Programy
2014-06-02 22:01 - 2014-06-02 22:01 - 00000000 ____D () C:\Documents and Settings\NetworkService\Nabídka Start
2014-06-02 22:01 - 2011-12-07 19:11 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2014-05-30 22:03 - 2014-05-30 22:03 - 00000000 _____ () C:\Documents and Settings\admin\Plocha\Nový objekt - Textový dokument (2).txt
2014-05-30 21:57 - 2014-05-30 21:57 - 00000556 _____ () C:\Documents and Settings\admin\Plocha\EVEREST Ultimate Edition.lnk
2014-05-30 21:57 - 2014-05-30 21:57 - 00000000 ____D () C:\Documents and Settings\All Users\Nabídka Start\Programy\Lavalys
2014-05-30 15:41 - 2014-05-30 15:41 - 00000533 _____ () C:\Documents and Settings\admin\Plocha\Fraps.lnk
2014-05-30 15:41 - 2014-05-30 15:41 - 00000000 ____D () C:\Documents and Settings\admin\Nabídka Start\Programy\Fraps
2014-05-30 10:32 - 2014-05-30 10:26 - 116106267 _____ () C:\Documents and Settings\admin\Plocha\Hrdina-počítačový-hry-jde-do-světa.zip

Files to move or delete:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job


Some content of TEMP:
====================
C:\Documents and Settings\admin\Local Settings\Temp\AcDeltree.exe
C:\Documents and Settings\admin\Local Settings\Temp\APNStub.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRun.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRunGUI.dll
C:\Documents and Settings\admin\Local Settings\Temp\CojLauncher.exe
C:\Documents and Settings\admin\Local Settings\Temp\drm_dialogs.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7300015.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7370014.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7380007.dll
C:\Documents and Settings\admin\Local Settings\Temp\eauninstall.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-1.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-2.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-3.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-4.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-5.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-6.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-7.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-8.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-9.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe.exe
C:\Documents and Settings\admin\Local Settings\Temp\FNP_ACT_InstallerCA.dll
C:\Documents and Settings\admin\Local Settings\Temp\InstallManager_GEN_GEN.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u3-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u5-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u7-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u9-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\primosdk.DLL
C:\Documents and Settings\admin\Local Settings\Temp\px.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxafs.dll
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxdrv.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxhpinst.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxmas.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxsetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxsfs.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxwave.dll
C:\Documents and Settings\admin\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\admin\Local Settings\Temp\setup.exe
C:\Documents and Settings\admin\Local Settings\Temp\SkypeSetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\The Sims 2_uninst.exe
C:\Documents and Settings\admin\Local Settings\Temp\vxblock.dll
C:\Documents and Settings\admin\Local Settings\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s viry. Bit Coiner, Dropper - gen

#8 Příspěvek od vyosek »

:arrow: Je to chybna detekce, pozadame opet Avast o vyjmuti z databaze

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [LogMeIn Hamachi Ui] => D:\Programy\Hamachi\hamachi-2-ui.exe [3816272 2014-06-23] (LogMeIn Inc.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\MountPoints2: {f72e8a83-fe65-11e1-98bd-002421f0d638} - F:\setup\rsrc\Autorun.exe

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
URLSearchHook: HKCU - (No Name) - {95289393-33EA-4F8D-B952-483415B9C955} - No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - E478E738E0594F9CAB782E50909E5983 URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {CD6A975A-A823-49CD-8B23-3D6E77641E29} URL = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=U3&apn_dtid=OSJ000YYCZ&apn_uid=558448A9-CC68-4238-B89C-2BE0860C92B0&apn_sauid=A582A7B7-7F43-4607-A443-9AB8B43BC1E3

FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing 
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]

CHR HomePage:
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: http://www.bing.com/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-08-04]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]

R2 Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3275136 2013-10-09] (Skype Technologies S.A.)

C:\WINDOWS\inf\mncgtghxg.vbe
C:\WINDOWS\system32\msstp.vbe
2014-06-27 11:38 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\system32\sqlite3.dll
2014-06-27 11:36 - 2014-06-27 11:39 - 00000000 ____D () C:\AdwCleaner
2014-06-27 00:14 - 2014-06-27 00:14 - 00000060 _____ () C:\WINDOWS\setupact.log
2014-06-27 00:14 - 2014-06-27 00:14 - 00000000 _____ () C:\WINDOWS\setuperr.log
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job
C:\Documents and Settings\admin\Local Settings\Temp\AcDeltree.exe
C:\Documents and Settings\admin\Local Settings\Temp\APNStub.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRun.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRunGUI.dll
C:\Documents and Settings\admin\Local Settings\Temp\CojLauncher.exe
C:\Documents and Settings\admin\Local Settings\Temp\drm_dialogs.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7300015.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7370014.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7380007.dll
C:\Documents and Settings\admin\Local Settings\Temp\eauninstall.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-1.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-2.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-3.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-4.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-5.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-6.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-7.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-8.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-9.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe.exe
C:\Documents and Settings\admin\Local Settings\Temp\FNP_ACT_InstallerCA.dll
C:\Documents and Settings\admin\Local Settings\Temp\InstallManager_GEN_GEN.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u3-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u5-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u7-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u9-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\primosdk.DLL
C:\Documents and Settings\admin\Local Settings\Temp\px.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxafs.dll
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxdrv.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxhpinst.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxmas.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxsetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxsfs.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxwave.dll
C:\Documents and Settings\admin\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\admin\Local Settings\Temp\setup.exe
C:\Documents and Settings\admin\Local Settings\Temp\SkypeSetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\The Sims 2_uninst.exe
C:\Documents and Settings\admin\Local Settings\Temp\vxblock.dll
C:\Documents and Settings\admin\Local Settings\Temp\xmlUpdater.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f
REG: reg delete "REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mncgtghxgSrv" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSStp" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NPSStartup" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Autoupdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Service 16" /f

Hosts:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#9 Příspěvek od Wraith »

Cituji: Přesuňte vytvořený fixlist vedle FRST.
Mám fixlist vložit do složky s názvem FRST? nebo k FRST.exe?
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#10 Příspěvek od Wraith »

Mám to...

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:25-06-2014
Ran by admin at 2014-06-27 12:25:28 Run:1
Running from C:\Documents and Settings\admin\Dokumenty\Stažené soubory
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [LogMeIn Hamachi Ui] => D:\Programy\Hamachi\hamachi-2-ui.exe [3816272 2014-06-23] (LogMeIn Inc.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\...\MountPoints2: {f72e8a83-fe65-11e1-98bd-002421f0d638} - F:\setup\rsrc\Autorun.exe

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
URLSearchHook: HKCU - (No Name) - {95289393-33EA-4F8D-B952-483415B9C955} - No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - E478E738E0594F9CAB782E50909E5983 URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {95289393-33EA-4F8D-B952-483415B9C955} URL = http://search.qip.ru/?query={searchTerms}
SearchScopes: HKCU - {CD6A975A-A823-49CD-8B23-3D6E77641E29} URL = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=U3&apn_dtid=OSJ000YYCZ&apn_uid=558448A9-CC68-4238-B89C-2BE0860C92B0&apn_sauid=A582A7B7-7F43-4607-A443-9AB8B43BC1E3

FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-06-11]

CHR HomePage:
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: http://www.bing.com/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-08-04]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]

R2 Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3275136 2013-10-09] (Skype Technologies S.A.)

C:\WINDOWS\inf\mncgtghxg.vbe
C:\WINDOWS\system32\msstp.vbe
2014-06-27 11:38 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\system32\sqlite3.dll
2014-06-27 11:36 - 2014-06-27 11:39 - 00000000 ____D () C:\AdwCleaner
2014-06-27 00:14 - 2014-06-27 00:14 - 00000060 _____ () C:\WINDOWS\setupact.log
2014-06-27 00:14 - 2014-06-27 00:14 - 00000000 _____ () C:\WINDOWS\setuperr.log
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job
C:\Documents and Settings\admin\Local Settings\Temp\AcDeltree.exe
C:\Documents and Settings\admin\Local Settings\Temp\APNStub.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRun.exe
C:\Documents and Settings\admin\Local Settings\Temp\AutoRunGUI.dll
C:\Documents and Settings\admin\Local Settings\Temp\CojLauncher.exe
C:\Documents and Settings\admin\Local Settings\Temp\drm_dialogs.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7300015.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7370014.dll
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7380007.dll
C:\Documents and Settings\admin\Local Settings\Temp\eauninstall.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-1.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-2.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-3.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-4.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-5.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-6.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-7.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-8.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-9.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe.exe
C:\Documents and Settings\admin\Local Settings\Temp\FNP_ACT_InstallerCA.dll
C:\Documents and Settings\admin\Local Settings\Temp\InstallManager_GEN_GEN.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u3-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u5-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u7-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u9-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\primosdk.DLL
C:\Documents and Settings\admin\Local Settings\Temp\px.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxafs.dll
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxdrv.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxhpinst.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsA64.exe
C:\Documents and Settings\admin\Local Settings\Temp\PxInsI64.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxmas.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxsetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\pxsfs.dll
C:\Documents and Settings\admin\Local Settings\Temp\pxwave.dll
C:\Documents and Settings\admin\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\admin\Local Settings\Temp\setup.exe
C:\Documents and Settings\admin\Local Settings\Temp\SkypeSetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\The Sims 2_uninst.exe
C:\Documents and Settings\admin\Local Settings\Temp\vxblock.dll
C:\Documents and Settings\admin\Local Settings\Temp\xmlUpdater.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f
REG: reg delete "REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mncgtghxgSrv" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSStp" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NPSStartup" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Autoupdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Service 16" /f

Hosts:
Reboot:
End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\LogMeIn Hamachi Ui => value deleted successfully.
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
HKU\S-1-5-21-1292428093-1965331169-682003330-1006\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => value deleted successfully.
'HKU\S-1-5-21-1292428093-1965331169-682003330-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f72e8a83-fe65-11e1-98bd-002421f0d638}' => Key deleted successfully.
'HKCR\CLSID\{f72e8a83-fe65-11e1-98bd-002421f0d638}'=> Key not found.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Bar => value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{95289393-33EA-4F8D-B952-483415B9C955} => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
'HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95289393-33EA-4F8D-B952-483415B9C955}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\E478E738E0594F9CAB782E50909E5983' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\E478E738E0594F9CAB782E50909E5983'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95289393-33EA-4F8D-B952-483415B9C955}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{95289393-33EA-4F8D-B952-483415B9C955}'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CD6A975A-A823-49CD-8B23-3D6E77641E29}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{CD6A975A-A823-49CD-8B23-3D6E77641E29}'=> Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.3 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox Keyword.URL deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} => Moved successfully.
C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} => Moved successfully.
CHR DefaultSearchKeyword: bing.com ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchProvider: Bing ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: http://www.bing.com/search?q={searchTerms} ==> The Chrome "Settings" can be used to fix the entry.
C:\Documents and Settings\admin\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl => Moved successfully.
'HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl' => Key deleted successfully.
C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx => Moved successfully.
Skype C2C Service => Service stopped successfully.
Skype C2C Service => Service deleted successfully.
"C:\WINDOWS\inf\mncgtghxg.vbe" => File/Directory not found.
C:\WINDOWS\system32\msstp.vbe => Moved successfully.
C:\WINDOWS\system32\sqlite3.dll => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\WINDOWS\setupact.log => Moved successfully.
C:\WINDOWS\setuperr.log => Moved successfully.
C:\Windows\Tasks\At1.job => Moved successfully.
C:\Windows\Tasks\At2.job => Moved successfully.
C:\Windows\Tasks\At3.job => Moved successfully.
C:\Windows\Tasks\At4.job => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\AcDeltree.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\APNStub.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\AutoRun.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\AutoRunGUI.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\CojLauncher.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\drm_dialogs.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7300015.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7370014.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\drm_dyndata_7380007.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\eauninstall.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-1.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-2.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-3.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-4.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-5.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-6.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-7.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-8.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe-9.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\FNP_ACT_InstallerCA.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\InstallManager_GEN_GEN.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u3-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u5-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u7-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u9-windows-i586-iftw.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\primosdk.DLL => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\px.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxafs.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyA64.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\PxCpyI64.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxdrv.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxhpinst.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\PxInsA64.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\PxInsI64.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxmas.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxsetup.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxsfs.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\pxwave.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\Quarantine.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\setup.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\SkypeSetup.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\The Sims 2_uninst.exe => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\vxblock.dll => Moved successfully.
C:\Documents and Settings\admin\Local Settings\Temp\xmlUpdater.exe => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper" /f =========



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mncgtghxgSrv" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSStp" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NPSStartup" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Autoupdate" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zoner Photo Studio Service 16" /f =========


Operace byla dokončena úspěšně.


========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.


The system needed a reboot.

==== End of Fixlog ====
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s viry. Bit Coiner, Dropper - gen

#11 Příspěvek od vyosek »

Tak jeste uklidime :James008:

:arrow: T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Wraith
Návštěvník
Návštěvník
Příspěvky: 19
Registrován: 27 Črv 2014 07:54

Re: Problém s viry. Bit Coiner, Dropper - gen

#12 Příspěvek od Wraith »

Mohl bych se ještě zeptat, v jaké fázi se ztratil vir? Jinak děkuji moc za spolupráci
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s viry. Bit Coiner, Dropper - gen

#13 Příspěvek od vyosek »

:arrow: Vir jsme smazali tim skriptem pro FRST

Nemate zac, rad jsem pomohl :worship: Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat :lock:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“