Conhost.exe

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#16 Příspěvek od Trauten »

Naughty napsal::arrow: Vytvoř textový soubor mající obsah:


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"System-boot"=-

File::
c:\windows\inf\poclbm.exe
c:\windows\inf\SYSTEM-x32.exe
c:\windows\inf\system32-x86.exe


FileLook::
c:\windows\system32\nvspcap64.dll


ulož jako CFScript


Chytni myši soubor CFScript a přetáhni ho nad ikonu ComboFix-u. Až se překryjí pusť. Dojde jakoby k opětovné instalaci CF, potvrzuj dialogové hlášky CF, po ukončení se otevře texták, jeho report sem zkopíruj.

Pro dnesek uz koncim, zitra napisu co dal. Ty me mezitim dej log z Combofixu a pokus se vytvorit z FRST. Napis mi i stav PC.

Zatim :bye:
omlovám se ale tento pokyn je na mě složitý
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#17 Příspěvek od Trauten »

Trauten napsal:
Naughty napsal::arrow: Vytvoř textový soubor mající obsah:


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"System-boot"=-

File::
c:\windows\inf\poclbm.exe
c:\windows\inf\SYSTEM-x32.exe
c:\windows\inf\system32-x86.exe


FileLook::
c:\windows\system32\nvspcap64.dll


ulož jako CFScript


Chytni myši soubor CFScript a přetáhni ho nad ikonu ComboFix-u. Až se překryjí pusť. Dojde jakoby k opětovné instalaci CF, potvrzuj dialogové hlášky CF, po ukončení se otevře texták, jeho report sem zkopíruj.

Pro dnesek uz koncim, zitra napisu co dal. Ty me mezitim dej log z Combofixu a pokus se vytvorit z FRST. Napis mi i stav PC.

Zatim :bye:
omlovám se ale tento pokyn je na mě složitý
omlouvám se za paniku, při podrobnějším přečtení mi bylo jasno co mám dělat :)
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#18 Příspěvek od Trauten »

ComboFix 14-10-21.01 - Semerádovi 23.10.2014 21:07:05.2.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8183.6811 [GMT 2:00]
Spuštěný z: c:\users\Semerßdovi\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Semerßdovi\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-09-23 do 2014-10-23 )))))))))))))))))))))))))))))))
.
.
2014-10-23 19:09 . 2014-10-23 19:09 -------- d-----w- c:\users\Semer dovi\AppData\Local\temp
2014-10-23 19:09 . 2014-10-23 19:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-23 17:35 . 2014-10-23 17:41 -------- d-----w- c:\program files (x86)\trend micro
2014-10-23 17:29 . 2014-10-23 17:29 -------- d-----w- C:\rsit
2014-10-23 17:29 . 2014-10-23 17:29 -------- d-----w- c:\program files\trend micro
2014-10-23 16:26 . 2014-10-23 16:26 -------- d-----w- c:\programdata\Malwarebytes
2014-10-23 16:13 . 2014-10-23 16:13 18432 ----a-w- c:\windows\SysWow64\corpol.dll
2014-10-23 16:13 . 2014-10-23 16:13 73216 ----a-w- c:\windows\SysWow64\admparse.dll
2014-10-23 16:11 . 2014-10-23 16:11 -------- d-----w- c:\program files (x86)\DLLSuite
2014-10-23 15:22 . 2014-10-23 15:25 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\Solvusoft
2014-10-22 16:40 . 2014-10-16 12:27 614544 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-10-21 14:29 . 2014-10-21 14:29 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\poclbm
2014-10-20 17:11 . 2014-10-20 17:11 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\NVIDIA
2014-10-20 16:46 . 2014-10-23 14:50 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\uTorrent
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-20 17:11 . 2014-10-20 17:11 454144 ----a-w- c:\windows\inf\SYSTEM-x32.exe
2014-10-20 17:11 . 2014-10-20 17:11 24064 ----a-w- c:\windows\inf\poclbm.exe
2014-10-20 17:11 . 2014-10-20 17:11 479744 ----a-w- c:\windows\inf\wxmsw28uh_html_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 3165184 ----a-w- c:\windows\inf\wxmsw28uh_core_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 730112 ----a-w- c:\windows\inf\wxmsw28uh_adv_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 1300992 ----a-w- c:\windows\inf\wxbase28uh_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 122368 ----a-w- c:\windows\inf\wxbase28uh_net_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 110080 ----a-w- c:\windows\inf\pywintypes27.dll
2014-10-20 17:11 . 2014-10-20 17:11 2303488 ----a-w- c:\windows\inf\python27.dll
2014-10-20 17:10 . 2014-10-20 17:10 569680 ----a-w- c:\windows\inf\msvcp90.dll
2014-10-20 17:10 . 2014-10-20 17:10 212992 ----a-w- c:\windows\inf\system32-x86.exe
2014-10-20 17:10 . 2014-10-20 17:10 219648 ----a-w- c:\windows\inf\boost_python-vc90-mt-1_48.dll
2014-10-20 17:10 . 2014-10-20 17:10 64000 ----a-w- c:\windows\inf\MPR.dll
2014-10-20 17:10 . 2014-10-20 17:10 4096 ----a-w- c:\windows\inf\API-MS-Win-Core-LocalRegistry-L1-1-0.dll
2014-10-16 16:54 . 2014-09-19 19:19 72904 ----a-w- c:\windows\system32\OpenCL.dll
2014-10-16 16:54 . 2014-09-19 19:19 60560 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-10-16 16:54 . 2014-09-19 19:18 987008 ----a-w- c:\windows\system32\nvumdshimx.dll
2014-10-16 16:54 . 2014-09-19 19:18 3237528 ----a-w- c:\windows\system32\nvapi64.dll
2014-10-16 16:54 . 2014-09-19 19:18 2849224 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-10-16 16:54 . 2014-09-19 19:18 20968040 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-10-16 16:54 . 2014-09-19 19:18 19966856 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-10-16 16:54 . 2014-09-19 19:18 18499648 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-10-16 16:54 . 2014-09-19 19:18 16886168 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-10-16 14:11 . 2014-09-19 19:19 3533632 ----a-w- c:\windows\system32\nvsvc64.dll
2014-10-16 14:11 . 2014-09-19 19:19 6883136 ----a-w- c:\windows\system32\nvcpl.dll
2014-10-16 14:11 . 2014-09-19 19:19 933064 ----a-w- c:\windows\system32\nvvsvc.exe
2014-10-16 14:11 . 2014-09-19 19:19 61640 ----a-w- c:\windows\system32\nvshext.dll
2014-10-16 14:11 . 2014-09-19 19:19 2559808 ----a-w- c:\windows\system32\nvsvcr.dll
2014-10-16 14:11 . 2014-09-19 19:19 384200 ----a-w- c:\windows\system32\nvmctray.dll
2014-10-15 00:48 . 2014-09-19 19:19 4047877 ----a-w- c:\windows\system32\nvcoproc.bin
2014-10-04 06:42 . 2014-09-10 15:27 2197680 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-10-04 06:42 . 2014-09-10 15:27 1291280 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2014-10-04 06:41 . 2014-09-10 15:27 2800296 ----a-w- c:\windows\system32\nvspcap64.dll
2014-10-04 06:41 . 2014-09-10 15:27 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll
2014-09-22 06:42 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-17 04:51 . 2014-09-19 19:18 31520 ----a-w- c:\windows\system32\nvhdap64.dll
2014-09-17 04:51 . 2014-09-19 19:18 197408 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2014-09-17 04:51 . 2014-09-19 19:18 1538880 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2014-09-13 23:48 . 2014-09-19 19:18 1876296 ----a-w- c:\windows\system32\nvdispco6434411.dll
2014-09-13 23:48 . 2014-09-19 19:18 1539272 ----a-w- c:\windows\system32\nvdispgenco6434411.dll
2014-09-04 19:14 . 2014-09-19 19:10 38048 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2014-09-04 19:14 . 2014-09-19 19:10 32416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2014-09-04 19:14 . 2014-09-10 15:24 34976 ----a-w- c:\windows\system32\nvaudcap64v.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"System-boot"="c:\windows\inf\SYSTEM-x32.exe" [2014-10-20 454144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 cpuz128;cpuz128;c:\users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys;c:\users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 OXUDIDRV;OXUDIDRV;c:\windows\system32\Drivers\OXUDIDRV_X64.sys;c:\windows\SYSNATIVE\Drivers\OXUDIDRV_X64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - NisDrv
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-10-04 2463552]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-10-04 2800296]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://intranet.humlak.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-7go - c:\program files (x86)\7go\uninst.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-10-23 21:10:07
ComboFix-quarantined-files.txt 2014-10-23 19:10
ComboFix2.txt 2014-10-23 18:19
.
Před spuštěním: Volných bajtů: 13 050 322 944
Po spuštění: Volných bajtů: 12 852 776 960
.
- - End Of File - - EDADD3E5A63176BD547666C50C42107A
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#19 Příspěvek od Trauten »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Semerádovi at 2014-10-23 21:13:48
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 12 GB (10%) free of 122 GB
Total RAM: 8183 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:13:49, on 23.10.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16618)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Semerádovi\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Semerádovi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [System-boot] C:\Windows\inf\SYSTEM-x32.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5877 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://intranet.humlak.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn/npbattlelog,version=2.3.2]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default\searchplugins\
ask-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-09-23 926896]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"System-boot"=C:\Windows\inf\SYSTEM-x32.exe [2014-10-20 454144]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.FFDS"=ff_vfw.dll
"VIDC.X264"=x264vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-10-23 21:10:10 ----SHD---- C:\$RECYCLE.BIN
2014-10-23 21:10:08 ----D---- C:\Windows\temp
2014-10-23 21:10:07 ----A---- C:\ComboFix.txt
2014-10-23 20:15:24 ----A---- C:\Windows\zip.exe
2014-10-23 20:15:24 ----A---- C:\Windows\SWSC.exe
2014-10-23 20:15:24 ----A---- C:\Windows\SWREG.exe
2014-10-23 20:15:24 ----A---- C:\Windows\sed.exe
2014-10-23 20:15:24 ----A---- C:\Windows\PEV.exe
2014-10-23 20:15:24 ----A---- C:\Windows\NIRCMD.exe
2014-10-23 20:15:24 ----A---- C:\Windows\MBR.exe
2014-10-23 20:15:24 ----A---- C:\Windows\grep.exe
2014-10-23 20:11:44 ----D---- C:\Qoobox
2014-10-23 20:11:39 ----D---- C:\Windows\erdnt
2014-10-23 19:35:38 ----D---- C:\Program Files (x86)\trend micro
2014-10-23 19:29:25 ----D---- C:\rsit
2014-10-23 18:26:32 ----D---- C:\ProgramData\Malwarebytes
2014-10-23 18:13:12 ----A---- C:\Windows\SysWOW64\mstime.dll
2014-10-23 18:13:10 ----A---- C:\Windows\SysWOW64\ieakui.dll
2014-10-23 18:13:07 ----A---- C:\Windows\SysWOW64\ieaksie.dll
2014-10-23 18:13:05 ----A---- C:\Windows\SysWOW64\ieakeng.dll
2014-10-23 18:13:03 ----A---- C:\Windows\SysWOW64\corpol.dll
2014-10-23 18:13:01 ----A---- C:\Windows\SysWOW64\admparse.dll
2014-10-23 18:12:59 ----A---- C:\Windows\SysWOW64\ie4uinit.exe
2014-10-23 18:11:46 ----D---- C:\Program Files (x86)\DLLSuite
2014-10-23 17:22:32 ----D---- C:\Users\Semerádovi\AppData\Roaming\Solvusoft
2014-10-22 18:40:56 ----A---- C:\Windows\SysWOW64\nvStreaming.exe
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvumdshim.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvopencl.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvoglv32.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvoglshim32.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvinit.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvIFR.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvFBC.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcuvid.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcuda.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcompiler.dll
2014-10-21 16:29:08 ----D---- C:\Users\Semerádovi\AppData\Roaming\poclbm
2014-10-20 19:11:46 ----D---- C:\Users\Semerádovi\AppData\Roaming\NVIDIA
2014-10-20 18:46:27 ----D---- C:\Users\Semerádovi\AppData\Roaming\uTorrent
2014-09-25 08:35:18 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2014-10-23 21:10:08 ----D---- C:\Windows
2014-10-23 21:09:22 ----A---- C:\Windows\system.ini
2014-10-23 21:08:10 ----D---- C:\Windows\SysWOW64\drivers
2014-10-23 21:08:10 ----D---- C:\Windows\SysWOW64
2014-10-23 21:08:10 ----D---- C:\Windows\AppPatch
2014-10-23 21:08:09 ----D---- C:\Program Files (x86)\Common Files
2014-10-23 20:15:28 ----SHD---- C:\System Volume Information
2014-10-23 20:14:49 ----SHD---- C:\Windows\Installer
2014-10-23 20:14:49 ----RD---- C:\Program Files
2014-10-23 20:14:43 ----RD---- C:\Program Files (x86)
2014-10-23 20:13:43 ----D---- C:\Windows\System32
2014-10-23 20:13:43 ----D---- C:\Windows\inf
2014-10-23 20:07:48 ----D---- C:\ProgramData\NVIDIA
2014-10-23 20:07:47 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-23 20:00:29 ----SD---- C:\ProgramData\Microsoft
2014-10-23 20:00:29 ----D---- C:\ProgramData\Spybot - Search & Destroy
2014-10-23 18:46:31 ----D---- C:\Windows\Microsoft.NET
2014-10-23 18:46:09 ----A---- C:\Windows\SysWOW64\logfile.txt
2014-10-23 18:46:00 ----D---- C:\ProgramData
2014-10-23 17:55:31 ----D---- C:\Windows\Minidump
2014-10-23 17:25:15 ----D---- C:\Windows\Tasks
2014-10-22 18:41:00 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\OpenCL.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvwgf2um.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvd3dum.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvapi.dll
2014-10-04 08:42:47 ----A---- C:\Windows\SysWOW64\nvspcap.dll
2014-10-04 08:42:47 ----A---- C:\Windows\SysWOW64\nvspbridge.dll
2014-09-28 08:28:00 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-26 21:27:52 ----D---- C:\Users\Semerádovi\AppData\Roaming\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys []
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys []
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-10-04 20288]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys []
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz128;cpuz128; \??\C:\Users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 OXUDIDRV;OXUDIDRV; \??\C:\Windows\system32\Drivers\OXUDIDRV_X64.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys []
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys []
S3 WinUSB;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUSB.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-10-04 1149760]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-10-04 1796928]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-10-04 19440960]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-10-16 410952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-25 114288]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-11-26 569768]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
Nahoru
Avatar uživatele
cernohous13
VIP in memoriam
VIP in memoriam
Příspěvky: 8720
Registrován: 09 Pro 2006 06:19
Místo/Bydliště: Jablonec nad Nisou
Kontaktovat uživatele:
Kontaktovat uživatele cernohous13

Re: Conhost.exe

#20 Příspěvek od cernohous13 »

Zdravím a omlouvám se kolegovi za vstup :oops:

CF neuznává diakritiku "Spuštěný z: c:\users\Semerßdovi\Desktop\ComboFix.exe"
a proto nemazal

Přesuň oba soubory (ComboFix.exe + CFScript.txt) přímo na C:\
a operaci opakuj

:hide:
Doporučení:
V průběhu léčení prováděj nové instalace a odinstalace jen na můj pokyn.
Důkladně prostuduj a proveď celou operaci podle mé odpovědi.
V případě nejasností se zeptej - vysvětlím Obrázek

-------------------------------------------------------------------------------------------------
> Podpora fóra <
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#21 Příspěvek od Trauten »

cernohous13 napsal:Zdravím a omlouvám se kolegovi za vstup :oops:

CF neuznává diakritiku "Spuštěný z: c:\users\Semerßdovi\Desktop\ComboFix.exe"
a proto nemazal

Přesuň oba soubory (ComboFix.exe + CFScript.txt) přímo na C:\
a operaci opakuj

:hide:
Ahoj,
děkuju za radu, jdu to zkusit :worship:
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#22 Příspěvek od Trauten »

ComboFix 14-10-24.01 - Semerádovi 24.10.2014 18:22:47.3.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8183.7219 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\inf\poclbm.exe"
"c:\windows\inf\SYSTEM-x32.exe"
"c:\windows\inf\system32-x86.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\inf\poclbm.exe
c:\windows\inf\SYSTEM-x32.exe
c:\windows\inf\system32-x86.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-09-24 do 2014-10-24 )))))))))))))))))))))))))))))))
.
.
2014-10-24 16:25 . 2014-10-24 16:25 -------- d-----w- c:\users\Semer dovi\AppData\Local\temp
2014-10-24 16:25 . 2014-10-24 16:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-23 17:35 . 2014-10-23 19:13 -------- d-----w- c:\program files (x86)\trend micro
2014-10-23 17:29 . 2014-10-23 17:29 -------- d-----w- C:\rsit
2014-10-23 17:29 . 2014-10-23 17:29 -------- d-----w- c:\program files\trend micro
2014-10-23 16:26 . 2014-10-23 16:26 -------- d-----w- c:\programdata\Malwarebytes
2014-10-23 16:13 . 2014-10-23 16:13 18432 ----a-w- c:\windows\SysWow64\corpol.dll
2014-10-23 16:13 . 2014-10-23 16:13 73216 ----a-w- c:\windows\SysWow64\admparse.dll
2014-10-23 16:11 . 2014-10-23 16:11 -------- d-----w- c:\program files (x86)\DLLSuite
2014-10-23 15:22 . 2014-10-23 15:25 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\Solvusoft
2014-10-22 16:40 . 2014-10-16 12:27 614544 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-10-21 14:29 . 2014-10-21 14:29 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\poclbm
2014-10-20 17:11 . 2014-10-20 17:11 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\NVIDIA
2014-10-20 16:46 . 2014-10-23 14:50 -------- d-----w- c:\users\Semerádovi\AppData\Roaming\uTorrent
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-20 17:11 . 2014-10-20 17:11 479744 ----a-w- c:\windows\inf\wxmsw28uh_html_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 3165184 ----a-w- c:\windows\inf\wxmsw28uh_core_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 730112 ----a-w- c:\windows\inf\wxmsw28uh_adv_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 1300992 ----a-w- c:\windows\inf\wxbase28uh_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 122368 ----a-w- c:\windows\inf\wxbase28uh_net_vc.dll
2014-10-20 17:11 . 2014-10-20 17:11 110080 ----a-w- c:\windows\inf\pywintypes27.dll
2014-10-20 17:11 . 2014-10-20 17:11 2303488 ----a-w- c:\windows\inf\python27.dll
2014-10-20 17:10 . 2014-10-20 17:10 569680 ----a-w- c:\windows\inf\msvcp90.dll
2014-10-20 17:10 . 2014-10-20 17:10 219648 ----a-w- c:\windows\inf\boost_python-vc90-mt-1_48.dll
2014-10-20 17:10 . 2014-10-20 17:10 64000 ----a-w- c:\windows\inf\MPR.dll
2014-10-20 17:10 . 2014-10-20 17:10 4096 ----a-w- c:\windows\inf\API-MS-Win-Core-LocalRegistry-L1-1-0.dll
2014-10-16 16:54 . 2014-09-19 19:19 72904 ----a-w- c:\windows\system32\OpenCL.dll
2014-10-16 16:54 . 2014-09-19 19:19 60560 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-10-16 16:54 . 2014-09-19 19:18 987008 ----a-w- c:\windows\system32\nvumdshimx.dll
2014-10-16 16:54 . 2014-09-19 19:18 3237528 ----a-w- c:\windows\system32\nvapi64.dll
2014-10-16 16:54 . 2014-09-19 19:18 2849224 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-10-16 16:54 . 2014-09-19 19:18 20968040 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-10-16 16:54 . 2014-09-19 19:18 19966856 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-10-16 16:54 . 2014-09-19 19:18 18499648 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-10-16 16:54 . 2014-09-19 19:18 16886168 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-10-16 14:11 . 2014-09-19 19:19 3533632 ----a-w- c:\windows\system32\nvsvc64.dll
2014-10-16 14:11 . 2014-09-19 19:19 6883136 ----a-w- c:\windows\system32\nvcpl.dll
2014-10-16 14:11 . 2014-09-19 19:19 933064 ----a-w- c:\windows\system32\nvvsvc.exe
2014-10-16 14:11 . 2014-09-19 19:19 61640 ----a-w- c:\windows\system32\nvshext.dll
2014-10-16 14:11 . 2014-09-19 19:19 2559808 ----a-w- c:\windows\system32\nvsvcr.dll
2014-10-16 14:11 . 2014-09-19 19:19 384200 ----a-w- c:\windows\system32\nvmctray.dll
2014-10-15 00:48 . 2014-09-19 19:19 4047877 ----a-w- c:\windows\system32\nvcoproc.bin
2014-10-04 06:42 . 2014-09-10 15:27 2197680 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-10-04 06:42 . 2014-09-10 15:27 1291280 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2014-10-04 06:41 . 2014-09-10 15:27 2800296 ----a-w- c:\windows\system32\nvspcap64.dll
2014-10-04 06:41 . 2014-09-10 15:27 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll
2014-09-22 06:42 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-17 04:51 . 2014-09-19 19:18 31520 ----a-w- c:\windows\system32\nvhdap64.dll
2014-09-17 04:51 . 2014-09-19 19:18 197408 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2014-09-17 04:51 . 2014-09-19 19:18 1538880 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2014-09-13 23:48 . 2014-09-19 19:18 1876296 ----a-w- c:\windows\system32\nvdispco6434411.dll
2014-09-13 23:48 . 2014-09-19 19:18 1539272 ----a-w- c:\windows\system32\nvdispgenco6434411.dll
2014-09-04 19:14 . 2014-09-19 19:10 38048 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2014-09-04 19:14 . 2014-09-19 19:10 32416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2014-09-04 19:14 . 2014-09-10 15:24 34976 ----a-w- c:\windows\system32\nvaudcap64v.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\windows\system32\nvspcap64.dll ---
Company: NVIDIA Corporation
File Description: NVIDIA Capture Server Proxy
File Version: 16.13.56.0
Product Name: NVIDIA GeForce Experience
Copyright: (C) NVIDIA Corporation. All rights reserved.
Original Filename: nvspcap.dll
File size: 2800296
Created time: 2014-09-10 15:27
Modified time: 2014-10-04 06:41
MD5: 8B952D9F7E5E6452ED3727C2F062E403
SHA1: 7D490CA58EA050BE591FA4D9033D6FF426DFEA82
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 cpuz128;cpuz128;c:\users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys;c:\users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 OXUDIDRV;OXUDIDRV;c:\windows\system32\Drivers\OXUDIDRV_X64.sys;c:\windows\SYSNATIVE\Drivers\OXUDIDRV_X64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-10-04 2463552]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-10-04 2800296]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://intranet.humlak.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-7go - c:\program files (x86)\7go\uninst.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-10-24 18:25:56
ComboFix-quarantined-files.txt 2014-10-24 16:25
ComboFix2.txt 2014-10-23 19:10
ComboFix3.txt 2014-10-23 18:19
.
Před spuštěním: Volných bajtů: 12 816 531 456
Po spuštění: Volných bajtů: 12 760 911 872
.
- - End Of File - - CABB70774A3A69F058DB996D5BF03816
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#23 Příspěvek od Trauten »

v průběhu akce chtěl CF aktualizovat, tak snad jsem neudělal chybu když jsem mu to povolil :?:
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#24 Příspěvek od Trauten »

po restartu počítače to vypadá že problém kvůli kterému jsem vás oslovil je pryč :happy:
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#25 Příspěvek od Trauten »

Ahoj Naughty,

zasílám nový RSIT. Ale to CACLS se mi nějak nepodařilo.

Traut :-)
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#26 Příspěvek od Trauten »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Semerádovi at 2014-10-25 09:49:33
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 13 GB (11%) free of 122 GB
Total RAM: 8183 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:49:34, on 25.10.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16618)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe
C:\Games\World_of_Tanks\worldoftanks.exe
C:\Users\Semerádovi\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Semerádovi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5941 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://intranet.humlak.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn/npbattlelog,version=2.3.2]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\Semerádovi\AppData\Roaming\Mozilla\Firefox\Profiles\hw75imrc.default\searchplugins\
ask-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-09-23 926896]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.FFDS"=ff_vfw.dll
"VIDC.X264"=x264vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-10-24 18:26:00 ----SHD---- C:\$RECYCLE.BIN
2014-10-24 18:25:58 ----D---- C:\Windows\temp
2014-10-24 18:25:56 ----A---- C:\ComboFix.txt
2014-10-23 20:15:24 ----A---- C:\Windows\zip.exe
2014-10-23 20:15:24 ----A---- C:\Windows\SWSC.exe
2014-10-23 20:15:24 ----A---- C:\Windows\SWREG.exe
2014-10-23 20:15:24 ----A---- C:\Windows\sed.exe
2014-10-23 20:15:24 ----A---- C:\Windows\PEV.exe
2014-10-23 20:15:24 ----A---- C:\Windows\NIRCMD.exe
2014-10-23 20:15:24 ----A---- C:\Windows\MBR.exe
2014-10-23 20:15:24 ----A---- C:\Windows\grep.exe
2014-10-23 20:11:44 ----D---- C:\Qoobox
2014-10-23 20:11:39 ----D---- C:\Windows\erdnt
2014-10-23 20:10:33 ----R---- C:\ComboFix.exe
2014-10-23 19:35:38 ----D---- C:\Program Files (x86)\trend micro
2014-10-23 19:29:25 ----D---- C:\rsit
2014-10-23 18:26:32 ----D---- C:\ProgramData\Malwarebytes
2014-10-23 18:13:12 ----A---- C:\Windows\SysWOW64\mstime.dll
2014-10-23 18:13:10 ----A---- C:\Windows\SysWOW64\ieakui.dll
2014-10-23 18:13:07 ----A---- C:\Windows\SysWOW64\ieaksie.dll
2014-10-23 18:13:05 ----A---- C:\Windows\SysWOW64\ieakeng.dll
2014-10-23 18:13:03 ----A---- C:\Windows\SysWOW64\corpol.dll
2014-10-23 18:13:01 ----A---- C:\Windows\SysWOW64\admparse.dll
2014-10-23 18:12:59 ----A---- C:\Windows\SysWOW64\ie4uinit.exe
2014-10-23 18:11:46 ----D---- C:\Program Files (x86)\DLLSuite
2014-10-23 17:22:32 ----D---- C:\Users\Semerádovi\AppData\Roaming\Solvusoft
2014-10-22 18:40:56 ----A---- C:\Windows\SysWOW64\nvStreaming.exe
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvumdshim.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvopencl.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvoglv32.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvoglshim32.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvinit.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvIFR.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\NvFBC.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcuvid.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcuda.dll
2014-10-22 18:39:41 ----A---- C:\Windows\SysWOW64\nvcompiler.dll
2014-10-21 16:29:08 ----D---- C:\Users\Semerádovi\AppData\Roaming\poclbm
2014-10-20 19:11:46 ----D---- C:\Users\Semerádovi\AppData\Roaming\NVIDIA
2014-10-20 18:46:27 ----D---- C:\Users\Semerádovi\AppData\Roaming\uTorrent

======List of files/folders modified in the last 1 month======

2014-10-25 08:51:48 ----D---- C:\Windows\System32
2014-10-25 08:51:48 ----D---- C:\Windows\inf
2014-10-25 08:47:34 ----D---- C:\ProgramData\NVIDIA
2014-10-24 18:25:58 ----D---- C:\Windows
2014-10-24 18:25:09 ----A---- C:\Windows\system.ini
2014-10-24 18:23:54 ----D---- C:\Windows\SysWOW64\drivers
2014-10-24 18:23:54 ----D---- C:\Windows\SysWOW64
2014-10-24 18:23:54 ----D---- C:\Windows\AppPatch
2014-10-24 18:23:53 ----D---- C:\Program Files (x86)\Common Files
2014-10-23 20:15:28 ----SHD---- C:\System Volume Information
2014-10-23 20:14:49 ----SHD---- C:\Windows\Installer
2014-10-23 20:14:49 ----RD---- C:\Program Files
2014-10-23 20:14:43 ----RD---- C:\Program Files (x86)
2014-10-23 20:07:47 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-23 20:00:29 ----SD---- C:\ProgramData\Microsoft
2014-10-23 20:00:29 ----D---- C:\ProgramData\Spybot - Search & Destroy
2014-10-23 18:46:31 ----D---- C:\Windows\Microsoft.NET
2014-10-23 18:46:09 ----A---- C:\Windows\SysWOW64\logfile.txt
2014-10-23 18:46:00 ----D---- C:\ProgramData
2014-10-23 17:55:31 ----D---- C:\Windows\Minidump
2014-10-23 17:25:15 ----D---- C:\Windows\Tasks
2014-10-22 18:41:00 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\OpenCL.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvwgf2um.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvd3dum.dll
2014-10-16 18:54:03 ----A---- C:\Windows\SysWOW64\nvapi.dll
2014-10-04 08:42:47 ----A---- C:\Windows\SysWOW64\nvspcap.dll
2014-10-04 08:42:47 ----A---- C:\Windows\SysWOW64\nvspbridge.dll
2014-09-28 08:28:00 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-26 21:27:52 ----D---- C:\Users\Semerádovi\AppData\Roaming\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys []
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys []
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-10-04 20288]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys []
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\SEMERD~1\AppData\Local\Temp\ALSysIO64.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz128;cpuz128; \??\C:\Users\SEMERD~1\AppData\Local\Temp\cpuz_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 OXUDIDRV;OXUDIDRV; \??\C:\Windows\system32\Drivers\OXUDIDRV_X64.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys []
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys []
S3 WinUSB;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUSB.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-10-04 1149760]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-10-04 1796928]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-10-04 19440960]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-10-16 410952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-25 114288]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-11-26 569768]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#27 Příspěvek od Trauten »

vyjela mě takových několik řádku v tom černém okně, všechny začínaly hláškou: Zpracovávaný soubor.... ale nic co by se dalo zabalit
Nahoru
Avatar uživatele
cernohous13
VIP in memoriam
VIP in memoriam
Příspěvky: 8720
Registrován: 09 Pro 2006 06:19
Místo/Bydliště: Jablonec nad Nisou
Kontaktovat uživatele:
Kontaktovat uživatele cernohous13

Re: Conhost.exe

#28 Příspěvek od cernohous13 »

Nezmatkuj - Naughty chce zabalit o uploudnout C:\Qoobox :wink:
Doporučení:
V průběhu léčení prováděj nové instalace a odinstalace jen na můj pokyn.
Důkladně prostuduj a proveď celou operaci podle mé odpovědi.
V případě nejasností se zeptej - vysvětlím Obrázek

-------------------------------------------------------------------------------------------------
> Podpora fóra <
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#29 Příspěvek od Trauten »

to ano, ale zatím se mi nedaří
Nahoru
Trauten
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 23 Říj 2014 17:34

Re: Conhost.exe

#30 Příspěvek od Trauten »

a jinak mám udělat vše dle výše uvedeného návodu ?
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“