Opakující se zobrazování ruských stránek

[Kanarek]

Ahoj, pravděpodobně mám nějaký marast v PC. Mám otevřený internetový prohlížeč Opera. Na stránce kliknu na odkaz a v tu chvíli se mi v dalším okně otevře nová stránka (mám dojem že vždy *.ru). Není to nic pravidelného. Stává se to občas, ale stává se to také na stránkách, kde se to dřív nedělo. Mám nainstalovaný NOD32, ale z nedostatku financí není rok aktualizovaný. CCleaner používám celkem často.

Děkuji za pomoc.

Zde je log:


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-10-2014 01
Ran by Beny (administrator) on BENY-PC on 29-10-2014 19:11:01
Running from C:\Users\Beny\Desktop
Loaded Profile: Beny (Available profiles: Beny & UpdatusUser)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Valve Corporation) C:\Program Files\Hry\Steam\Steam.exe
(BitTorrent Inc.) C:\Users\Beny\AppData\Roaming\uTorrent\uTorrent.exe
(Syntek Ltd.) C:\Windows\STK03N\STK03NM.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Valve Corporation) C:\Program Files\Hry\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
() C:\Program Files\Opera\25.0.1614.63\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(Opera Software) C:\Program Files\Opera\25.0.1614.63\opera.exe
(forum.viry.cz) C:\Users\Beny\Desktop\FRSTLauncher.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [3080264 2011-09-22] (ESET)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [mnchamiixSrv] => C:\Windows\system32\mnchamiix.vbe [7670 2014-03-05] ()
HKLM\...\Run: [mncvvwloSrv] => C:\Windows\system32\mncvvwlo.vbe [7670 2014-03-05] ()
HKLM\...\Run: [MSStp] => C:\Windows\system32\msstp.vbe [1419 2014-01-19] ()
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\Run: [Steam] => C:\Program Files\Hry\Steam\steam.exe [1938624 2014-10-21] (Valve Corporation)
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\Run: [MMServerListAutoUpdaterTSS] => C:\Program Files\Hry\VUGames\SWAT 4\ContentExpansion\System\MMServerListAutoUpdaterTSS.exe [302857 2012-12-10] ()
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\Programy\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\Run: [uTorrent] => C:\Users\Beny\AppData\Roaming\uTorrent\uTorrent.exe [1385808 2014-10-08] (BitTorrent Inc.)
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\MountPoints2: G - G:\iStudio.exe
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\MountPoints2: H - H:\iStudio.exe
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\MountPoints2: {a501c994-38b2-11e2-81b4-001bfc43c6fd} - E:\Autorun.exe
HKU\S-1-5-21-1424593332-1298421875-114481279-1000\...\MountPoints2: {e5c026a0-3c63-11e2-856c-001bfc43c6fd} - G:\iStudio.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [122200 2014-07-01] (Garmin Ltd or its subsidiaries)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\STK03N PNP Monitor.lnk
ShortcutTarget: STK03N PNP Monitor.lnk -> C:\Windows\STK03N\STK03NM.exe (Syntek Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 217.195.165.131 217.195.160.10

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Beny\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012-11-22]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Unity Player) - C:\Users\Beny\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll No File
CHR Profile: C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-17]
CHR Extension: (Disk Google) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-17]
CHR Extension: (YouTube) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-22]
CHR Extension: (Vyhledávání Google) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-22]
CHR Extension: (Everysale.Net) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\iapdadaeaebaoigieglfababneoaifnf [2014-07-24]
CHR Extension: (Peněženka Google) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-31]
CHR Extension: (Gmail) - C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-22]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-12-01] (Adobe Systems) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [974944 2011-09-22] (ESET)
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [437080 2014-07-01] (Garmin Ltd or its subsidiaries)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 DCamUSBSTK03N; C:\Windows\System32\DRIVERS\STK03NW2.sys [108544 2009-12-18] (Syntek Ltd.)
S3 DFX11_1; C:\Windows\System32\drivers\dfx11_1.sys [24424 2012-12-13] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [163424 2011-08-09] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [118104 2011-08-04] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [103112 2011-08-04] (ESET)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
S3 XFDriver; C:\Program Files\Xfire2\XFDriver.sys [16648 2013-03-14] (XFire)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 19:11 - 2014-10-29 19:11 - 00011706 _____ () C:\Users\Beny\Desktop\FRST.txt
2014-10-29 19:10 - 2014-10-29 19:11 - 00000000 ____D () C:\FRST
2014-10-29 19:09 - 2014-10-29 19:09 - 00112640 _____ (forum.viry.cz) C:\Users\Beny\Desktop\FRSTLauncher.exe
2014-10-29 19:09 - 2014-10-29 19:09 - 00029696 _____ () C:\Users\Beny\AppData\Local\MSGBOX.EXE
2014-10-29 19:09 - 2014-10-29 19:09 - 00015327 _____ () C:\Users\Beny\Desktop\LM.bat
2014-10-29 19:08 - 2014-10-29 19:08 - 01104896 _____ (Farbar) C:\Users\Beny\Desktop\FRST.exe
2014-10-16 14:24 - 2014-10-29 18:47 - 00003696 _____ () C:\Windows\setupact.log
2014-10-16 14:24 - 2014-10-16 14:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-16 10:28 - 2014-10-29 17:43 - 00907773 _____ () C:\Windows\WindowsUpdate.log
2014-10-15 18:22 - 2014-10-27 17:02 - 00001003 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 25.lnk
2014-10-14 21:26 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-14 21:26 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-14 21:26 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-14 21:26 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-14 21:26 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-14 21:26 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-14 21:26 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-14 21:26 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-14 21:26 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-14 21:26 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-14 21:26 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-14 21:26 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-14 21:26 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-14 21:26 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-14 21:26 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-14 21:26 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-14 21:26 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-14 21:26 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-14 21:26 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-14 21:26 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-14 21:25 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-14 21:25 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-14 21:25 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-14 21:25 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-14 21:25 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-14 21:25 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-14 21:25 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-14 21:25 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-14 21:25 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-14 21:25 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-14 21:25 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-14 21:25 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-14 21:25 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-14 21:25 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-14 21:25 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-14 21:25 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-14 21:25 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-14 21:25 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-14 21:25 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-14 21:25 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-14 21:25 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-14 21:25 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-10-14 21:25 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-14 21:25 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-10-14 21:25 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-10-14 21:24 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-14 21:24 - 2014-08-19 03:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-14 21:24 - 2014-08-19 03:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-14 21:24 - 2014-08-19 03:41 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-14 21:24 - 2014-08-19 03:40 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-14 21:24 - 2014-07-07 02:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00516096 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-14 21:24 - 2014-07-07 02:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-14 21:24 - 2014-07-07 02:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-10-14 21:24 - 2014-07-07 02:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-14 21:24 - 2014-07-07 02:39 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-14 21:24 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-14 21:24 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-14 21:24 - 2014-07-07 02:28 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-14 21:24 - 2014-06-28 01:21 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-14 21:24 - 2014-06-28 01:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-14 21:24 - 2014-06-28 01:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-14 21:23 - 2014-08-19 03:40 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-14 21:23 - 2014-08-19 02:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-14 21:23 - 2014-07-07 02:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-14 21:23 - 2014-07-07 02:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-14 21:23 - 2014-07-07 02:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-14 21:23 - 2014-07-07 02:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-14 21:23 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-06 10:04 - 2014-10-06 10:04 - 00000000 ____D () C:\Users\Beny\Downloads\Kraftklub---In-Schwarz-(2014)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 19:11 - 2012-11-27 17:59 - 00000000 ____D () C:\Users\Beny\AppData\Roaming\uTorrent
2014-10-29 18:41 - 2013-11-16 20:04 - 00000940 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-29 17:48 - 2009-07-14 05:34 - 00021904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-29 17:48 - 2009-07-14 05:34 - 00021904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-29 17:42 - 2014-07-25 09:34 - 00000002 _____ () C:\Users\Beny\rgmnr
2014-10-29 17:40 - 2012-11-21 20:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-29 17:40 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-28 19:04 - 2010-11-20 22:01 - 01470062 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-27 22:51 - 2013-11-16 20:04 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-27 17:02 - 2012-11-21 20:21 - 00000000 ____D () C:\Program Files\Opera
2014-10-27 12:13 - 2012-11-21 20:17 - 00000000 ____D () C:\Users\Beny\AppData\Local\VirtualStore
2014-10-24 10:30 - 2012-11-21 20:26 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-10-22 18:46 - 2012-11-22 16:37 - 00000000 ____D () C:\Users\Beny\AppData\Roaming\Canon
2014-10-22 17:58 - 2014-08-28 08:25 - 00000000 ____D () C:\Users\Beny\AppData\Local\Adobe
2014-10-22 17:58 - 2012-12-02 10:55 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-22 17:58 - 2012-12-02 10:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-21 23:36 - 2013-11-16 20:04 - 00000936 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 11:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-10-16 10:28 - 2014-07-24 09:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-15 19:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-15 12:01 - 2009-07-14 05:33 - 00282672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-15 08:47 - 2013-08-14 21:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 08:41 - 2012-11-23 17:24 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-05 15:10 - 2012-11-27 22:14 - 00000000 ____D () C:\Users\Beny\AppData\Roaming\DAEMON Tools Lite
2014-10-05 13:28 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-02 14:53 - 2012-11-21 20:24 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-26 21:03

==================== End Of Log ============================

[Márty84]

Zdravim

NOD odinstalujte a nainstalujte Avast free.

Stahnete AdwCleaner https://toolslib.net/downloads/finish/1/ a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Clean
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner [S?].txt ). Ten mi sem zkopirujte.

[Kanarek]

provedu, jen se zeptám. Když dám pryč NOD a třeba za rok se ho zase rozhodnu obnovit půjde použít staré instalační CD, které mám a koupit jen nějaký kód, kterým to aktualizuji?

[Márty84]

Neni potreba zadne CD. Proste stahnete z oficialnich stranek nejnovejsi verzi NODu a pouzijete zakoupeny licencni klic

[Kanarek]

# AdwCleaner v3.311 - Report created 30/10/2014 at 01:09:35
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Beny - BENY-PC
# Running from : C:\Users\Beny\Desktop\adwcleaner_3.311.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Folder Deleted : C:\Program Files\WinZip Registry Optimizer
Folder Deleted : C:\Users\Beny\AppData\Roaming\YourFileDownloader
Folder Deleted : C:\Users\Beny\Documents\Updater
File Deleted : C:\Windows\system32\roboot.exe

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\PIP
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YourFileDownloader
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\PIP
Key Deleted : HKLM\SOFTWARE\YourFileDownloader

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Google Chrome v38.0.2125.111

[ File : C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1409 octets] - [30/10/2014 01:07:24]
AdwCleaner[S0].txt - [1356 octets] - [30/10/2014 01:09:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1416 octets] ##########

[Márty84]

Udelejte kontrolu s MBAM. Test nastavte podle tohoto navodu http://forum.viry.cz/viewtopic.php?f=29&t=137928 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

[Kanarek]

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 30.10.2014
Čas skenování: 10:43:10
Protokol: log001.txt
Správce: Ano

Verze: 2.00.3.1025
Databáze malwaru: v2014.10.30.04
Databáze rootkitů: v2014.10.22.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Sebeobrany: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Beny

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 540835
Uplynulý čas: 1 hod, 20 min, 1 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Žádné zákerné zjištěny položek)

Moduly: 0
(Žádné zákerné zjištěny položek)

Klíče registru: 0
(Žádné zákerné zjištěny položek)

Hodnoty registru: 0
(Žádné zákerné zjištěny položek)

Data registru: 0
(Žádné zákerné zjištěny položek)

Složky: 0
(Žádné zákerné zjištěny položek)

Soubory: 9
PUP.Optional.Tarma, C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\File System\001\t\00\00000000, , [22bac2585d1fd36346d2bcac31d08e72],
Trojan.BitMiner, C:\Windows\inf\mncjmqx\mncjmqx.exe, , [4d8f0b0fa3d937ff6a717e7bbb460af6],
BitcoinMiner, C:\Windows\inf\msxyibq\msxyibq.exe, , [8d4fc357e696b5818046c44f02ff56aa],
PUP.Optional.Bitcoin, C:\Windows\System32\acumnchamiix.exe, , [16c638e20c70f244c21cc127a85955ab],
PUP.Optional.Bitcoin, C:\Windows\System32\acumncvvwlo.exe, , [c814ef2bc9b33cfa904e579127da34cc],
PUP.BitCoinMiner, C:\Windows\System32\lcpmnchamiix.exe, , [09d329f185f710260db59e86e41d817f],
PUP.BitCoinMiner, C:\Windows\System32\lcpmncvvwlo.exe, , [efed21f9710b5adc3092ee36d62b768a],
Trojan.BitMiner, C:\Windows\System32\dcgmnchamiix.exe, , [6c7037e3d1ab00365586b44557aaac54],
Trojan.BitMiner, C:\Windows\System32\dcgmncvvwlo.exe, , [6b71c951ee8e013524b7faffab56da26],

Fyzické sektory: 0
(Žádné zákerné zjištěny položek)


(end)

[Márty84]

Vsechny nalezy hodte do karanteny. Po restartu pc test zopakujte, at vime, jestli se to nevraci. Napiste vysledek testu a podle nej zvolim dalsi postup.

[Kanarek]

vypadá to, že se nevrací:

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 30.10.2014
Čas skenování: 18:51:32
Protokol: log002.txt
Správce: Ano

Verze: 2.00.3.1025
Databáze malwaru: v2014.10.30.11
Databáze rootkitů: v2014.10.22.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Sebeobrany: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Beny

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 541687
Uplynulý čas: 1 hod, 8 min, 43 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Žádné zákerné zjištěny položek)

Moduly: 0
(Žádné zákerné zjištěny položek)

Klíče registru: 0
(Žádné zákerné zjištěny položek)

Hodnoty registru: 0
(Žádné zákerné zjištěny položek)

Data registru: 0
(Žádné zákerné zjištěny položek)

Složky: 0
(Žádné zákerné zjištěny položek)

Soubory: 0
(Žádné zákerné zjištěny položek)

Fyzické sektory: 0
(Žádné zákerné zjištěny položek)


(end)

[Márty84]

MBAM odinstalujte.


Pokud nemate, zazalohujte si radeji dulezita data (fotky, dokumenty, atd.)

Nepouzivejte ComboFix bez predchozi domluvy! Je to poruseni pravidel fora a ztratite tim narok na pomoc!

Stahnete ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe a ulozte ho na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Kliknete na ComboFix pravym mysidlem a levym na Spustit jako spravce
Odsouhlaste licencni podminky a nechte program pracovat. Jestli vam nabidne instalaci Konzoly pro zotaveni, souhlaste.
Po dobu skenu nic nespoustejte, nikam neklikejte.
Po dokonceni skenovani (muze dojit i k restartu pc) by se mel vytvorit log, ktery bude umisteny zde C:\ComboFix.txt
Jeho obsah sem zkopirujte

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace
Kdyz windows nabehne, ale pri spousteni ruznych programu bude hlasena chyba, staci restartovat pc a bude to v poradku

[Kanarek]

ComboFix 14-10-29.01 - Beny 30.10.2014 21:03:43.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2046.604 [GMT 1:00]
Spuštěný z: c:\users\Beny\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Beny\AppData\Local\MSGBOX.EXE
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-09-28 do 2014-10-30 )))))))))))))))))))))))))))))))
.
.
2014-10-30 20:13 . 2014-10-30 20:13 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-10-30 20:13 . 2014-10-30 20:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-30 09:41 . 2014-10-30 09:41 -------- d-----w- c:\programdata\Malwarebytes
2014-10-30 09:31 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7A3AAF78-D2A8-4172-92F7-54876A99F2B6}\mpengine.dll
2014-10-30 00:23 . 2014-10-30 00:25 -------- d-----w- c:\users\Beny\AppData\Roaming\Dropbox
2014-10-30 00:09 . 2010-08-30 07:34 536576 ----a-w- c:\windows\system32\sqlite3.dll
2014-10-30 00:08 . 2014-10-30 00:09 -------- d-----w- c:\windows\system32\vbox
2014-10-30 00:07 . 2014-10-30 00:09 -------- d-----w- C:\AdwCleaner
2014-10-29 23:59 . 2014-10-29 23:59 -------- d-----w- c:\users\Beny\AppData\Roaming\AVAST Software
2014-10-29 23:57 . 2014-10-29 23:57 91496 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-10-29 23:57 . 2014-10-29 23:57 206248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-10-29 23:57 . 2014-10-29 23:57 70384 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-10-29 23:57 . 2014-10-29 23:57 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-10-29 23:57 . 2014-10-29 23:57 422760 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-10-29 23:57 . 2014-10-29 23:57 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-10-29 23:57 . 2014-10-29 23:57 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-10-29 23:57 . 2014-10-29 23:57 787800 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-10-29 23:57 . 2014-10-29 23:57 291352 ----a-w- c:\windows\system32\aswBoot.exe
2014-10-29 23:57 . 2014-10-29 23:57 43152 ----a-w- c:\windows\avastSS.scr
2014-10-29 23:56 . 2014-10-29 23:56 -------- d-----w- c:\program files\AVAST Software
2014-10-29 23:56 . 2014-10-29 23:56 -------- d-----w- c:\programdata\AVAST Software
2014-10-29 18:10 . 2014-10-29 18:12 -------- d-----w- C:\FRST
2014-10-14 20:24 . 2014-09-13 01:40 67072 ----a-w- c:\windows\system32\packager.dll
2014-10-14 20:23 . 2014-08-19 01:48 50176 ----a-w- c:\windows\system32\drivers\appid.sys
2014-10-14 20:23 . 2014-07-07 01:40 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2014-10-14 20:23 . 2014-08-19 02:40 16896 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2014-10-14 20:23 . 2014-07-07 01:40 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2014-10-14 20:23 . 2014-07-07 01:40 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2014-10-14 20:23 . 2014-07-07 01:40 4096 ----a-w- c:\windows\system32\dxmasf.dll
2014-10-14 20:23 . 2014-07-07 01:40 8192 ----a-w- c:\windows\system32\spwmp.dll
2014-10-14 20:23 . 2014-07-07 01:40 4096 ----a-w- c:\windows\system32\msdxm.ocx
2014-10-14 20:23 . 2014-07-07 01:39 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2014-10-14 20:23 . 2014-07-07 01:37 2048 ----a-w- c:\windows\system32\mferror.dll
2014-10-05 12:28 . 2014-10-05 12:28 -------- d-----w- c:\users\Beny\AppData\Local\Diagnostics
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-30 00:27 . 2012-12-02 09:55 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-10-30 00:27 . 2012-12-02 09:55 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-10-02 13:53 . 2012-11-21 19:24 231568 ------w- c:\windows\system32\MpSigStub.exe
2014-08-23 01:46 . 2014-08-27 19:37 305152 ----a-w- c:\windows\system32\gdi32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-10-29 23:57 723976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Hry\Steam\steam.exe" [2014-10-21 1938624]
"MMServerListAutoUpdaterTSS"="c:\program files\Hry\VUGames\SWAT 4\ContentExpansion\System\MMServerListAutoUpdaterTSS.exe" [2012-12-10 302857]
"DAEMON Tools Lite"="c:\program files\Programy\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728]
"uTorrent"="c:\users\Beny\AppData\Roaming\uTorrent\uTorrent.exe" [2014-10-29 1385808]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-10-29 5223016]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2014-07-01 122200]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
STK03N PNP Monitor.lnk - c:\windows\STK03N\STK03NM.exe [2012-12-2 163840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Beny^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\users\Beny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2014-08-21 16:30 959176 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-11-06 10:46 3673728 ----a-w- c:\program files\Programy\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarminExpressTrayApp]
2014-07-01 10:01 122200 ----a-w- c:\program files\Garmin\Express Tray\ExpressTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 21:17 52256 ----a-w- c:\program files\Programy\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-14 20:01 71216 ------w- c:\program files\Programy\CyberLink\PowerDVD\PDVDServ.exe
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-10-29 91496]
R2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2014-07-01 437080]
R3 DCamUSBSTK03N;Standard_Camera;c:\windows\system32\DRIVERS\STK03NW2.sys [2009-12-18 108544]
R3 DFX11_1;DFX Audio Enhancer 11.1;c:\windows\system32\drivers\dfx11_1.sys [2012-12-13 24424]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-09-19 108032]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-23 1343400]
R3 XFDriver;XFDrive;c:\program files\Xfire2\XFDriver.sys [2013-03-14 16648]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-10-29 787800]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-10-29 422760]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-11-27 242240]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-10-29 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-10-29 70384]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2014-10-29 218192]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2014-10-29 3192344]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-27 21:48 1089352 ----a-w- c:\program files\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-11-16 19:03]
.
2014-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-11-16 19:03]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 217.195.165.131 217.195.160.10
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
MSConfigStartUp-mncjmqxSrv - c:\windows\inf\mncjmqx.vbe
MSConfigStartUp-msmjpoSrv - c:\windows\inf\msmjpo.vbe
MSConfigStartUp-uTorrent - c:\program files\Programy\uTorrent\uTorrent.exe
AddRemove-WinZip Registry Optimizer_is1 - c:\program files\WinZip Registry Optimizer\unins000.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-10-30 21:15:35
ComboFix-quarantined-files.txt 2014-10-30 20:15
.
Před spuštěním: Volných bajtů: 88 255 934 464
Po spuštění: Volných bajtů: 88 379 068 416
.
- - End Of File - - 918D623170D3BF1ABA81ECABC132E935
A36C5E4F47E84449FF07ED3517B43A31

[Kanarek]

Ještě při listováním tématy zde na foru mě napadá, že bych mohl říct, že tu a tam přijde tzv. modrá smrt. Když se to stane, tak jeden řádek poměrně rychle udělá nějakou operaci od 1 do 100 a zase vše funguje. Jsem v tom naprostý laik a antitalent, tak k tomu víc neřeknu. Pravděpodobně jste to ale už vyčetl z těch logů

Aktualizace: Nyní jsem zadal viry.cz, klikl na odkaz Forum a vyskočilo mi nové okno se stránkou mall.cz

[Márty84]

Postupujte podle navodu kolegy

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Postupujte podle navodu kolegy

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  emptyclsid;
  iedefaults;
  FFdefaults;
  CHRdefaults;
  emptyalltemp;
  resethosts;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[Kanarek]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Professional x86
Ran by Beny on p  31.10.2014 at 16:46:25,58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on p  31.10.2014 at 16:50:30,57
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Kanarek]

Zoek.exe v5.0.0.0 Updated 31-10-2014
Tool run by Beny on p  31.10.2014 at 17:15:20,05.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Beny\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

31.10.2014 17:18:26 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Beny\AppData\Roaming\Thunderbird\Profiles\yf7ezhxy.default\prefs.js:

Added to C:\Users\Beny\AppData\Roaming\Thunderbird\Profiles\yf7ezhxy.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Package Cache deleted
C:\Users\Beny\AppData\Local\cache deleted
"C:\Users\Beny\AppData\Roaming\vlc\vlcrc" deleted
"C:\Users\Beny\AppData\Roaming\vlc" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [30.10.2014 00:57]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Beny\AppData\Roaming\Thunderbird\Profiles\yf7ezhxy.default
- ImportExportTools - %ProfilePath%\extensions\{3ed8cc52-86fc-4613-9026-c1ef969da4c3}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[30.10.2014 00:57]

Everysale.Net - Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\iapdadaeaebaoigieglfababneoaifnf
Everysale.Net - Beny\AppData\Roaming\Opera Software\Opera Stable\Extensions\iapdadaeaebaoigieglfababneoaifnf

==== Chromium Fix ======================

C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.slutfinder.com_0.localstorage deleted successfully
C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.slutfinder.com_0.localstorage-journal deleted successfully
C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_services.hearstmags.com_0.localstorage deleted successfully
C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_services.hearstmags.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Preferences was reset successfully
C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data will be reset at reboot

==== Empty IE Cache ======================

C:\Users\Beny\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Beny\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1E068Y9 will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache will be emptied at reboot
C:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=26 folders=20 43289507 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\temp emptied successfully
C:\Users\Beny\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Guest\AppData\Local\temp emptied successfully
C:\Users\HomeGroupUser$\AppData\Local\temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\UpdatusUser\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Beny\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data" not found
"C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_0" deleted
"C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_1" deleted
"C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_2" deleted
"C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_3" deleted
"C:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\index" deleted
"C:\Users\Beny\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1E068Y9" not found

==== EOF on p  31.10.2014 at 17:47:47,67 ======================