Zavirovany notebook

Zpráva

Svara7 · #1 Příspěvek od **Svara7** » 04 Lis 2014 09:50

Dobry den, dnes me pozadal muj novy nemecky kolega, jestli nevim o nekom, kdo by mu mohl pomoci s vycistenim jeho notebooku. Myslim, ze to nikdo nezvladne lepe, nez na tomto foru. Vypada to u nej na slusnou sbirku. Dekuji moc!

Logfile of random's system information tool 1.10 (written by random/random)
Run by prishtinafc at 2014-11-04 09:45:04
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 56 GB (56%) free of 100 GB
Total RAM: 1910 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:45:26 AM, on 11/4/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Advanced System Protector\AdvancedSystemProtector.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\PortalMore\bin\PortalMore.BrowserAdapter.exe
C:\Program Files\PortalMore\bin\PortalMore.BOASHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PortalMore\bin\PortalMore.BOASPRT.exe
C:\Program Files\PortalMore\bin\PortalMore.BOAS.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\prishtinafc\Downloads\RSIT.exe
C:\Program Files\trend micro\prishtinafc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findamo.com?&cid=3975ch=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: PortalMore - {b4fdb093-34f6-4a49-8133-61b3072261ac} - C:\Program Files\PortalMore\PortalMorebho.dll
O2 - BHO: Systweak Toolbar for Internet Explorer - {F0D6F486-7230-3139-1997-CB2FBCF4E080} - C:\Program Files\Systweak Toolbar\systweak-32.dll
O3 - Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Systweak Toolbar for Internet Explorer - {F0D6F486-7230-3139-1997-CB2FBCF4E080} - C:\Program Files\Systweak Toolbar\systweak-32.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_15_0_0_152_Plugin.exe -update plugin
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: web'n'walk Manager.lnk = C:\Program Files\T-Mobile\web'n'walk Manager\web'n'walk Manager.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files\MyPC Backup\BackupStack.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DCService.exe - Unknown owner - C:\ProgramData\DatacardService\DCService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: GtDetectSc - Option - C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Internet Manager. OUC (Internet Manager. RunOuc) - Unknown owner - C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe
O23 - Service: MaintainerSvc2.60.0411857 - Unknown owner - C:\ProgramData\4c0f6683-2f83-421e-8410-9d669d28d41d\maintainer.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Update PortalMore - Unknown owner - C:\Program Files\PortalMore\updatePortalMore.exe
O23 - Service: Util PortalMore - Unknown owner - C:\Program Files\PortalMore\bin\utilPortalMore.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 9271 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000Core.job - C:\Users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000UA.job - C:\Users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.findamo.com?&cid=3975ch=2"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\extensions\
abs@avira.com
ich@maltegoetz.de
toolbar@systweak.com
{0545b830-f0aa-4d7e-8820-50a4629a56fe}

C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\searchplugins\
Search The Web.xml
youtube-videosuche.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2014-04-25 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4fdb093-34f6-4a49-8133-61b3072261ac}]
PortalMore - C:\Program Files\PortalMore\PortalMorebho.dll [2014-10-18 250096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0D6F486-7230-3139-1997-CB2FBCF4E080}]
Systweak Toolbar for Internet Explorer - C:\Program Files\Systweak Toolbar\systweak-32.dll [2014-01-28 182272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{98889811-442D-49dd-99D7-DC866BE87DBC}
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2014-04-25 194504]
{F0D6F486-7230-3139-1997-CB2FBCF4E080} - Systweak Toolbar for Internet Explorer - C:\Program Files\Systweak Toolbar\systweak-32.dll [2014-01-28 182272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2010-06-04 292208]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-08-31 142616]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-08-31 177432]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-08-31 176408]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2014-03-11 951576]
"MobileConnect"=C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2008-07-04 2072576]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2014-01-17 421888]
"Avira Systray"=C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [2014-09-23 165168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=C:\Users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15 138096]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2012-01-07 39408]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2014-07-24 21650016]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner.exe [2014-09-25 4810520]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\Windows\system32\Macromed\Flash\FlashUtil32_15_0_0_152_Plugin.exe [2014-10-19 854192]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
web'n'walk Manager.lnk - C:\Program Files\T-Mobile\web'n'walk Manager\web'n'walk Manager.exe

C:\Users\prishtinafc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MyPC Backup.lnk - C:\Program Files\MyPC Backup\MyPC Backup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-08-31 294400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-11-04 09:45:04 ----D---- C:\rsit
2014-11-04 09:45:04 ----D---- C:\Program Files\trend micro
2014-11-04 09:08:30 ----A---- C:\Windows\system32\drivers\{a1724e9e-4583-4b6c-bcb9-e5e364683c43}w.sys
2014-11-01 16:08:08 ----A---- C:\Windows\system32\drivers\{71a533d3-f24d-436b-9e6e-3ac71fa7eec9}w.sys
2014-10-29 13:28:25 ----D---- C:\ProgramData\4c0f6683-2f83-421e-8410-9d669d28d41d
2014-10-29 12:56:23 ----A---- C:\Windows\system32\drivers\{6a184198-5e72-4903-80bb-e80e3a740585}w.sys
2014-10-27 14:51:30 ----A---- C:\Windows\system32\drivers\{c0a0d23a-662e-4f8c-9e81-e5f906e062fe}w.sys
2014-10-25 22:50:22 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2014-10-25 22:39:43 ----A---- C:\Windows\system32\win32k.sys
2014-10-25 22:39:37 ----A---- C:\Windows\system32\gdi32.dll
2014-10-25 22:39:10 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-10-25 22:39:10 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-10-25 22:39:09 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-25 22:39:09 ----A---- C:\Windows\system32\jsproxy.dll
2014-10-25 22:39:09 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-25 22:39:09 ----A---- C:\Windows\system32\ieUnatt.exe
2014-10-25 22:39:09 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-10-25 22:39:09 ----A---- C:\Windows\system32\dxtmsft.dll
2014-10-25 22:39:08 ----A---- C:\Windows\system32\wininet.dll
2014-10-25 22:39:08 ----A---- C:\Windows\system32\vbscript.dll
2014-10-25 22:39:07 ----A---- C:\Windows\system32\mshtmled.dll
2014-10-25 22:39:07 ----A---- C:\Windows\system32\ieui.dll
2014-10-25 22:39:07 ----A---- C:\Windows\system32\dxtrans.dll
2014-10-25 22:39:06 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-10-25 22:39:06 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-10-25 22:39:06 ----A---- C:\Windows\system32\iertutil.dll
2014-10-25 22:39:05 ----A---- C:\Windows\system32\jscript9diag.dll
2014-10-25 22:39:04 ----A---- C:\Windows\system32\mshtml.dll
2014-10-25 22:39:04 ----A---- C:\Windows\system32\jscript9.dll
2014-10-25 22:39:03 ----A---- C:\Windows\system32\urlmon.dll
2014-10-25 22:39:03 ----A---- C:\Windows\system32\iernonce.dll
2014-10-25 22:39:03 ----A---- C:\Windows\system32\ie4uinit.exe
2014-10-25 22:39:02 ----A---- C:\Windows\system32\msfeeds.dll
2014-10-25 22:39:02 ----A---- C:\Windows\system32\iedkcs32.dll
2014-10-25 22:39:02 ----A---- C:\Windows\system32\ieapfltr.dll
2014-10-25 22:39:00 ----A---- C:\Windows\system32\msrating.dll
2014-10-25 22:39:00 ----A---- C:\Windows\system32\iesetup.dll
2014-10-25 22:39:00 ----A---- C:\Windows\system32\ieframe.dll
2014-10-25 22:38:14 ----A---- C:\Windows\system32\rastls.dll
2014-10-25 22:37:53 ----A---- C:\Windows\system32\qdvd.dll
2014-10-25 22:37:27 ----A---- C:\Windows\system32\d3d10warp.dll
2014-10-25 22:37:08 ----A---- C:\Windows\system32\TSWorkspace.dll
2014-10-25 22:36:56 ----A---- C:\Windows\system32\mscorier.dll
2014-10-25 22:36:56 ----A---- C:\Windows\system32\dfshim.dll
2014-10-25 22:36:55 ----A---- C:\Windows\system32\mscories.dll
2014-10-25 22:36:13 ----A---- C:\Windows\system32\mstscax.dll
2014-10-25 22:36:12 ----A---- C:\Windows\system32\mstsc.exe
2014-10-25 22:36:11 ----A---- C:\Windows\system32\winsta.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\winlogon.exe
2014-10-25 22:36:11 ----A---- C:\Windows\system32\termsrv.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\rdpcorets.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\rdpcorekmts.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\lsasrv.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\kerberos.dll
2014-10-25 22:36:11 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2014-10-25 22:36:10 ----A---- C:\Windows\system32\TSpkg.dll
2014-10-25 22:36:10 ----A---- C:\Windows\system32\drivers\tssecsrv.sys
2014-10-25 22:36:10 ----A---- C:\Windows\system32\credssp.dll
2014-10-25 22:36:10 ----A---- C:\Windows\system32\aaclient.dll
2014-10-25 22:35:46 ----A---- C:\Windows\system32\msi.dll
2014-10-25 22:35:08 ----A---- C:\Windows\system32\packager.dll
2014-10-25 22:34:43 ----A---- C:\Windows\system32\tzres.dll
2014-10-24 07:57:58 ----A---- C:\Windows\system32\drivers\{42489cbb-2902-475b-96ba-2ac9e47fc378}w.sys
2014-10-19 17:03:19 ----A---- C:\Windows\system32\drivers\{31a2f244-4a67-4367-b593-df9513aea360}w.sys
2014-10-18 13:30:43 ----A---- C:\Windows\system32\ff_vfw.dll
2014-10-18 13:30:38 ----D---- C:\Program Files\ffdshow
2014-10-18 13:30:32 ----D---- C:\Program Files\PortalMore
2014-10-18 13:30:32 ----D---- C:\Program Files\Haali
2014-10-18 13:30:04 ----D---- C:\Users\prishtinafc\AppData\Roaming\Performersoft
2014-10-18 13:30:02 ----D---- C:\Program Files\MyPC Backup
2014-10-18 13:29:55 ----A---- C:\Windows\performersoftsetup.dll
2014-10-18 13:29:53 ----D---- C:\Users\prishtinafc\AppData\Roaming\UnknownFile
2014-10-18 13:29:50 ----D---- C:\Program Files\PC Performer
2014-10-17 13:59:12 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2014-11-04 18:03:31 ----D---- C:\Windows\system32\LogFiles
2014-11-04 09:45:16 ----D---- C:\Windows\Prefetch
2014-11-04 09:45:04 ----RD---- C:\Program Files
2014-11-04 09:41:10 ----D---- C:\Windows\Temp
2014-11-04 09:41:00 ----D---- C:\Windows\inf
2014-11-04 09:33:28 ----D---- C:\Windows\system32\config
2014-11-04 09:15:12 ----D---- C:\Windows\tracing
2014-11-04 09:11:35 ----D---- C:\Windows\System32
2014-11-04 09:11:35 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-11-04 09:10:43 ----A---- C:\Windows\win.ini
2014-11-04 09:08:30 ----D---- C:\Windows\system32\drivers
2014-11-04 09:07:36 ----D---- C:\Windows\system32\Tasks
2014-11-01 16:51:01 ----D---- C:\Users\prishtinafc\AppData\Roaming\Skype
2014-11-01 16:17:25 ----SHD---- C:\System Volume Information
2014-10-30 12:24:45 ----N---- C:\Windows\system32\MpSigStub.exe
2014-10-29 13:28:25 ----HD---- C:\ProgramData
2014-10-27 16:19:02 ----SHD---- C:\Windows\Installer
2014-10-27 16:19:02 ----SHD---- C:\Config.Msi
2014-10-27 16:14:47 ----D---- C:\Windows\Tasks
2014-10-27 11:35:43 ----D---- C:\Windows\rescache
2014-10-27 11:05:47 ----D---- C:\Windows\Microsoft.NET
2014-10-27 11:01:48 ----RSD---- C:\Windows\assembly
2014-10-27 10:50:19 ----D---- C:\Windows\winsxs
2014-10-25 22:53:56 ----D---- C:\Windows\system32\en-US
2014-10-25 22:53:56 ----D---- C:\Windows\system32\de-DE
2014-10-25 22:53:56 ----D---- C:\Program Files\Internet Explorer
2014-10-25 22:53:29 ----D---- C:\ProgramData\Microsoft Help
2014-10-25 22:50:30 ----D---- C:\Windows\system32\catroot
2014-10-25 22:49:13 ----D---- C:\Windows\system32\MRT
2014-10-25 22:40:35 ----D---- C:\Windows\system32\catroot2
2014-10-25 16:04:53 ----D---- C:\Windows\system32\wdi
2014-10-22 23:52:54 ----D---- C:\Windows\system32\wfp
2014-10-22 23:52:52 ----D---- C:\Windows\system32\wbem
2014-10-22 23:52:52 ----D---- C:\Windows
2014-10-22 23:51:47 ----D---- C:\Windows\system32\NDF
2014-10-22 23:51:47 ----D---- C:\Windows\servicing
2014-10-22 23:51:47 ----D---- C:\Windows\schemas
2014-10-22 23:51:44 ----D---- C:\Program Files\Common Files\microsoft shared
2014-10-22 23:51:31 ----D---- C:\Windows\registration
2014-10-21 08:53:22 ----D---- C:\Windows\debug
2014-10-20 23:45:56 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-10-19 21:40:31 ----D---- C:\Users\prishtinafc\AppData\Roaming\vlc
2014-10-19 14:03:29 ----D---- C:\Windows\system32\GroupPolicy
2014-10-17 14:15:47 ----D---- C:\Windows\Panther
2014-10-17 14:15:47 ----D---- C:\Windows\ModemLogs
2014-10-17 14:15:44 ----D---- C:\Windows\Logs
2014-10-17 13:57:22 ----D---- C:\ProgramData\Package Cache
2014-10-17 13:57:11 ----D---- C:\Program Files\Avira
2014-10-17 13:48:21 ----D---- C:\ProgramData\Avira
2014-10-17 13:37:35 ----D---- C:\Users\prishtinafc\AppData\Roaming\Apple Computer
2014-10-17 13:37:34 ----D---- C:\Program Files\Common Files\Apple
2014-10-17 13:36:45 ----D---- C:\ProgramData\Systweak
2014-10-17 13:36:44 ----D---- C:\Users\prishtinafc\AppData\Roaming\Systweak
2014-10-17 13:35:04 ----D---- C:\ProgramData\Tarma Installer
2014-10-17 13:33:18 ----D---- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-10-17 13:26:19 ----D---- C:\Windows\system32\DriverStore
2014-10-17 13:25:18 ----D---- C:\Windows\system32\appmgmt
2014-10-17 13:24:32 ----DC---- C:\Windows\system32\DRVSTORE
2014-10-17 13:21:52 ----D---- C:\Program Files\Amazon
2014-10-17 13:20:03 ----D---- C:\ProgramData\Apple
2014-10-17 13:10:03 ----D---- C:\Windows\system32\Macromed
2014-10-17 13:09:45 ----RD---- C:\Program Files\Skype
2014-10-17 13:09:45 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-10-17 13:09:45 ----D---- C:\Program Files\Mozilla Firefox
2014-10-17 13:09:44 ----D---- C:\Program Files\Common Files\Skype
2014-10-17 13:09:44 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-01-25 231960]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 {31a2f244-4a67-4367-b593-df9513aea360}w;{31a2f244-4a67-4367-b593-df9513aea360}w; C:\Windows\system32\drivers\{31a2f244-4a67-4367-b593-df9513aea360}w.sys [2014-10-19 43152]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows x86; C:\Windows\system32\DRIVERS\Apfiltr.sys [2010-06-21 255096]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 HECI;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECI.sys [2009-09-17 41088]
R3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys [2012-04-23 76544]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-08-31 10855424]
R3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit; C:\Windows\system32\DRIVERS\NETwNs32.sys [2010-07-14 6814720]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 84992]
S1 cicmqzml;cicmqzml; \??\C:\Windows\system32\drivers\cicmqzml.sys []
S1 gmqbkxzq;gmqbkxzq; \??\C:\Windows\system32\drivers\gmqbkxzq.sys []
S1 hhdmvsxe;hhdmvsxe; \??\C:\Windows\system32\drivers\hhdmvsxe.sys []
S1 kwsitvnh;kwsitvnh; \??\C:\Windows\system32\drivers\kwsitvnh.sys []
S1 lhezqkqh;lhezqkqh; \??\C:\Windows\system32\drivers\lhezqkqh.sys []
S1 rzrudrjs;rzrudrjs; \??\C:\Windows\system32\drivers\rzrudrjs.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 bpenum;bpenum; C:\Windows\system32\DRIVERS\bpenum.sys [2009-09-15 56832]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys [2010-07-27 102784]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys []
S3 GT72NDISIPXP;GT 72 IP NDIS; C:\Windows\system32\DRIVERS\Gt51Ip.sys [2007-07-09 95744]
S3 GT72UBUS;GT 72 U BUS; C:\Windows\system32\DRIVERS\gt72ubus.sys [2007-06-26 51968]
S3 GTPTSER;GT PT SER; C:\Windows\system32\DRIVERS\gtptser.sys [2007-03-30 8064]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2011-12-31 199168]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2011-08-02 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-09-23 160560]
R2 BackupStack;Computer Backup (MyPC Backup); C:\Program Files\MyPC Backup\BackupStack.exe [2014-10-13 36936]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DCService.exe;DCService.exe; C:\ProgramData\DatacardService\DCService.exe [2010-05-08 229376]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2010-07-19 866576]
R2 GtDetectSc;GtDetectSc; C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe [2007-11-05 204915]
R2 MaintainerSvc2.60.0411857;MaintainerSvc2.60.0411857; C:\ProgramData\4c0f6683-2f83-421e-8410-9d669d28d41d\maintainer.exe [2014-11-04 123632]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-03-11 22216]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2010-07-19 477456]
R2 Update PortalMore;Update PortalMore; C:\Program Files\PortalMore\updatePortalMore.exe [2014-11-04 523504]
R2 Util PortalMore;Util PortalMore; C:\Program Files\PortalMore\bin\utilPortalMore.exe [2014-11-04 523504]
R2 VMCService;Vodafone Mobile Connect Service; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-27 107912]
S2 Internet Manager. RunOuc;Internet Manager. OUC; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [2011-06-17 224096]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-20 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-27 107912]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-22 194032]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-09-19 108032]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-08-09 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-02 1343400]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

#2 Příspěvek od **JaRon** » 04 Lis 2014 10:08

ahoj
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim

akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)

Svara7 · #3 Příspěvek od **Svara7** » 04 Lis 2014 10:42

Dekuji moc

ComboFix 14-10-29.01 - prishtinafc 11/04/2014 10:20:11.1.4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.1910.976 [GMT 1:00]
Running from: c:\users\prishtinafc\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\MyPC Backup
c:\program files\MyPC Backup\aff.conf
c:\program files\MyPC Backup\AlphaVSS.51.x86.dll
c:\program files\MyPC Backup\AlphaVSS.52.x64.dll
c:\program files\MyPC Backup\AlphaVSS.52.x86.dll
c:\program files\MyPC Backup\AlphaVSS.60.x64.dll
c:\program files\MyPC Backup\AlphaVSS.60.x86.dll
c:\program files\MyPC Backup\AlphaVSS.Common.dll
c:\program files\MyPC Backup\AWSSDK.dll
c:\program files\MyPC Backup\BackupStack.exe
c:\program files\MyPC Backup\Config\api.ts2
c:\program files\MyPC Backup\Configuration Updater.exe
c:\program files\MyPC Backup\Crypto32.dll
c:\program files\MyPC Backup\Crypto64.dll
c:\program files\MyPC Backup\Database\mpcb_backup_conf.db
c:\program files\MyPC Backup\Database\mpcb_file_cache.db
c:\program files\MyPC Backup\Database\mpcb_queues.db
c:\program files\MyPC Backup\Database\mpcb_settings.db
c:\program files\MyPC Backup\Database\mpcb_sig_cache.db
c:\program files\MyPC Backup\Database\mpcb_version_queue.db
c:\program files\MyPC Backup\de_DE.mo
c:\program files\MyPC Backup\diffstack.dll
c:\program files\MyPC Backup\es_ES.mo
c:\program files\MyPC Backup\fr_FR.mo
c:\program files\MyPC Backup\GetText.dll
c:\program files\MyPC Backup\it_IT.mo
c:\program files\MyPC Backup\LinqBridge.dll
c:\program files\MyPC Backup\log\APPLICATION.log
c:\program files\MyPC Backup\log\AUTH.log
c:\program files\MyPC Backup\log\BACKOFF.log
c:\program files\MyPC Backup\log\CLIENT.log
c:\program files\MyPC Backup\log\GRID_RECOVERY.log
c:\program files\MyPC Backup\log\GRID_RECOVERY_INIT.log
c:\program files\MyPC Backup\log\NETWORK_SHARES.log
c:\program files\MyPC Backup\log\POPUPS.log
c:\program files\MyPC Backup\log\REMOTING.log
c:\program files\MyPC Backup\log\REQUEST.log
c:\program files\MyPC Backup\log\SERVICE.log
c:\program files\MyPC Backup\log\SHELL.log
c:\program files\MyPC Backup\log\UPDATER.log
c:\program files\MyPC Backup\log\UTC_MIGRATION.log
c:\program files\MyPC Backup\log\WAIT_HANDLES.log
c:\program files\MyPC Backup\LogicNP.EZShellExtensions.dll
c:\program files\MyPC Backup\MPCBClient.dll
c:\program files\MyPC Backup\MPCBContextMenu.dll
c:\program files\MyPC Backup\MPCBIconOverlays.dll
c:\program files\MyPC Backup\MyPC Backup.exe
c:\program files\MyPC Backup\mypcbackup.ico
c:\program files\MyPC Backup\ObjectListView.dll
c:\program files\MyPC Backup\pt_PT.mo
c:\program files\MyPC Backup\RegisterExtensionDotNet20_x64.exe
c:\program files\MyPC Backup\RegisterExtensionDotNet20_x86.exe
c:\program files\MyPC Backup\RestartExplorer.exe
c:\program files\MyPC Backup\Service Start.exe
c:\program files\MyPC Backup\Shared Stack.dll
c:\program files\MyPC Backup\Signup Wizard.exe
c:\program files\MyPC Backup\syncicon.ico
c:\program files\MyPC Backup\syncing.ico
c:\program files\MyPC Backup\tick.ico
c:\program files\MyPC Backup\uninst.exe
c:\program files\MyPC Backup\UnRegisterExtensions.exe
c:\program files\MyPC Backup\Updater.exe
c:\program files\MyPC Backup\x64\System.Data.SQLite.dll
c:\program files\MyPC Backup\x86\System.Data.SQLite.dll
c:\program files\Savings Sidekick
c:\program files\Savings Sidekick\ButtonUtil.dll
c:\program files\Savings Sidekick\Savings Sidekick.ico
c:\program files\Savings Sidekick\Savings Sidekick.ini
c:\program files\Savings Sidekick\Savings SidekickInstaller.log
c:\program files\Savings Sidekick\Uninstall.exe
c:\program files\Systweak Toolbar\sySTweak-32.dll
c:\programdata\Roaming
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dhdepfaagokllfmhfbcfmocaeigmoebo_0
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dhdepfaagokllfmhfbcfmocaeigmoebo_0\3
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dhdepfaagokllfmhfbcfmocaeigmoebo_0\4
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\background.html
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\crossriderManifest.json
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\icons\actions\1.png
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\icons\icon128.png
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\icons\icon16.png
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\icons\icon48.png
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\api\chrome.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\api\cookie.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\api\message.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\background.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\app_api.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\async_api.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\bg_app_api.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\cookie_store.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\data_store.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\delegate.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\events.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\logging.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\onBGDocumentLoad.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\reports.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\util.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\js\lib\xhr.js
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\manifest.json
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo\1.21.74_0\popup.html
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dhdepfaagokllfmhfbcfmocaeigmoebo_0.localstorage
c:\users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\prishtinafc\AppData\Local\Savings Sidekick
c:\users\prishtinafc\AppData\Local\Savings Sidekick\Chrome\Savings Sidekick.crx
c:\users\prishtinafc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
c:\users\prishtinafc\AppData\Roaming\skype.ini
c:\windows\performersoftsetup.dll
c:\windows\system32\DEBUG.log
c:\windows\system32\roboot.exe
c:\windows\system32\Tasks\PC Performer Logon Scan
c:\windows\system32\Tasks\PC Performer Scheduled Scan
E:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_DCService.exe
-------\Service_BackupStack
-------\Service_BackupStack
.
.
((((((((((((((((((((((((( Files Created from 2014-10-04 to 2014-11-04 )))))))))))))))))))))))))))))))
.
.
2014-11-04 09:28 . 2014-11-04 09:31 -------- d-----w- c:\users\prishtinafc\AppData\Local\temp
2014-11-04 08:45 . 2014-11-04 08:45 -------- d-----w- C:\rsit
2014-11-04 08:45 . 2014-11-04 08:45 -------- d-----w- c:\program files\trend micro
2014-11-04 08:22 . 2014-10-17 13:01 908840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3707B3E0-E556-4683-900E-E3210DC805C5}\gapaengine.dll
2014-11-04 08:18 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\mpengine.dll
2014-11-04 08:08 . 2014-11-03 19:35 43152 ----a-w- c:\windows\system32\drivers\{a1724e9e-4583-4b6c-bcb9-e5e364683c43}w.sys
2014-11-01 15:17 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-11-01 15:08 . 2014-11-01 03:47 43152 ----a-w- c:\windows\system32\drivers\{71a533d3-f24d-436b-9e6e-3ac71fa7eec9}w.sys
2014-10-29 12:28 . 2014-11-04 08:02 -------- d-----w- c:\programdata\4c0f6683-2f83-421e-8410-9d669d28d41d
2014-10-29 11:56 . 2014-10-29 01:38 43152 ----a-w- c:\windows\system32\drivers\{6a184198-5e72-4903-80bb-e80e3a740585}w.sys
2014-10-27 13:51 . 2014-10-27 00:32 43152 ----a-w- c:\windows\system32\drivers\{c0a0d23a-662e-4f8c-9e81-e5f906e062fe}w.sys
2014-10-25 21:50 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-10-25 21:38 . 2014-10-07 02:04 812736 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2014-10-25 21:38 . 2014-09-04 05:04 372736 ----a-w- c:\windows\system32\rastls.dll
2014-10-25 21:37 . 2014-09-25 01:40 519680 ----a-w- c:\windows\system32\qdvd.dll
2014-10-25 21:37 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2014-10-25 21:37 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-10-25 21:35 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\system32\msi.dll
2014-10-25 21:35 . 2014-09-13 01:40 67072 ----a-w- c:\windows\system32\packager.dll
2014-10-25 21:34 . 2014-09-09 21:47 2048 ----a-w- c:\windows\system32\tzres.dll
2014-10-24 06:57 . 2014-10-23 18:39 43152 ----a-w- c:\windows\system32\drivers\{42489cbb-2902-475b-96ba-2ac9e47fc378}w.sys
2014-10-19 16:03 . 2014-10-19 02:03 43152 ----a-w- c:\windows\system32\drivers\{31a2f244-4a67-4367-b593-df9513aea360}w.sys
2014-10-18 12:30 . 2012-04-08 22:40 79360 ----a-w- c:\windows\system32\ff_vfw.dll
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\program files\ffdshow
2014-10-18 12:30 . 2014-11-04 09:31 -------- d-----w- c:\program files\PortalMore
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\program files\Haali
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Local\MatroskaSplitter
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Local\CodecPerformer
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Roaming\Performersoft
2014-10-18 12:29 . 2014-10-18 12:29 -------- d-----w- c:\users\prishtinafc\AppData\Roaming\UnknownFile
2014-10-18 12:29 . 2014-10-18 12:29 -------- d-----w- c:\program files\PC Performer
2014-10-17 12:59 . 2014-10-17 12:59 -------- d-----w- c:\program files\CCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-30 11:24 . 2011-12-01 09:43 229000 ------w- c:\windows\system32\MpSigStub.exe
2014-10-20 22:45 . 2012-05-22 21:25 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-10-20 22:45 . 2012-01-07 09:27 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-10-17 13:01 . 2012-02-12 11:16 908840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-01-07 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-07-24 21650016]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2014-09-25 4810520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 292208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 142616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 177432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 176408]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-09-23 165168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
web'n'walk Manager.lnk - c:\program files\T-Mobile\web'n'walk Manager\web'n'walk Manager.exe /noshow [2007-11-7 798720]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R1 cicmqzml;cicmqzml;c:\windows\system32\drivers\cicmqzml.sys [x]
R1 gmqbkxzq;gmqbkxzq;c:\windows\system32\drivers\gmqbkxzq.sys [x]
R1 hhdmvsxe;hhdmvsxe;c:\windows\system32\drivers\hhdmvsxe.sys [x]
R1 kwsitvnh;kwsitvnh;c:\windows\system32\drivers\kwsitvnh.sys [x]
R1 lhezqkqh;lhezqkqh;c:\windows\system32\drivers\lhezqkqh.sys [x]
R1 rzrudrjs;rzrudrjs;c:\windows\system32\drivers\rzrudrjs.sys [x]
R2 Internet Manager. RunOuc;Internet Manager. OUC;c:\program files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [2011-06-17 224096]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-04-03 315008]
R3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [2009-09-15 56832]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-07-27 102784]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-07-09 95744]
R3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-06-26 51968]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-09-19 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub; [x]
S1 MpKslf7b47694;MpKslf7b47694;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\MpKslf7b47694.sys [2014-11-04 39464]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-09-23 160560]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
S2 GtDetectSc;GtDetectSc;c:\program files\T-Mobile\web'n'walk Manager\GtDetectSc.exe [2007-11-05 204915]
S2 MaintainerSvc2.60.0411857;MaintainerSvc2.60.0411857;c:\programdata\4c0f6683-2f83-421e-8410-9d669d28d41d\maintainer.exe [2014-11-04 123632]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2012-04-23 76544]
S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2010-07-14 6814720]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2014-11-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-25 22:45]
.
2014-11-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000Core.job
- c:\users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-14 23:25]
.
2014-11-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000UA.job
- c:\users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-14 23:25]
.
2014-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-07 15:14]
.
2014-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-07 15:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.findamo.com?&cid=3975ch=2
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 77.237.128.2 77.237.128.1
FF - ProfilePath - c:\users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\
FF - prefs.js: browser.search.selectedEngine - YouTube-Videosuche
FF - prefs.js: browser.startup.homepage - hxxp://www.findamo.com?&cid=3975ch=2
user_pref(extensions.autoDisableScopes,14);
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-MyPC Backup - c:\program files\MyPC Backup\uninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4054779759-107291172-2637059254-1000\Software\Microsoft\Internet Explorer\Approved Extensions]
@DACL=(02 0000)
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,3b,1b,71,2b,97,
6e,f6,64,4a,09,ac,f7,40,fc,1c,7b,e1,60
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,3b,1b,f1,00,46,
36,c5,0f,0d,02,b3,ad,84,e9,66,6d,00,8f
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,21,3f,
51,8d,3d,12,03,8b,fb,b6,9b,04,76,3b,6b
"{98889811-442D-49DD-99D7-DC866BE87DBC}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,82,9a,
84,1e,10,b5,0d,82,d9,97,c6,6a,ab,3f,a2
"{74F475FA-6C75-43BD-AAB9-ECDA6184F600}"=hex:51,66,7a,6c,4c,1d,3b,1b,ea,6f,e6,
68,46,38,d5,07,b1,b7,a7,9a,60,c7,b4,1e
"{2EECD738-5844-4A99-B4B6-146BF802613B}"=hex:51,66,7a,6c,4c,1d,3b,1b,28,cd,fe,
32,77,0c,f1,0e,af,b8,5f,2b,f9,41,23,25
"{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}"=hex:51,66,7a,6c,4c,1d,3b,1b,fb,ac,88,
bc,86,65,24,01,8c,e2,d0,69,4c,d1,ac,34
"{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"=hex:51,66,7a,6c,4c,1d,3b,1b,0e,1c,60,
e1,ed,cb,25,0c,be,84,40,eb,40,12,88,c6
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_189_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_189_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Advanced System Protector\AdvancedSystemProtector.exe
c:\programdata\Internet Manager\OnlineUpdate\ouc.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\UI0Detect.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\PortalMore\bin\utilPortalMore.exe
c:\program files\PortalMore\bin\PortalMore.BrowserAdapter.exe
c:\program files\PortalMore\bin\PortalMore.PurBrowse.exe
c:\windows\system32\conhost.exe
c:\program files\PortalMore\bin\PortalMore.BOASHelper.exe
c:\program files\PortalMore\updatePortalMore.exe
.
**************************************************************************
.
Completion time: 2014-11-04 10:39:07 - machine was rebooted
ComboFix-quarantined-files.txt 2014-11-04 09:39
.
Pre-Run: 58,315,403,264 bytes free
Post-Run: 59,429,584,896 bytes free
.
- - End Of File - - 10B2E02E4C3AFA3E452BB3C9681F58FE
A36C5E4F47E84449FF07ED3517B43A31

#4 Příspěvek od **JaRon** » 04 Lis 2014 10:47

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Driver::
cicmqzml
gmqbkxzq
hhdmvsxe
kwsitvnh
lhezqkqh
rzrudrjs

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:

Obrázek

po aplikacii by mal vzniknut dalsi log, ten vloz sem

Svara7 · #5 Příspěvek od **Svara7** » 04 Lis 2014 12:29

Dekuji, tady je:

ComboFix 14-10-29.01 - prishtinafc 11/04/2014 10:56:13.2.4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.1910.931 [GMT 1:00]
Running from: c:\users\prishtinafc\Desktop\ComboFix.exe
Command switches used :: c:\users\prishtinafc\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_cicmqzml
-------\Service_gmqbkxzq
-------\Service_hhdmvsxe
-------\Service_kwsitvnh
-------\Service_lhezqkqh
-------\Service_rzrudrjs
.
.
((((((((((((((((((((((((( Files Created from 2014-10-04 to 2014-11-04 )))))))))))))))))))))))))))))))
.
.
2014-11-04 10:02 . 2014-11-04 10:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-11-04 09:39 . 2014-11-04 09:39 39464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\MpKsl66b8042e.sys
2014-11-04 09:28 . 2014-11-04 10:04 -------- d-----w- c:\users\prishtinafc\AppData\Local\temp
2014-11-04 08:45 . 2014-11-04 08:45 -------- d-----w- C:\rsit
2014-11-04 08:45 . 2014-11-04 08:45 -------- d-----w- c:\program files\trend micro
2014-11-04 08:22 . 2014-10-17 13:01 908840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3707B3E0-E556-4683-900E-E3210DC805C5}\gapaengine.dll
2014-11-04 08:18 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\mpengine.dll
2014-11-04 08:08 . 2014-11-03 19:35 43152 ----a-w- c:\windows\system32\drivers\{a1724e9e-4583-4b6c-bcb9-e5e364683c43}w.sys
2014-11-01 15:17 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-11-01 15:08 . 2014-11-01 03:47 43152 ----a-w- c:\windows\system32\drivers\{71a533d3-f24d-436b-9e6e-3ac71fa7eec9}w.sys
2014-10-29 12:28 . 2014-11-04 08:02 -------- d-----w- c:\programdata\4c0f6683-2f83-421e-8410-9d669d28d41d
2014-10-29 11:56 . 2014-10-29 01:38 43152 ----a-w- c:\windows\system32\drivers\{6a184198-5e72-4903-80bb-e80e3a740585}w.sys
2014-10-27 13:51 . 2014-10-27 00:32 43152 ----a-w- c:\windows\system32\drivers\{c0a0d23a-662e-4f8c-9e81-e5f906e062fe}w.sys
2014-10-25 21:50 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-10-25 21:38 . 2014-10-07 02:04 812736 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2014-10-25 21:38 . 2014-09-04 05:04 372736 ----a-w- c:\windows\system32\rastls.dll
2014-10-25 21:37 . 2014-09-25 01:40 519680 ----a-w- c:\windows\system32\qdvd.dll
2014-10-25 21:37 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2014-10-25 21:37 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-10-25 21:35 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\system32\msi.dll
2014-10-25 21:35 . 2014-09-13 01:40 67072 ----a-w- c:\windows\system32\packager.dll
2014-10-25 21:34 . 2014-09-09 21:47 2048 ----a-w- c:\windows\system32\tzres.dll
2014-10-24 06:57 . 2014-10-23 18:39 43152 ----a-w- c:\windows\system32\drivers\{42489cbb-2902-475b-96ba-2ac9e47fc378}w.sys
2014-10-19 16:03 . 2014-10-19 02:03 43152 ----a-w- c:\windows\system32\drivers\{31a2f244-4a67-4367-b593-df9513aea360}w.sys
2014-10-18 12:30 . 2012-04-08 22:40 79360 ----a-w- c:\windows\system32\ff_vfw.dll
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\program files\ffdshow
2014-10-18 12:30 . 2014-11-04 10:04 -------- d-----w- c:\program files\PortalMore
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\program files\Haali
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Local\MatroskaSplitter
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Local\CodecPerformer
2014-10-18 12:30 . 2014-10-18 12:30 -------- d-----w- c:\users\prishtinafc\AppData\Roaming\Performersoft
2014-10-18 12:29 . 2014-10-18 12:29 -------- d-----w- c:\users\prishtinafc\AppData\Roaming\UnknownFile
2014-10-18 12:29 . 2014-10-18 12:29 -------- d-----w- c:\program files\PC Performer
2014-10-17 12:59 . 2014-10-17 12:59 -------- d-----w- c:\program files\CCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-30 11:24 . 2011-12-01 09:43 229000 ------w- c:\windows\system32\MpSigStub.exe
2014-10-20 22:45 . 2012-05-22 21:25 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-10-20 22:45 . 2012-01-07 09:27 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-10-17 13:01 . 2012-02-12 11:16 908840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-01-07 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-07-24 21650016]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2014-09-25 4810520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 292208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 142616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 177432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 176408]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-10-09 124720]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
web'n'walk Manager.lnk - c:\program files\T-Mobile\web'n'walk Manager\web'n'walk Manager.exe /noshow [2007-11-7 798720]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R1 MpKslf7b47694;MpKslf7b47694;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\MpKslf7b47694.sys [x]
R2 Internet Manager. RunOuc;Internet Manager. OUC;c:\program files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [2011-06-17 224096]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-04-03 315008]
R3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [2009-09-15 56832]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-07-27 102784]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-07-09 95744]
R3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-06-26 51968]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-09-19 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub; [x]
S1 MpKsl66b8042e;MpKsl66b8042e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F0446CEA-DECE-4F3F-AE59-BD6EE86DA337}\MpKsl66b8042e.sys [2014-11-04 39464]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-10-09 162096]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
S2 GtDetectSc;GtDetectSc;c:\program files\T-Mobile\web'n'walk Manager\GtDetectSc.exe [2007-11-05 204915]
S2 MaintainerSvc2.60.0411857;MaintainerSvc2.60.0411857;c:\programdata\4c0f6683-2f83-421e-8410-9d669d28d41d\maintainer.exe [2014-11-04 123632]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2012-04-23 76544]
S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2010-07-14 6814720]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-11-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-25 22:45]
.
2014-11-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000Core.job
- c:\users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-14 23:25]
.
2014-11-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4054779759-107291172-2637059254-1000UA.job
- c:\users\prishtinafc\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-14 23:25]
.
2014-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-07 15:14]
.
2014-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-07 15:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.findamo.com?&cid=3975ch=2
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 77.237.128.2 77.237.128.1
FF - ProfilePath - c:\users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\
FF - prefs.js: browser.search.selectedEngine - YouTube-Videosuche
FF - prefs.js: browser.startup.homepage - hxxp://www.findamo.com?&cid=3975ch=2
user_pref(extensions.autoDisableScopes,14);
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4054779759-107291172-2637059254-1000\Software\Microsoft\Internet Explorer\Approved Extensions]
@DACL=(02 0000)
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,3b,1b,71,2b,97,
6e,f6,64,4a,09,ac,f7,40,fc,1c,7b,e1,60
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,3b,1b,f1,00,46,
36,c5,0f,0d,02,b3,ad,84,e9,66,6d,00,8f
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,21,3f,
51,8d,3d,12,03,8b,fb,b6,9b,04,76,3b,6b
"{98889811-442D-49DD-99D7-DC866BE87DBC}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,82,9a,
84,1e,10,b5,0d,82,d9,97,c6,6a,ab,3f,a2
"{74F475FA-6C75-43BD-AAB9-ECDA6184F600}"=hex:51,66,7a,6c,4c,1d,3b,1b,ea,6f,e6,
68,46,38,d5,07,b1,b7,a7,9a,60,c7,b4,1e
"{2EECD738-5844-4A99-B4B6-146BF802613B}"=hex:51,66,7a,6c,4c,1d,3b,1b,28,cd,fe,
32,77,0c,f1,0e,af,b8,5f,2b,f9,41,23,25
"{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}"=hex:51,66,7a,6c,4c,1d,3b,1b,fb,ac,88,
bc,86,65,24,01,8c,e2,d0,69,4c,d1,ac,34
"{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"=hex:51,66,7a,6c,4c,1d,3b,1b,0e,1c,60,
e1,ed,cb,25,0c,be,84,40,eb,40,12,88,c6
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_189_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_189_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Advanced System Protector\AdvancedSystemProtector.exe
c:\programdata\Internet Manager\OnlineUpdate\ouc.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\windows\system32\sppsvc.exe
c:\program files\PortalMore\updatePortalMore.exe
c:\program files\PortalMore\bin\utilPortalMore.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
c:\windows\system32\UI0Detect.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conhost.exe
c:\program files\PortalMore\bin\PortalMore.PurBrowse.exe
c:\windows\system32\conhost.exe
c:\program files\PortalMore\bin\PortalMore.BrowserAdapter.exe
c:\program files\PortalMore\bin\PortalMore.BOASHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Completion time: 2014-11-04 11:08:34 - machine was rebooted
ComboFix-quarantined-files.txt 2014-11-04 10:08
ComboFix2.txt 2014-11-04 09:39
.
Pre-Run: 59,323,871,232 bytes free
Post-Run: 14 Verzeichnis(se), 59,174,621,184 Bytes frei
.
- - End Of File - - CA7DB4CEE33F065F4A2745D26FA09045
A36C5E4F47E84449FF07ED3517B43A31

#6 Příspěvek od **JaRon** » 04 Lis 2014 12:58

1. odinstaluj Advanced System Protector
2. vycisti PC s ADWCleanerom
3. prescanuj s TDSSKiller - ak nieco najde - log sem

Svara7 · #7 Příspěvek od **Svara7** » 04 Lis 2014 14:02

TDSSkiller nic nenalezl. ADWcleaner vypsal toto:

# AdwCleaner v3.311 - Report created 04/11/2014 at 13:25:01
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (32 bits)
# Username : prishtinafc - PRISHTINAFC-PC
# Running from : C:\Users\prishtinafc\Downloads\adwcleaner_3.311.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : Update PortalMore
[#] Service Deleted : Util PortalMore
Service Deleted : {31a2f244-4a67-4367-b593-df9513aea360}w
Service Deleted : {42489cbb-2902-475b-96ba-2ac9e47fc378}w
Service Deleted : {6a184198-5e72-4903-80bb-e80e3a740585}w
Service Deleted : {71a533d3-f24d-436b-9e6e-3ac71fa7eec9}w
Service Deleted : {a1724e9e-4583-4b6c-bcb9-e5e364683c43}w
Service Deleted : {c0a0d23a-662e-4f8c-9e81-e5f906e062fe}w

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\BitGuard
Folder Deleted : C:\ProgramData\IBUpdaterService
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer
Folder Deleted : C:\Program Files\PC Performer
Folder Deleted : C:\Program Files\Systweak Toolbar
Folder Deleted : C:\Program Files\VideoPerformer
[!] Folder Deleted : C:\Program Files\PortalMore
Folder Deleted : C:\Users\prishtinafc\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\Babylon
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\PerformerSoft
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\rightbackup
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\Systweak
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Folder Deleted : C:\Users\prishtinafc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoPerformer
Folder Deleted : C:\Users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Extensions\oieclmddeijbdilojgahahcjmjkhbilp
File Deleted : C:\Windows\system32\drivers\{31a2f244-4a67-4367-b593-df9513aea360}w.sys
File Deleted : C:\Windows\system32\drivers\{42489cbb-2902-475b-96ba-2ac9e47fc378}w.sys
File Deleted : C:\Windows\system32\drivers\{6a184198-5e72-4903-80bb-e80e3a740585}w.sys
File Deleted : C:\Windows\system32\drivers\{71a533d3-f24d-436b-9e6e-3ac71fa7eec9}w.sys
File Deleted : C:\Windows\system32\drivers\{a1724e9e-4583-4b6c-bcb9-e5e364683c43}w.sys
File Deleted : C:\Windows\system32\drivers\{c0a0d23a-662e-4f8c-9e81-e5f906e062fe}w.sys
File Deleted : C:\Users\prishtinafc\Desktop\MyPC Backup.lnk
File Deleted : C:\Users\prishtinafc\Desktop\PC Performer.lnk
File Deleted : C:\Users\prishtinafc\Desktop\Sync Folder.lnk
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\bprotector_extensions.sqlite
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\bprotector_prefs.js
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\foxydeal.sqlite
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\invalidprefs.js
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\searchplugins\Search The Web.xml
File Deleted : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\user.js
File Deleted : C:\Users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
File Deleted : C:\Users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\prishtinafc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****

Task Deleted : LaunchSignup

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\babylon.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatePortalMore_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatePortalMore_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilPortalMore_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilPortalMore_RASMANCS
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Update PortalMore
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Util PortalMore
Key Deleted : HKCU\Software\5248cd0e63bef17
Key Deleted : HKLM\SOFTWARE\5248cd0e63bef17
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055505560}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066506660}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Babylon
Key Deleted : HKCU\Software\performersoft llc
Key Deleted : HKCU\Software\PerformerSoft
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\UnknownFile
Key Deleted : HKCU\Software\PortalMore
Key Deleted : HKCU\Software\AppDataLow\Software\Savings Sidekick
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\Iminent
Key Deleted : HKLM\SOFTWARE\PerformerSoft
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\PortalMore
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnknownFile
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Performer_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PortalMore
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B2468513CA2D6943A1A233CD3F88CE7
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6207E55EA2FE71A4AA7ABD89AEF31D1B
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\6207E55EA2FE71A4AA7ABD89AEF31D1B

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

-\\ Mozilla Firefox v31.0 (x86 de)

[ File : C:\Users\prishtinafc\AppData\Roaming\Mozilla\Firefox\Profiles\pm0a4hsx.default\prefs.js ]

Line Deleted : user_pref("browser.search.order.1", "Search The Web");

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [14332 octets] - [04/11/2014 13:23:55]
AdwCleaner[S0].txt - [14285 octets] - [04/11/2014 13:25:01]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14346 octets] ##########

#8 Příspěvek od **JaRon** » 04 Lis 2014 14:09

citat:
Odinstalujte Combofix
• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky
+
nahraf tuto parodiu na AV >> Microsoft Security Essentials
nejakym normalnym AV - nemecky kolega si snad moze kupit Aviru ,,,
+
ak nie su problemy - hotovo

Svara7 · #9 Příspěvek od **Svara7** » 04 Lis 2014 14:46

Moc dekuji za pomoc, zda se vse ok

#10 Příspěvek od **JaRon** » 04 Lis 2014 14:48

rado sa stalo

VIRY.CZ

Zavirovany notebook

Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook

Re: Zavirovany notebook