zavirovaný noťas

[ententeak]

zdravím.. dnes mi sestra přinesla noťas, že je prej zasekanej..
tak jsem ho spustil v nouzáku a ze složky "Po spuštění" jsem vymazal cca 90 souborů *.vbs a pár s názvy jako facebook.exe atp.
Dále jsem pomocí hijackthis fixnul 160 položek, který odkazovaly na výše zmíněné soubory.
Když jsem to pak chtěl dočistit CCleanerem, tak jsem zjistil, že ani nejde spustit instalátor (vůbecnic se neděje)
A tak se obracím s prosbou o pomoc na Vás.
Zde je kdyžtak výpis z RSITu:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Prachov at 2015-09-28 19:06:54
Microsoft® Windows Vista™ Home Basic
System drive C: has 15 GB (22%) free of 66 GB
Total RAM: 2038 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:07:17, on 28.9.2015
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Prachov\Downloads\RSIT.exe
C:\Program Files\trend micro\Prachov.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Service KMSELDI - Unknown owner - C:\Program Files\KMSpico\Service_KMS.exe

--
End of file - 3894 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Prachov\AppData\Roaming\Mozilla\Firefox\Profiles\pvagz6wn.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe� Flash� Player 19.0.0.185 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_185.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2014-12-12 1006264]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-23 4423680]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2014-12-12 1232896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-03-30 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2015-09-28 19:06:55 ----D---- C:\Program Files\trend micro
2015-09-28 19:06:54 ----D---- C:\rsit
2015-09-28 18:22:36 ----A---- C:\Windows\ntbtlog.txt
2015-09-26 14:25:55 ----A---- C:\Users\Prachov\AppData\Roaming\tmp3C9E.tmp.vbs
2015-09-26 14:25:39 ----A---- C:\Users\Prachov\AppData\Roaming\xtpmosscnr.vbs
2015-09-26 14:25:25 ----A---- C:\Users\Prachov\AppData\Roaming\fdnlefdqrx.vbs
2015-09-25 22:00:47 ----A---- C:\Users\Prachov\AppData\Roaming\systeme32.exe
2015-09-25 18:55:17 ----A---- C:\Users\Prachov\AppData\Roaming\google.exe
2015-09-25 18:33:27 ----A---- C:\Users\Prachov\AppData\Roaming\tmp9D11.tmp.vbs
2015-09-25 18:32:18 ----A---- C:\Users\Prachov\AppData\Roaming\tmp8F3A.tmp.vbs
2015-09-25 18:32:13 ----A---- C:\Users\Prachov\AppData\Roaming\tmp7C07.tmp.vbs
2015-09-25 18:32:10 ----A---- C:\Users\Prachov\AppData\Roaming\tmp712E.tmp.vbs
2015-09-25 18:32:08 ----A---- C:\Users\Prachov\AppData\Roaming\tmp67F9.tmp.vbs
2015-09-25 16:59:47 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe.tmp
2015-09-25 16:58:38 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe
2015-09-24 21:06:20 ----D---- C:\ProgramData\Isolated Storage
2015-09-24 20:50:33 ----A---- C:\Users\Prachov\AppData\Roaming\svchost.exe
2015-09-24 20:34:45 ----A---- C:\Users\Prachov\AppData\Roaming\windows.exe
2015-09-24 19:52:53 ----D---- C:\Users\Prachov\AppData\Roaming\dclogs
2015-09-24 19:47:50 ----A---- C:\ProgramData\windows.exe
2015-09-24 15:52:17 ----D---- C:\Program Files\Mozilla Firefox
2015-09-24 12:12:28 ----A---- C:\Users\Prachov\AppData\Roaming\system32.exe.tmp
2015-09-24 12:12:02 ----A---- C:\Users\Prachov\AppData\Roaming\system32.exe
2015-09-23 21:22:58 ----A---- C:\Users\Prachov\AppData\Roaming\Server.exe
2015-09-23 19:14:01 ----A---- C:\Users\Prachov\AppData\Roaming\Crypted_VeWTZv.exe
2015-09-23 19:12:15 ----A---- C:\Users\Prachov\AppData\Roaming\tmp617F.tmp.vbs
2015-09-21 18:52:50 ----A---- C:\ProgramData\system32.exe
2015-09-06 19:14:27 ----D---- C:\Program Files\McAfee Security Scan
2015-09-02 21:06:49 ----A---- C:\ProgramData\55.exe

======List of files/folders modified in the last 1 month======

2015-09-28 19:06:55 ----RD---- C:\Program Files
2015-09-28 19:01:47 ----D---- C:\Windows\System32
2015-09-28 19:01:46 ----D---- C:\Windows\inf
2015-09-28 19:01:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-28 18:55:52 ----D---- C:\Windows\Temp
2015-09-28 18:37:44 ----D---- C:\Windows\system32\logs
2015-09-28 18:31:49 ----D---- C:\Windows\system32\drivers\etc
2015-09-28 18:22:36 ----D---- C:\Windows
2015-09-26 11:21:25 ----D---- C:\ProgramData\Mozilla
2015-09-25 15:51:03 ----SHD---- C:\System Volume Information
2015-09-25 14:06:26 ----D---- C:\Program Files\Mozilla Maintenance Service
2015-09-24 21:06:20 ----HD---- C:\ProgramData
2015-09-24 20:59:02 ----SHD---- C:\Windows\Installer
2015-09-22 17:12:39 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-09-21 18:52:50 ----D---- C:\Windows\Prefetch
2015-09-20 16:06:30 ----D---- C:\Windows\system32\drivers
2015-09-08 21:58:42 ----D---- C:\Windows\system32\catroot2
2015-09-07 07:03:10 ----D---- C:\Users\Prachov\AppData\Roaming\vlc
2015-09-04 15:18:05 ----SD---- C:\Users\Prachov\AppData\Roaming\Microsoft
2015-09-02 21:06:43 ----D---- C:\ProgramData\McAfee

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-02-12 277784]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2009-03-02 38400]
S2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2013-04-30 5120]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-26 1761696]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2014-12-12 82432]
S3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-01-24 290304]
S3 usbaudio;Ovladač zvuků USB (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2015-08-22 75136]
S2 Service KMSELDI;Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [2013-11-25 800536]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-22 269000]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe [2015-07-31 235696]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-09-24 147624]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

[ententeak]

# AdwCleaner v5.009 - Logfile created 28/09/2015 at 20:24:16
# Updated 27/09/2015 by Xplode
# Database : 2015-09-27.1 [Server]
# Operating system : Windows Vista (TM) Home Basic (x86)
# Username : Prachov - PRACHOV-PC
# Running from : E:\adwcleaner_5.009.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : Adobe Flash Player Updater

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\0515ad80f5c891520879365a690ca1ce
[-] Key Deleted : HKCU\Software\06403edf2da84676405ba47ed927efe8
[-] Key Deleted : HKCU\Software\0a9fc54d1fd9c1db44f41409a9274213
[-] Key Deleted : HKCU\Software\1710a28a45b655e95348aca814ccf3ec
[-] Key Deleted : HKCU\Software\1748e8e8175e6660122f85ed736fc024
[-] Key Deleted : HKCU\Software\1ac54efef229386218f9defd73c9fae1
[-] Key Deleted : HKCU\Software\1d3aef793af087b59ec719731dc2847e
[-] Key Deleted : HKCU\Software\23556fb1360f366337f97c924e76ead3
[-] Key Deleted : HKCU\Software\2871008b11b19831c86ab1ee3dd267c7
[-] Key Deleted : HKCU\Software\2ad8d984bfc960b9426eecbec660a9bc
[-] Key Deleted : HKCU\Software\3216893c52598aba9c50043b71480bc9
[-] Key Deleted : HKCU\Software\37f860443296616ff1a1032dff645de1
[-] Key Deleted : HKCU\Software\3bd13f8af846694af836aa5a2c763ceb
[-] Key Deleted : HKCU\Software\3ea30f8d2d29e35bcde6a3aecc233a60
[-] Key Deleted : HKCU\Software\5531986d5abab4c4868b719c0565fc56
[-] Key Deleted : HKCU\Software\5cd8f17f4086744065eb0992a09e05a2
[-] Key Deleted : HKCU\Software\60d892344ef1489b8a74a8c0a3278254
[-] Key Deleted : HKCU\Software\66a0787319cac24fe398f1f8d44fb11b
[-] Key Deleted : HKCU\Software\68586d46470da7fa6e4c622786775e97
[-] Key Deleted : HKCU\Software\6e9b3cd9ea5f9879fb3dd5b668f334f7
[-] Key Deleted : HKCU\Software\78da0422172bb1c4bf8f5b473fa4639a
[-] Key Deleted : HKCU\Software\802a9357a9751f943d94eb663ea75ff1
[-] Key Deleted : HKCU\Software\8a1b3ed71d4a43a8504ec95da2c6191e
[-] Key Deleted : HKCU\Software\9ed966436aaf0c9b3532d2886ac543a4
[-] Key Deleted : HKCU\Software\a374829b0e37920935a4bbca40f63d1b
[-] Key Deleted : HKCU\Software\a3ea41f4963757b1cdfde9e372ecd474
[-] Key Deleted : HKCU\Software\a7dc92269d0800e76f2433513c03e981
[-] Key Deleted : HKCU\Software\ac81fa871a4336b2440cb3826cd12647
[-] Key Deleted : HKCU\Software\b3adaf8638cb357cd6920b27eaaf2359
[-] Key Deleted : HKCU\Software\b424857db990f63ef956b71e7a796979
[-] Key Deleted : HKCU\Software\b71003c1546ffe63d5b7bb696082e8ea
[-] Key Deleted : HKCU\Software\bcc246c0d7dcabe439f23df50156a292
[-] Key Deleted : HKCU\Software\c5dd127ab224a68ace908cef61aa4f16
[-] Key Deleted : HKCU\Software\c6790ce50eb4f56d214739fcff7acf56
[-] Key Deleted : HKCU\Software\cbad6784b4976def0050c4fa9b9dcf8d
[-] Key Deleted : HKCU\Software\e5c1ec3f25c8f93b432a0260276b94b7
[-] Key Deleted : HKCU\Software\ea78a88ee5a5c9eceab729803f7062de
[-] Key Deleted : HKCU\Software\f2be33b5e367f7ac26771cf7c4ff63aa
[-] Key Deleted : HKCU\Software\f58c4ae67804dde5f71e2e33f36c3d00
[-] Key Deleted : HKCU\Software\f706d7b5fa83b13c5dd10aaee625aa12

***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [3291 bytes] ##########

[Rudy]

Dejte nový log RSIT.

[ententeak]

Logfile of random's system information tool 1.10 (written by random/random)
Run by Prachov at 2015-09-28 21:09:44
Microsoft® Windows Vista™ Home Basic
System drive C: has 13 GB (19%) free of 66 GB
Total RAM: 2038 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:09:49, on 28.9.2015
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe
C:\Users\Prachov\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Prachov\Downloads\RSIT.exe
C:\Program Files\trend micro\Prachov.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Service KMSELDI - Unknown owner - C:\Program Files\KMSpico\Service_KMS.exe

--
End of file - 4383 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Prachov\AppData\Roaming\Mozilla\Firefox\Profiles\pvagz6wn.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe� Flash� Player 19.0.0.185 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_185.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2014-12-12 1006264]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-23 4423680]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2014-12-12 1232896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-03-30 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2015-09-28 20:24:57 ----ASH---- C:\hiberfil.sys
2015-09-28 20:22:13 ----D---- C:\AdwCleaner
2015-09-28 20:21:14 ----A---- C:\Windows\system32\igfxres.dll
2015-09-28 19:06:55 ----D---- C:\Program Files\trend micro
2015-09-28 19:06:54 ----D---- C:\rsit
2015-09-28 18:22:36 ----A---- C:\Windows\ntbtlog.txt
2015-09-26 14:25:55 ----A---- C:\Users\Prachov\AppData\Roaming\tmp3C9E.tmp.vbs
2015-09-26 14:25:39 ----A---- C:\Users\Prachov\AppData\Roaming\xtpmosscnr.vbs
2015-09-26 14:25:25 ----A---- C:\Users\Prachov\AppData\Roaming\fdnlefdqrx.vbs
2015-09-25 22:00:47 ----A---- C:\Users\Prachov\AppData\Roaming\systeme32.exe
2015-09-25 18:55:17 ----A---- C:\Users\Prachov\AppData\Roaming\google.exe
2015-09-25 18:33:27 ----A---- C:\Users\Prachov\AppData\Roaming\tmp9D11.tmp.vbs
2015-09-25 18:32:18 ----A---- C:\Users\Prachov\AppData\Roaming\tmp8F3A.tmp.vbs
2015-09-25 18:32:13 ----A---- C:\Users\Prachov\AppData\Roaming\tmp7C07.tmp.vbs
2015-09-25 18:32:10 ----A---- C:\Users\Prachov\AppData\Roaming\tmp712E.tmp.vbs
2015-09-25 18:32:08 ----A---- C:\Users\Prachov\AppData\Roaming\tmp67F9.tmp.vbs
2015-09-25 16:59:47 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe.tmp
2015-09-25 16:58:38 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe
2015-09-24 21:06:20 ----D---- C:\ProgramData\Isolated Storage
2015-09-24 20:50:33 ----A---- C:\Users\Prachov\AppData\Roaming\svchost.exe
2015-09-24 20:34:45 ----A---- C:\Users\Prachov\AppData\Roaming\windows.exe
2015-09-24 19:52:53 ----D---- C:\Users\Prachov\AppData\Roaming\dclogs
2015-09-24 19:47:50 ----A---- C:\ProgramData\windows.exe
2015-09-24 15:52:17 ----D---- C:\Program Files\Mozilla Firefox
2015-09-24 12:12:28 ----A---- C:\Users\Prachov\AppData\Roaming\system32.exe.tmp
2015-09-24 12:12:02 ----A---- C:\Users\Prachov\AppData\Roaming\system32.exe
2015-09-23 21:22:58 ----A---- C:\Users\Prachov\AppData\Roaming\Server.exe
2015-09-23 19:14:01 ----A---- C:\Users\Prachov\AppData\Roaming\Crypted_VeWTZv.exe
2015-09-23 19:12:15 ----A---- C:\Users\Prachov\AppData\Roaming\tmp617F.tmp.vbs
2015-09-21 18:52:50 ----A---- C:\ProgramData\system32.exe
2015-09-06 19:14:27 ----D---- C:\Program Files\McAfee Security Scan
2015-09-02 21:06:49 ----A---- C:\ProgramData\55.exe

======List of files/folders modified in the last 1 month======

2015-09-28 21:09:48 ----D---- C:\Windows\Temp
2015-09-28 20:33:09 ----D---- C:\Windows\System32
2015-09-28 20:33:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-28 20:25:56 ----D---- C:\Windows\system32\logs
2015-09-28 20:24:16 ----D---- C:\Windows\Tasks
2015-09-28 19:09:29 ----D---- C:\Windows\inf
2015-09-28 19:06:55 ----RD---- C:\Program Files
2015-09-28 18:31:49 ----D---- C:\Windows\system32\drivers\etc
2015-09-28 18:22:36 ----D---- C:\Windows
2015-09-26 11:21:25 ----D---- C:\ProgramData\Mozilla
2015-09-25 15:51:03 ----SHD---- C:\System Volume Information
2015-09-25 14:06:26 ----D---- C:\Program Files\Mozilla Maintenance Service
2015-09-24 21:06:20 ----HD---- C:\ProgramData
2015-09-24 20:59:02 ----SHD---- C:\Windows\Installer
2015-09-22 17:12:39 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-09-21 18:52:50 ----D---- C:\Windows\Prefetch
2015-09-20 16:06:30 ----D---- C:\Windows\system32\drivers
2015-09-08 21:58:42 ----D---- C:\Windows\system32\catroot2
2015-09-07 07:03:10 ----D---- C:\Users\Prachov\AppData\Roaming\vlc
2015-09-04 15:18:05 ----SD---- C:\Users\Prachov\AppData\Roaming\Microsoft
2015-09-02 21:06:43 ----D---- C:\ProgramData\McAfee

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-02-12 277784]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2013-04-30 5120]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-26 1761696]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2014-12-12 82432]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-01-24 290304]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2009-03-02 38400]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 usbaudio;Ovladač zvuků USB (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2015-08-22 75136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S2 Service KMSELDI;Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [2013-11-25 800536]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-22 269000]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe [2015-07-31 235696]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-09-24 147624]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\Program Files\McAfee Security Scan
C:\Program Files\KMSpico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
C:\Users\Prachov\AppData\Roaming\tmp*.tmp.vbs
C:\Users\Prachov\AppData\Roaming\svchost.exe
C:\Users\Prachov\AppData\Roaming\windows.exe
C:\Users\Prachov\AppData\Roaming\system32.exe.tmp
C:\Users\Prachov\AppData\Roaming\system32.exe
C:\Users\Prachov\AppData\Roaming\Server.exe
C:\Users\Prachov\AppData\Roaming\Crypted_VeWTZv.exe
C:\ProgramData\system32.exe
C:\ProgramData\55.exe

:services
McComponentHostService
Service KMSELDI

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

[ententeak]

Logfile of random's system information tool 1.10 (written by random/random)
Run by Prachov at 2015-09-29 15:14:14
Microsoft® Windows Vista™ Home Basic
System drive C: has 13 GB (20%) free of 66 GB
Total RAM: 2038 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:14:22, on 29.9.2015
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Prachov\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Users\Prachov\Downloads\RSIT.exe
C:\Program Files\trend micro\Prachov.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 3983 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Prachov\AppData\Roaming\Mozilla\Firefox\Profiles\pvagz6wn.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe� Flash� Player 19.0.0.185 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_185.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2014-12-12 1006264]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-23 4423680]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2014-12-12 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-03-30 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2015-09-29 14:59:40 ----D---- C:\_OTM
2015-09-28 20:24:57 ----ASH---- C:\hiberfil.sys
2015-09-28 20:22:13 ----D---- C:\AdwCleaner
2015-09-28 20:21:14 ----A---- C:\Windows\system32\igfxres.dll
2015-09-28 19:06:55 ----D---- C:\Program Files\trend micro
2015-09-28 19:06:54 ----D---- C:\rsit
2015-09-28 18:22:36 ----A---- C:\Windows\ntbtlog.txt
2015-09-26 14:25:39 ----A---- C:\Users\Prachov\AppData\Roaming\xtpmosscnr.vbs
2015-09-26 14:25:25 ----A---- C:\Users\Prachov\AppData\Roaming\fdnlefdqrx.vbs
2015-09-25 22:00:47 ----A---- C:\Users\Prachov\AppData\Roaming\systeme32.exe
2015-09-25 18:55:17 ----A---- C:\Users\Prachov\AppData\Roaming\google.exe
2015-09-25 16:59:47 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe.tmp
2015-09-25 16:58:38 ----A---- C:\Users\Prachov\AppData\Roaming\Systeme.exe
2015-09-24 21:06:20 ----D---- C:\ProgramData\Isolated Storage
2015-09-24 19:52:53 ----D---- C:\Users\Prachov\AppData\Roaming\dclogs
2015-09-24 19:47:50 ----A---- C:\ProgramData\windows.exe
2015-09-24 15:52:17 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-09-29 15:14:22 ----D---- C:\Windows\Temp
2015-09-29 15:08:30 ----D---- C:\Windows
2015-09-29 14:59:45 ----HD---- C:\ProgramData
2015-09-29 14:59:44 ----RD---- C:\Program Files
2015-09-29 14:36:02 ----D---- C:\Windows\System32
2015-09-29 14:36:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-29 14:35:59 ----D---- C:\Windows\inf
2015-09-29 14:35:25 ----SHD---- C:\System Volume Information
2015-09-29 14:29:31 ----D---- C:\Windows\system32\logs
2015-09-28 20:24:16 ----D---- C:\Windows\Tasks
2015-09-28 18:31:49 ----D---- C:\Windows\system32\drivers\etc
2015-09-26 11:21:25 ----D---- C:\ProgramData\Mozilla
2015-09-25 14:06:26 ----D---- C:\Program Files\Mozilla Maintenance Service
2015-09-24 20:59:02 ----SHD---- C:\Windows\Installer
2015-09-22 17:12:39 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-09-21 18:52:50 ----D---- C:\Windows\Prefetch
2015-09-20 16:06:30 ----D---- C:\Windows\system32\drivers
2015-09-08 21:58:42 ----D---- C:\Windows\system32\catroot2
2015-09-07 07:03:10 ----D---- C:\Users\Prachov\AppData\Roaming\vlc
2015-09-04 15:18:05 ----SD---- C:\Users\Prachov\AppData\Roaming\Microsoft
2015-09-02 21:06:43 ----D---- C:\ProgramData\McAfee

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-02-12 277784]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2013-04-30 5120]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-26 1761696]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2014-12-12 82432]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-01-24 290304]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2009-03-02 38400]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-03-30 1671680]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 usbaudio;Ovladač zvuků USB (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2015-08-22 75136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-22 269000]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-09-24 147624]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?

[ententeak]

instalátor ccleaneru stále nedělá vůbec nic..
jinak právě teď se stahují a instalují aktualizace systému...

[Rudy]

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemžte.

[ententeak]

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 29.9.2015
Čas skenování: 19:43:51
Protokol:
Správce: Ano

Verze: 2.1.8.1057
Databáze malwaru: v2015.09.29.05
Databáze rootkitů: v2015.09.22.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows Vista
CPU: x86
Souborový systém: NTFS
Uživatel: Prachov

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 300515
Uplynulý čas: 15 min, 33 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 3
Backdoor.Bifrose.Trace, HKU\S-1-5-21-3444975244-3462179002-3201107855-1000\SOFTWARE\Bifrost, , [6049fe371a71bd799f128355040008f8],
Malware.Trace, HKU\S-1-5-21-3444975244-3462179002-3201107855-1000\SOFTWARE\DC3_FEXEC, , [9b0e4aebb5d6c076493bb34010f3a65a],
Backdoor.Trace, HKU\S-1-5-21-3444975244-3462179002-3201107855-1000\SOFTWARE\ÖÍÍÉ, , [b6f3a2935b30b77f5d8dc382a361eb15],

Hodnoty registru: 1
Backdoor.Trace, HKU\S-1-5-21-3444975244-3462179002-3201107855-1000\SOFTWARE\ÖÍÍÉ|FirstExecution, 20/09/2015 -- 09:35, , [b6f3a2935b30b77f5d8dc382a361eb15]

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 1
Stolen.Data, C:\Users\Prachov\AppData\Roaming\dclogs, , [cadfe550c8c3ae886e510e124eb68b75],

Soubory: 17
Backdoor.NJRat, C:\ProgramData\windows.exe, , [c5e42114c8c3d462d048352a12f3d927],
Backdoor.NJRat, C:\ProgramData\McAfee\55.exe, , [f1b884b1e9a278bed840352a7f86d22e],
Backdoor.NJRat, C:\ProgramData\Mozilla\55.exe, , [e7c28da8aae1c07629efa6b99f662ed2],
Backdoor.NJRat, C:\ProgramData\Mozilla\Facebook.exe, , [aefb0332b7d41f176aaeeb749372ca36],
Backdoor.NJRat, C:\Users\Prachov\AppData\Roaming\google.exe, , [9a0fa68ff09be45267b1f26da65f6997],
Trojan.MSIL, C:\Users\Prachov\AppData\Roaming\Systeme.exe, , [2d7ca491b6d5e452f98e29f4a560f50b],
Backdoor.NJRat, C:\Users\Prachov\AppData\Roaming\systeme32.exe, , [a603c66f4843b4820315b0afce3737c9],
Backdoor.NJRat, C:\Users\Prachov\Documents\Abdelrhman.exe, , [acfdc570ff8c10260a0e96c9b550c53b],
Backdoor.Agent.DC, C:\Users\Prachov\Documents\MSDCSC\msdcsc.exe, , [5c4d56df474444f280c7d8360cf8d32d],
Stolen.Data, C:\Users\Prachov\AppData\Roaming\dclogs\2015-09-24-5.dc, , [cadfe550c8c3ae886e510e124eb68b75],
Stolen.Data, C:\Users\Prachov\AppData\Roaming\dclogs\2015-09-25-6.dc, , [cadfe550c8c3ae886e510e124eb68b75],
Stolen.Data, C:\Users\Prachov\AppData\Roaming\dclogs\2015-09-26-7.dc, , [cadfe550c8c3ae886e510e124eb68b75],
Stolen.Data, C:\Users\Prachov\AppData\Roaming\dclogs\2015-09-28-2.dc, , [cadfe550c8c3ae886e510e124eb68b75],
Trojan.Agent.IMN, C:\Users\Prachov\AppData\Roaming\Systeme.exe.tmp, , [e4c594a15b30a6906e01651ac04428d8],
Backdoor.Bifrose.Trace, C:\Users\Prachov\AppData\Roaming\logs.dat, , [783191a47e0dd660bee9b424e61efc04],
Worm.Jenxcus, C:\Users\Prachov\AppData\Roaming\fdnlefdqrx.vbs, , [703911240b808caada14ae06f015ba46],
Worm.Jenxcus, C:\Users\Prachov\AppData\Roaming\xtpmosscnr.vbs, , [d6d393a23c4f191dd01e5b590401827e],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

[Rudy]

Smažte všechny nálezy.

[ententeak]

Tak po smazání a restartu již CCleaner nainstalit a spustit šel.
Nyní analyzuje..

[Rudy]

OK.

[ententeak]

Takže tedy pročištěno CCleanerem, systém aktualizován, nyní instaluji Avast.
Děkuji za pomoc.