Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

eshield

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

eshield

#1 Příspěvek od Tonny05 »

Dobrý den, prosím o pomoc s tímto problémem. Zapnu prohlížeč internetu (Firefox i Opera) a zobrazí se mi stránky vyhledavače eshield. Pak když na jiných stránkách klikám na odkazy, tak to přeskakuje na různé reklamní stránky.

Nedávno jsem aktualizoval KPM player. Nevím zda natahal nějaký nepořádek. Problém se objevil až když jsem klikl na stránky jedné šperkařky skynetdesign.cz (myslím, že tak byla adresa).

Zasílám log:


Logfile of random's system information tool 1.10 (written by random/random)
Run by Beny at 2015-12-02 19:45:30
Microsoft Windows 7 Professional Service Pack 1
System drive E: has 139 GB (30%) free of 471 GB
Total RAM: 1953 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:45:30, on 2.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18057)
Boot mode: Safe mode with network support

Running processes:
E:\Windows\Explorer.EXE
E:\Windows\system32\ctfmon.exe
E:\Windows\system32\DllHost.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera_crashreporter.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Users\Beny\Downloads\RSIT.exe
E:\Program Files\trend micro\Beny.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://services.eshield.com/general/new ... E6F204}&i=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://services.eshield.com/general/new ... E6F204}&i=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] E:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: STK03H PNP Monitor.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - E:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Unknown owner - E:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - E:\Windows\system32\IntelCpHeciSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Service Mgr MoneyViking - Unknown owner - E:\ProgramData\ab36fac3-93dd-4505-9add-ad6d38d4b914\plugincontainer.exe
O23 - Service: Update Mgr MoneyViking - Unknown owner - E:\Program Files\Common Files\ab36fac3-93dd-4505-9add-ad6d38d4b914\updater.exe

--
End of file - 4839 bytes

======Scheduled tasks folder======

E:\Windows\tasks\Adobe Flash Player Updater.job - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
E:\Windows\tasks\GoogleUpdateTaskMachineCore.job - E:\Program Files\Google\Update\GoogleUpdate.exe /c
E:\Windows\tasks\GoogleUpdateTaskMachineUA.job - E:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://services.eshield.com/general/new ... E6F204}&i="
prefs.js - "keyword.URL" - "http://search.eshield.com/serp?guid={14 ... _search&k="

"wrc@avast.com"=E:\Program Files\AVAST Software\Avast\WebRep\FF
"sp@avast.com"=E:\Program Files\AVAST Software\Avast\SafePrice\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=E:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.66.2]
"Description"=Java™ Deployment Toolkit
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.66.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=E:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\searchplugins\
ask-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-29 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=E:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-29 7004376]
"SunJavaUpdateSched"=E:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-11-09 596528]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=E:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28 1067736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-11-06 3673728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
E:\Windows\system32\hkcmd.exe [2012-03-19 180504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
E:\Windows\system32\igfxtray.exe [2012-03-19 144664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
E:\Windows\system32\igfxpers.exe [2012-03-19 187672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
E:\PROGRA~1\MICROS~1\Office10\OSA.EXE [2001-02-13 83360]

E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
STK03H PNP Monitor.lnk - E:\Windows\STK03H\STK03HM.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\Windows\system32\igfxdev.dll [2012-03-19 325120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=E:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"VIDC.VP80"=vp8vfw.dll

======File associations======

.js - edit - E:\Windows\System32\Notepad.exe %1
.js - open - E:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-02 19:39:50 ----D---- E:\rsit
2015-12-02 19:39:50 ----D---- E:\Program Files\trend micro
2015-12-02 19:33:16 ----A---- E:\Windows\ntbtlog.txt
2015-12-02 17:16:38 ----D---- E:\Program Files\Common Files\ab36fac3-93dd-4505-9add-ad6d38d4b914
2015-12-02 17:16:37 ----D---- E:\ProgramData\ab36fac3-93dd-4505-9add-ad6d38d4b914
2015-12-02 17:16:36 ----D---- E:\Program Files\Money Viking
2015-12-02 17:16:07 ----D---- E:\Users\Beny\AppData\Roaming\Opera Software
2015-12-02 17:14:53 ----D---- E:\Program Files\TNT2
2015-12-02 17:14:46 ----D---- E:\Program Files\Opera
2015-11-29 18:28:56 ----A---- E:\Windows\system32\aswBoot.exe
2015-11-29 18:28:41 ----A---- E:\Windows\avastSS.scr
2015-11-25 17:04:12 ----D---- E:\ProgramData\simplitec
2015-11-25 17:04:10 ----A---- E:\Windows\system32\DLLDEV32i.dll
2015-11-25 17:04:09 ----D---- E:\Program Files\simplitec
2015-11-25 17:03:29 ----D---- E:\ProgramData\Package Cache
2015-11-25 16:35:15 ----D---- E:\ProgramData\WinZip
2015-11-25 16:34:28 ----D---- E:\Program Files\WinZip
2015-11-22 20:32:22 ----D---- E:\Program Files\Common Files\Java
2015-11-22 20:31:55 ----A---- E:\Windows\system32\WindowsAccessBridge.dll
2015-11-04 19:20:27 ----D---- E:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-12-02 19:45:30 ----D---- E:\Windows\Temp
2015-12-02 19:39:50 ----D---- E:\Program Files
2015-12-02 19:33:16 ----D---- E:\Windows
2015-12-02 19:31:45 ----D---- E:\Windows\Prefetch
2015-12-02 19:20:45 ----D---- E:\Windows\Tasks
2015-12-02 19:20:45 ----D---- E:\Windows\system32\Tasks
2015-12-02 17:38:49 ----HD---- E:\ProgramData
2015-12-02 17:18:48 ----D---- E:\Windows\system32\GroupPolicy
2015-12-02 17:16:38 ----D---- E:\Program Files\Common Files
2015-12-02 17:13:13 ----D---- E:\Users\Beny\AppData\Roaming\Notepad++
2015-12-02 17:12:43 ----D---- E:\Windows\inf
2015-12-02 17:12:41 ----D---- E:\Windows\debug
2015-12-02 16:50:16 ----D---- E:\Windows\system32\config
2015-11-30 08:19:55 ----D---- E:\Windows\system32\drivers
2015-11-29 18:28:56 ----D---- E:\Windows\System32
2015-11-25 17:04:10 ----RSD---- E:\Windows\Fonts
2015-11-25 17:04:08 ----SHD---- E:\Windows\Installer
2015-11-25 17:03:38 ----SHD---- E:\System Volume Information
2015-11-22 20:32:30 ----D---- E:\ProgramData\Oracle
2015-11-22 20:31:41 ----D---- E:\Program Files\Java
2015-11-22 15:19:37 ----A---- E:\Windows\system32\PerfStringBackup.INI
2015-11-21 22:34:18 ----D---- E:\Windows\system32\catroot2
2015-11-16 19:50:19 ----D---- E:\Program Files\Common Files\Adobe
2015-11-16 19:50:18 ----D---- E:\Program Files\Adobe
2015-11-16 19:49:49 ----D---- E:\ProgramData\Adobe
2015-11-15 12:14:09 ----A---- E:\Windows\system32\FlashPlayerApp.exe
2015-11-05 08:53:21 ----D---- E:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; E:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; E:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; E:\Windows\system32\drivers\aswRdr2.sys [2015-11-29 81728]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; E:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; E:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-17 242240]
R3 MEI;Intel(R) Management Engine Interface ; E:\Windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
R3 RTL8167;Realtek 8167 NT Driver; E:\Windows\system32\DRIVERS\Rt86win7.sys [2012-02-16 514152]
R3 SR9USB;SR9600 USB To Fast Ethernet Adapter; E:\Windows\system32\DRIVERS\sr9usb.sys [2009-03-15 14720]
S0 aswRvrt;avast! Revert; E:\Windows\system32\drivers\aswRvrt.sys [2015-11-29 49776]
S0 aswVmm;avast! VM Monitor; E:\Windows\system32\drivers\aswVmm.sys [2015-11-29 209432]
S1 aswSnx;aswSnx; E:\Windows\system32\drivers\aswSnx.sys [2015-11-29 794952]
S1 aswSP;aswSP; E:\Windows\system32\drivers\aswSP.sys [2015-11-29 435464]
S2 aswHwid;avast! HardwareID; E:\Windows\system32\drivers\aswHwid.sys [2015-11-29 24016]
S2 aswMonFlt;aswMonFlt; E:\Windows\system32\drivers\aswMonFlt.sys [2015-11-29 81168]
S2 aswStm;aswStm; E:\Windows\system32\drivers\aswStm.sys [2015-11-29 117200]
S2 Parvdm;Parvdm; E:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S2 VBoxAswDrv;VBoxAsw Support Driver; \??\E:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys []
S3 aic78xx;aic78xx; E:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; E:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; E:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; E:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 igfx;igfx; E:\Windows\system32\DRIVERS\igdkmd32.sys [2012-03-19 13210624]
S3 RDPDR;Terminal Server Device Redirector Driver; E:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; E:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; E:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; E:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; E:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; E:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; E:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; E:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; E:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; E:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; E:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AdobeARMservice;Adobe Acrobat Update Service; E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
S2 avast! Antivirus;Avast Antivirus; E:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-11-29 174416]
S2 CscService;@%systemroot%\system32\cscsvc.dll,-200; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S2 Service Mgr MoneyViking;Service Mgr MoneyViking; E:\ProgramData\ab36fac3-93dd-4505-9add-ad6d38d4b914\plugincontainer.exe [2015-12-02 637664]
S2 Update Mgr MoneyViking;Update Mgr MoneyViking; E:\Program Files\Common Files\ab36fac3-93dd-4505-9add-ad6d38d4b914\updater.exe [2015-12-02 542944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-15 269000]
S3 AppMgmt;@appmgmts.dll,-3250; E:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AvastVBoxSvc;AvastVBox COM Service; E:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe []
S3 cphs;Intel(R) Content Protection HECI Service; E:\Windows\system32\IntelCpHeciSvc.exe [2012-03-19 276248]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; E:\Windows\system32\IEEtwCollector.exe [2015-09-16 102912]
S3 MozillaMaintenance;Mozilla Maintenance Service; E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-11-04 147624]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; E:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-29 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#3 Příspěvek od Tonny05 »

# AdwCleaner v5.023 - Logfile created 02/12/2015 at 20:27:37
# Updated 30/11/2015 by Xplode
# Database : 2015-11-30.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Beny - BENY-PC
# Running from : E:\Users\Beny\Desktop\adwcleaner_5.023.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : Service Mgr MoneyViking
[-] Service Deleted : Update Mgr MoneyViking

***** [ Folders ] *****

[-] Folder Deleted : E:\Program Files\TNT2
[-] Folder Deleted : E:\Program Files\Money Viking
[-] Folder Deleted : E:\Program Files\Common Files\ab36fac3-93dd-4505-9add-ad6d38d4b914
[!] Folder Not Deleted : E:\Program Files\Common Files\ab36fac3-93dd-4505-9add-ad6d38d4b914
[-] Folder Deleted : E:\ProgramData\apn
[-] Folder Deleted : E:\ProgramData\Ask
[-] Folder Deleted : E:\ProgramData\simplitec
[-] Folder Deleted : E:\ProgramData\ab36fac3-93dd-4505-9add-ad6d38d4b914
[!] Folder Not Deleted : E:\ProgramData\ab36fac3-93dd-4505-9add-ad6d38d4b914
[-] Folder Deleted : E:\Users\Beny\AppData\Local\PutLockerDownloader
[-] Folder Deleted : E:\Users\Beny\AppData\Local\TNT2

***** [ Files ] *****

[-] File Deleted : E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\searchplugins\ask-search.xml
[-] File Deleted : E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\FTDownloader
[-] Key Deleted : HKCU\SOFTWARE\MOZILLAPLUGINS\@tnt2npapi.com/Plugin
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\gkjoindjjcmbdpbfppabdgflnkgbbcli
[-] Key Deleted : HKCU\Software\Classes\CLSID\{554EBE31-AEC1-4E34-BCE3-606467760D88}
[-] Key Deleted : HKCU\Software\Classes\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{c7c5384f-d9e9-4db1-8c72-135ecccbc571}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FEB2313-F89B-4AC6-8153-84025604A06A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E156391B-B638-45B5-9A0A-326F29DE17EA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F5B714D5-4181-4C86-848B-80A3538C40A4}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDAF650-12B8-48F5-A843-BBA100716106}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00011268-E188-40DF-A514-835FCD78B1BF}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}
[-] Key Deleted : HKCU\Software\1ClickDownload
[-] Key Deleted : HKCU\Software\TNT2
[-] Key Deleted : HKLM\SOFTWARE\simplitec
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Money Viking
[-] Key Deleted : HKU\.DEFAULT\Software\AskPartnerNetwork
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3CFF9AC3-4A61-4249-B878-0728A7D3C9DB}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BBE32C06-2C75-44CB-A1A5-29C16FFF7BE1}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

***** [ Web browsers ] *****

[-] [E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "eShield Safe Web");
[-] [E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxp://services.eshield.com/general/newhometab.php?hometab=home&partner=11467&guid={14EABC0C-0CB1-4E80-951A-06D9F4E6F204}&i=");
[-] [E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://search.eshield.com/serp?guid={14EABC0C-0CB1-4E80-951A-06D9F4E6F204}&action=default_search&k=");
[-] [E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js] [Preference] Deleted : user_pref("plugin.state.npconduitfirefoxplugin", 0);

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - E:\AdwCleaner\AdwCleaner[C1].txt - [6623 bytes] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#5 Příspěvek od Tonny05 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Beny at 2015-12-02 22:28:57
Microsoft Windows 7 Professional Service Pack 1
System drive E: has 139 GB (30%) free of 471 GB
Total RAM: 1953 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:29:31, on 2.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18057)
Boot mode: Normal

Running processes:
E:\Windows\system32\Dwm.exe
E:\Windows\Explorer.EXE
E:\Windows\system32\taskhost.exe
E:\Program Files\AVAST Software\Avast\AvastUI.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\Program Files\Windows Sidebar\sidebar.exe
E:\Windows\STK03H\STK03HM.exe
E:\Windows\system32\wbem\unsecapp.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera_crashreporter.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Users\Beny\Downloads\RSIT.exe
E:\Program Files\trend micro\Beny.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] E:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: STK03H PNP Monitor.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - E:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - E:\Windows\system32\IntelCpHeciSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 4237 bytes

======Scheduled tasks folder======

E:\Windows\tasks\Adobe Flash Player Updater.job - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
E:\Windows\tasks\GoogleUpdateTaskMachineCore.job - E:\Program Files\Google\Update\GoogleUpdate.exe /c
E:\Windows\tasks\GoogleUpdateTaskMachineUA.job - E:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true

"wrc@avast.com"=E:\Program Files\AVAST Software\Avast\WebRep\FF
"sp@avast.com"=E:\Program Files\AVAST Software\Avast\SafePrice\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=E:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.66.2]
"Description"=Java™ Deployment Toolkit
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.66.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=E:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-29 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=E:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-29 7004376]
"SunJavaUpdateSched"=E:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-11-09 596528]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=E:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28 1067736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-11-06 3673728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
E:\Windows\system32\hkcmd.exe [2012-03-19 180504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
E:\Windows\system32\igfxtray.exe [2012-03-19 144664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
E:\Windows\system32\igfxpers.exe [2012-03-19 187672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
E:\PROGRA~1\MICROS~1\Office10\OSA.EXE [2001-02-13 83360]

E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
STK03H PNP Monitor.lnk - E:\Windows\STK03H\STK03HM.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\Windows\system32\igfxdev.dll [2012-03-19 325120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=E:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"VIDC.VP80"=vp8vfw.dll

======File associations======

.js - edit - E:\Windows\System32\Notepad.exe %1
.js - open - E:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-02 20:26:47 ----D---- E:\AdwCleaner
2015-12-02 20:14:31 ----D---- E:\Users\Beny\AppData\Roaming\MAGIX
2015-12-02 20:14:31 ----D---- E:\ProgramData\MAGIX
2015-12-02 19:39:50 ----D---- E:\rsit
2015-12-02 19:39:50 ----D---- E:\Program Files\trend micro
2015-12-02 17:16:07 ----D---- E:\Users\Beny\AppData\Roaming\Opera Software
2015-12-02 17:14:46 ----D---- E:\Program Files\Opera
2015-11-29 18:28:56 ----A---- E:\Windows\system32\aswBoot.exe
2015-11-29 18:28:41 ----A---- E:\Windows\avastSS.scr
2015-11-25 17:04:10 ----A---- E:\Windows\system32\DLLDEV32i.dll
2015-11-25 17:03:29 ----D---- E:\ProgramData\Package Cache
2015-11-25 16:35:15 ----D---- E:\ProgramData\WinZip
2015-11-25 16:34:28 ----D---- E:\Program Files\WinZip
2015-11-22 20:32:22 ----D---- E:\Program Files\Common Files\Java
2015-11-22 20:31:55 ----A---- E:\Windows\system32\WindowsAccessBridge.dll
2015-11-04 19:20:27 ----D---- E:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-12-02 22:29:09 ----D---- E:\Windows\Prefetch
2015-12-02 22:28:56 ----D---- E:\Windows\Temp
2015-12-02 22:23:51 ----SHD---- E:\System Volume Information
2015-12-02 20:42:50 ----D---- E:\Windows\system32\config
2015-12-02 20:32:08 ----D---- E:\Windows\SoftwareDistribution
2015-12-02 20:31:15 ----D---- E:\Windows
2015-12-02 20:27:37 ----HD---- E:\ProgramData
2015-12-02 20:27:37 ----D---- E:\Program Files
2015-12-02 20:14:36 ----RSD---- E:\Windows\Fonts
2015-12-02 19:20:45 ----D---- E:\Windows\Tasks
2015-12-02 19:20:45 ----D---- E:\Windows\system32\Tasks
2015-12-02 17:18:48 ----D---- E:\Windows\system32\GroupPolicy
2015-12-02 17:16:38 ----D---- E:\Program Files\Common Files
2015-12-02 17:13:13 ----D---- E:\Users\Beny\AppData\Roaming\Notepad++
2015-12-02 17:12:43 ----D---- E:\Windows\inf
2015-12-02 17:12:41 ----D---- E:\Windows\debug
2015-11-30 08:19:55 ----D---- E:\Windows\system32\drivers
2015-11-29 18:28:56 ----D---- E:\Windows\System32
2015-11-25 17:04:08 ----SHD---- E:\Windows\Installer
2015-11-22 20:32:30 ----D---- E:\ProgramData\Oracle
2015-11-22 20:31:41 ----D---- E:\Program Files\Java
2015-11-22 15:19:37 ----A---- E:\Windows\system32\PerfStringBackup.INI
2015-11-21 22:34:18 ----D---- E:\Windows\system32\catroot2
2015-11-16 19:50:19 ----D---- E:\Program Files\Common Files\Adobe
2015-11-16 19:50:18 ----D---- E:\Program Files\Adobe
2015-11-16 19:49:49 ----D---- E:\ProgramData\Adobe
2015-11-15 12:14:09 ----A---- E:\Windows\system32\FlashPlayerApp.exe
2015-11-05 08:53:21 ----D---- E:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; E:\Windows\system32\drivers\aswRvrt.sys [2015-11-29 49776]
R0 aswVmm;avast! VM Monitor; E:\Windows\system32\drivers\aswVmm.sys [2015-11-29 209432]
R0 pciide;pciide; E:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; E:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; E:\Windows\system32\drivers\aswRdr2.sys [2015-11-29 81728]
R1 aswSnx;aswSnx; E:\Windows\system32\drivers\aswSnx.sys [2015-11-29 794952]
R1 aswSP;aswSP; E:\Windows\system32\drivers\aswSP.sys [2015-11-29 435464]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; E:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; E:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-17 242240]
R2 aswHwid;avast! HardwareID; E:\Windows\system32\drivers\aswHwid.sys [2015-11-29 24016]
R2 aswMonFlt;aswMonFlt; E:\Windows\system32\drivers\aswMonFlt.sys [2015-11-29 81168]
R2 aswStm;aswStm; E:\Windows\system32\drivers\aswStm.sys [2015-11-29 117200]
R3 igfx;igfx; E:\Windows\system32\DRIVERS\igdkmd32.sys [2012-03-19 13210624]
R3 MEI;Intel(R) Management Engine Interface ; E:\Windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
R3 RTL8167;Realtek 8167 NT Driver; E:\Windows\system32\DRIVERS\Rt86win7.sys [2012-02-16 514152]
R3 SR9USB;SR9600 USB To Fast Ethernet Adapter; E:\Windows\system32\DRIVERS\sr9usb.sys [2009-03-15 14720]
S2 Parvdm;Parvdm; E:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S2 VBoxAswDrv;VBoxAsw Support Driver; \??\E:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys []
S3 aic78xx;aic78xx; E:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; E:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; E:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; E:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; E:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; E:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; E:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; E:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; E:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; E:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; E:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; E:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; E:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; E:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; E:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 avast! Antivirus;Avast Antivirus; E:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-11-29 174416]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-15 269000]
S3 AppMgmt;@appmgmts.dll,-3250; E:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 cphs;Intel(R) Content Protection HECI Service; E:\Windows\system32\IntelCpHeciSvc.exe [2012-03-19 276248]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; E:\Windows\system32\IEEtwCollector.exe [2015-09-16 102912]
S3 MozillaMaintenance;Mozilla Maintenance Service; E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-11-04 147624]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; E:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-29 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
E:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#7 Příspěvek od Tonny05 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Beny at 2015-12-03 09:02:04
Microsoft Windows 7 Professional Service Pack 1
System drive E: has 146 GB (31%) free of 471 GB
Total RAM: 1953 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:02:24, on 3.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18057)
Boot mode: Normal

Running processes:
E:\Windows\system32\Dwm.exe
E:\Windows\Explorer.EXE
E:\Windows\system32\taskhost.exe
E:\Program Files\AVAST Software\Avast\AvastUI.exe
E:\Program Files\Windows Sidebar\sidebar.exe
E:\Windows\STK03H\STK03HM.exe
E:\Windows\system32\wbem\unsecapp.exe
E:\Users\Beny\Downloads\RSIT.exe
E:\Program Files\trend micro\Beny.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera_crashreporter.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera_autoupdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] E:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: STK03H PNP Monitor.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - E:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - E:\Windows\system32\IntelCpHeciSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 4134 bytes

======Scheduled tasks folder======

E:\Windows\tasks\Adobe Flash Player Updater.job - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true

"wrc@avast.com"=E:\Program Files\AVAST Software\Avast\WebRep\FF
"sp@avast.com"=E:\Program Files\AVAST Software\Avast\SafePrice\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=E:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.66.2]
"Description"=Java™ Deployment Toolkit
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.66.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=E:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-29 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=E:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-29 7004376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=E:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28 1067736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-11-06 3673728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
E:\Windows\system32\hkcmd.exe [2012-03-19 180504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
E:\Windows\system32\igfxtray.exe [2012-03-19 144664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
E:\Windows\system32\igfxpers.exe [2012-03-19 187672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
E:\PROGRA~1\MICROS~1\Office10\OSA.EXE [2001-02-13 83360]

E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
STK03H PNP Monitor.lnk - E:\Windows\STK03H\STK03HM.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\Windows\system32\igfxdev.dll [2012-03-19 325120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=E:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"VIDC.VP80"=vp8vfw.dll

======File associations======

.js - edit - E:\Windows\System32\Notepad.exe %1
.js - open - E:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-03 08:54:11 ----D---- E:\_OTM
2015-12-02 20:26:47 ----D---- E:\AdwCleaner
2015-12-02 20:14:31 ----D---- E:\Users\Beny\AppData\Roaming\MAGIX
2015-12-02 20:14:31 ----D---- E:\ProgramData\MAGIX
2015-12-02 19:39:50 ----D---- E:\rsit
2015-12-02 19:39:50 ----D---- E:\Program Files\trend micro
2015-12-02 17:16:07 ----D---- E:\Users\Beny\AppData\Roaming\Opera Software
2015-12-02 17:14:46 ----D---- E:\Program Files\Opera
2015-11-29 18:28:56 ----A---- E:\Windows\system32\aswBoot.exe
2015-11-29 18:28:41 ----A---- E:\Windows\avastSS.scr
2015-11-25 17:04:10 ----A---- E:\Windows\system32\DLLDEV32i.dll
2015-11-25 17:03:29 ----D---- E:\ProgramData\Package Cache
2015-11-25 16:35:15 ----D---- E:\ProgramData\WinZip
2015-11-25 16:34:28 ----D---- E:\Program Files\WinZip
2015-11-22 20:32:22 ----D---- E:\Program Files\Common Files\Java
2015-11-22 20:31:55 ----A---- E:\Windows\system32\WindowsAccessBridge.dll
2015-11-04 19:20:27 ----D---- E:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-12-03 09:01:47 ----D---- E:\Windows\Temp
2015-12-03 08:59:47 ----D---- E:\Windows\system32\config
2015-12-03 08:59:43 ----D---- E:\Windows\Prefetch
2015-12-03 08:59:22 ----D---- E:\Windows\System32
2015-12-03 08:54:11 ----D---- E:\Windows\Tasks
2015-12-02 22:23:51 ----SHD---- E:\System Volume Information
2015-12-02 20:32:08 ----D---- E:\Windows\SoftwareDistribution
2015-12-02 20:31:15 ----D---- E:\Windows
2015-12-02 20:27:37 ----HD---- E:\ProgramData
2015-12-02 20:27:37 ----D---- E:\Program Files
2015-12-02 20:14:36 ----RSD---- E:\Windows\Fonts
2015-12-02 19:20:45 ----D---- E:\Windows\system32\Tasks
2015-12-02 17:18:48 ----D---- E:\Windows\system32\GroupPolicy
2015-12-02 17:16:38 ----D---- E:\Program Files\Common Files
2015-12-02 17:13:13 ----D---- E:\Users\Beny\AppData\Roaming\Notepad++
2015-12-02 17:12:43 ----D---- E:\Windows\inf
2015-12-02 17:12:41 ----D---- E:\Windows\debug
2015-11-30 08:19:55 ----D---- E:\Windows\system32\drivers
2015-11-25 17:04:08 ----SHD---- E:\Windows\Installer
2015-11-22 20:32:30 ----D---- E:\ProgramData\Oracle
2015-11-22 20:31:41 ----D---- E:\Program Files\Java
2015-11-22 15:19:37 ----A---- E:\Windows\system32\PerfStringBackup.INI
2015-11-21 22:34:18 ----D---- E:\Windows\system32\catroot2
2015-11-16 19:50:19 ----D---- E:\Program Files\Common Files\Adobe
2015-11-16 19:50:18 ----D---- E:\Program Files\Adobe
2015-11-16 19:49:49 ----D---- E:\ProgramData\Adobe
2015-11-15 12:14:09 ----A---- E:\Windows\system32\FlashPlayerApp.exe
2015-11-05 08:53:21 ----D---- E:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; E:\Windows\system32\drivers\aswRvrt.sys [2015-11-29 49776]
R0 aswVmm;avast! VM Monitor; E:\Windows\system32\drivers\aswVmm.sys [2015-11-29 209432]
R0 pciide;pciide; E:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; E:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; E:\Windows\system32\drivers\aswRdr2.sys [2015-11-29 81728]
R1 aswSnx;aswSnx; E:\Windows\system32\drivers\aswSnx.sys [2015-11-29 794952]
R1 aswSP;aswSP; E:\Windows\system32\drivers\aswSP.sys [2015-11-29 435464]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; E:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; E:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-17 242240]
R2 aswHwid;avast! HardwareID; E:\Windows\system32\drivers\aswHwid.sys [2015-11-29 24016]
R2 aswMonFlt;aswMonFlt; E:\Windows\system32\drivers\aswMonFlt.sys [2015-11-29 81168]
R2 aswStm;aswStm; E:\Windows\system32\drivers\aswStm.sys [2015-11-29 117200]
R3 igfx;igfx; E:\Windows\system32\DRIVERS\igdkmd32.sys [2012-03-19 13210624]
R3 MEI;Intel(R) Management Engine Interface ; E:\Windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
R3 RTL8167;Realtek 8167 NT Driver; E:\Windows\system32\DRIVERS\Rt86win7.sys [2012-02-16 514152]
R3 SR9USB;SR9600 USB To Fast Ethernet Adapter; E:\Windows\system32\DRIVERS\sr9usb.sys [2009-03-15 14720]
S2 Parvdm;Parvdm; E:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S2 VBoxAswDrv;VBoxAsw Support Driver; \??\E:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys []
S3 aic78xx;aic78xx; E:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; E:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; E:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; E:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; E:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; E:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; E:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; E:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; E:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; E:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; E:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; E:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; E:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; E:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; E:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 avast! Antivirus;Avast Antivirus; E:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-11-29 174416]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-15 269000]
S3 AppMgmt;@appmgmts.dll,-3250; E:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 cphs;Intel(R) Content Protection HECI Service; E:\Windows\system32\IntelCpHeciSvc.exe [2012-03-19 276248]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; E:\Windows\system32\IEEtwCollector.exe [2015-09-16 102912]
S3 MozillaMaintenance;Mozilla Maintenance Service; E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-11-04 147624]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; E:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-29 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#8 Příspěvek od Rudy »

Smazáno, log je již OK. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#9 Příspěvek od Tonny05 »

Bohužel beze změny.
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#10 Příspěvek od Rudy »

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#11 Příspěvek od Tonny05 »

Nevím, zda jsem pochopil správně. MBAM mi log automaticky nenabídl, tak posílám z RSIT. Každopádně MBAM vyhledal i ten eshield v registrech.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Beny at 2015-12-03 20:14:53
Microsoft Windows 7 Professional Service Pack 1
System drive E: has 145 GB (31%) free of 471 GB
Total RAM: 1953 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:15:00, on 3.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18057)
Boot mode: Normal

Running processes:
E:\Windows\system32\Dwm.exe
E:\Windows\Explorer.EXE
E:\Windows\system32\taskhost.exe
E:\Program Files\AVAST Software\Avast\AvastUI.exe
E:\Program Files\Windows Sidebar\sidebar.exe
E:\Windows\STK03H\STK03HM.exe
E:\Windows\system32\wbem\unsecapp.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera_crashreporter.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Program Files\Malwarebytes Anti-Malware\mbam.exe
E:\Windows\system32\taskhost.exe
E:\Program Files\Opera\33.0.1990.115\opera.exe
E:\Users\Beny\Downloads\RSIT.exe
E:\Program Files\trend micro\Beny.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] E:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: STK03H PNP Monitor.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - E:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - E:\Windows\system32\IntelCpHeciSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMScheduler - Malwarebytes - E:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes - E:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 4423 bytes

======Scheduled tasks folder======

E:\Windows\tasks\Adobe Flash Player Updater.job - E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true

"wrc@avast.com"=E:\Program Files\AVAST Software\Avast\WebRep\FF
"sp@avast.com"=E:\Program Files\AVAST Software\Avast\SafePrice\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=E:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.66.2]
"Description"=Java™ Deployment Toolkit
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.66.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=E:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=E:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-29 664184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=E:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-29 7004376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=E:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28 1067736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-11-06 3673728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
E:\Windows\system32\hkcmd.exe [2012-03-19 180504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
E:\Windows\system32\igfxtray.exe [2012-03-19 144664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
E:\Windows\system32\igfxpers.exe [2012-03-19 187672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
E:\PROGRA~1\MICROS~1\Office10\OSA.EXE [2001-02-13 83360]

E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
STK03H PNP Monitor.lnk - E:\Windows\STK03H\STK03HM.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\Windows\system32\igfxdev.dll [2012-03-19 325120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=E:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"VIDC.VP80"=vp8vfw.dll

======File associations======

.js - edit - E:\Windows\System32\Notepad.exe %1
.js - open - E:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-03 20:14:53 ----D---- E:\rsit
2015-12-03 20:01:27 ----A---- E:\Windows\system32\drivers\MBAMSwissArmy.sys
2015-12-03 20:00:59 ----D---- E:\ProgramData\Malwarebytes
2015-12-03 20:00:59 ----D---- E:\Program Files\Malwarebytes Anti-Malware
2015-12-03 20:00:59 ----A---- E:\Windows\system32\drivers\mwac.sys
2015-12-03 20:00:59 ----A---- E:\Windows\system32\drivers\mbamchameleon.sys
2015-12-03 20:00:59 ----A---- E:\Windows\system32\drivers\mbam.sys
2015-12-03 18:58:29 ----D---- E:\Program Files\Common Files\AV
2015-12-02 20:26:47 ----D---- E:\AdwCleaner
2015-12-02 20:14:31 ----D---- E:\Users\Beny\AppData\Roaming\MAGIX
2015-12-02 20:14:31 ----D---- E:\ProgramData\MAGIX
2015-12-02 19:39:50 ----D---- E:\Program Files\trend micro
2015-12-02 17:16:07 ----D---- E:\Users\Beny\AppData\Roaming\Opera Software
2015-12-02 17:14:46 ----D---- E:\Program Files\Opera
2015-11-29 18:28:56 ----A---- E:\Windows\system32\aswBoot.exe
2015-11-29 18:28:41 ----A---- E:\Windows\avastSS.scr
2015-11-25 17:04:10 ----A---- E:\Windows\system32\DLLDEV32i.dll
2015-11-25 17:03:29 ----D---- E:\ProgramData\Package Cache
2015-11-25 16:35:15 ----D---- E:\ProgramData\WinZip
2015-11-25 16:34:28 ----D---- E:\Program Files\WinZip
2015-11-22 20:32:22 ----D---- E:\Program Files\Common Files\Java
2015-11-22 20:31:55 ----A---- E:\Windows\system32\WindowsAccessBridge.dll
2015-11-04 19:20:27 ----D---- E:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-12-03 20:14:52 ----D---- E:\Windows\Temp
2015-12-03 20:02:02 ----D---- E:\Windows\Prefetch
2015-12-03 20:01:27 ----D---- E:\Windows\system32\drivers
2015-12-03 20:00:59 ----HD---- E:\ProgramData
2015-12-03 20:00:59 ----D---- E:\Program Files
2015-12-03 19:17:48 ----D---- E:\Windows\system32\config
2015-12-03 18:58:30 ----D---- E:\Windows\system32\Tasks
2015-12-03 18:58:29 ----D---- E:\Program Files\Common Files
2015-12-03 18:54:02 ----D---- E:\Windows
2015-12-03 08:59:22 ----D---- E:\Windows\System32
2015-12-03 08:54:11 ----D---- E:\Windows\Tasks
2015-12-02 22:23:51 ----SHD---- E:\System Volume Information
2015-12-02 20:32:08 ----D---- E:\Windows\SoftwareDistribution
2015-12-02 20:14:36 ----RSD---- E:\Windows\Fonts
2015-12-02 17:18:48 ----D---- E:\Windows\system32\GroupPolicy
2015-12-02 17:13:13 ----D---- E:\Users\Beny\AppData\Roaming\Notepad++
2015-12-02 17:12:43 ----D---- E:\Windows\inf
2015-12-02 17:12:41 ----D---- E:\Windows\debug
2015-11-25 17:04:08 ----SHD---- E:\Windows\Installer
2015-11-22 20:32:30 ----D---- E:\ProgramData\Oracle
2015-11-22 20:31:41 ----D---- E:\Program Files\Java
2015-11-22 15:19:37 ----A---- E:\Windows\system32\PerfStringBackup.INI
2015-11-21 22:34:18 ----D---- E:\Windows\system32\catroot2
2015-11-16 19:50:19 ----D---- E:\Program Files\Common Files\Adobe
2015-11-16 19:50:18 ----D---- E:\Program Files\Adobe
2015-11-16 19:49:49 ----D---- E:\ProgramData\Adobe
2015-11-15 12:14:09 ----A---- E:\Windows\system32\FlashPlayerApp.exe
2015-11-05 08:53:21 ----D---- E:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; E:\Windows\system32\drivers\aswRvrt.sys [2015-11-29 49776]
R0 aswVmm;avast! VM Monitor; E:\Windows\system32\drivers\aswVmm.sys [2015-11-29 209432]
R0 pciide;pciide; E:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; E:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; E:\Windows\system32\drivers\aswRdr2.sys [2015-11-29 81728]
R1 aswSnx;aswSnx; E:\Windows\system32\drivers\aswSnx.sys [2015-11-29 794952]
R1 aswSP;aswSP; E:\Windows\system32\drivers\aswSP.sys [2015-11-29 435464]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; E:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; E:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-12-17 242240]
R2 aswHwid;avast! HardwareID; E:\Windows\system32\drivers\aswHwid.sys [2015-11-29 24016]
R2 aswMonFlt;aswMonFlt; E:\Windows\system32\drivers\aswMonFlt.sys [2015-11-29 81168]
R2 aswStm;aswStm; E:\Windows\system32\drivers\aswStm.sys [2015-11-29 117200]
R3 igfx;igfx; E:\Windows\system32\DRIVERS\igdkmd32.sys [2012-03-19 13210624]
R3 MBAMProtector;MBAMProtector; \??\E:\Windows\system32\drivers\mbam.sys [2015-10-05 23256]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\E:\Windows\system32\drivers\MBAMSwissArmy.sys [2015-12-03 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\E:\Windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 MEI;Intel(R) Management Engine Interface ; E:\Windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
R3 RTL8167;Realtek 8167 NT Driver; E:\Windows\system32\DRIVERS\Rt86win7.sys [2012-02-16 514152]
R3 SR9USB;SR9600 USB To Fast Ethernet Adapter; E:\Windows\system32\DRIVERS\sr9usb.sys [2009-03-15 14720]
S2 Parvdm;Parvdm; E:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S2 VBoxAswDrv;VBoxAsw Support Driver; \??\E:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys []
S3 aic78xx;aic78xx; E:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; E:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; E:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 dmvsc;dmvsc; E:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 RDPDR;Terminal Server Device Redirector Driver; E:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; E:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; E:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; E:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; E:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; E:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 viaagp;VIA AGP Bus Filter; E:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; E:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; E:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; E:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; E:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; E:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 avast! Antivirus;Avast Antivirus; E:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-11-29 174416]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; E:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MBAMService;MBAMService; E:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R2 MBAMScheduler;MBAMScheduler; E:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-10-05 1513784]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-15 269000]
S3 AppMgmt;@appmgmts.dll,-3250; E:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 cphs;Intel(R) Content Protection HECI Service; E:\Windows\system32\IntelCpHeciSvc.exe [2012-03-19 276248]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; E:\Windows\system32\IEEtwCollector.exe [2015-09-16 102912]
S3 MozillaMaintenance;Mozilla Maintenance Service; E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-11-04 147624]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; E:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-29 1343400]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#12 Příspěvek od Rudy »

Log MBAM potřebuji vidět, abych se přesvědčil, že je vše možné smazat.

Z návodu:
Po dokončení skenu klikneme na "Uložit výsledky", poté na "Textový soubor (*.txt)" a následně log uložíme - ideálně na plochu, ať jej pak nemusíte hledat. Obsah tohoto logu vložte do svého tématu na fóru.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#13 Příspěvek od Tonny05 »

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 3.12.2015
Čas skenování: 20:45
Protokol: log mbam.txt
Správce: Ano

Verze: 0.0.0.0000
Databáze malwaru: v2015.12.03.05
Databáze rootkitů: v2015.11.26.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Beny

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 287019
Uplynulý čas: 7 min, 39 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: eshield

#14 Příspěvek od Rudy »

Toto je OK. Zkuste ještě tyto skeny:

1. Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize




autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;




Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Tonny05
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 02 pro 2015 19:38

Re: eshield

#15 Příspěvek od Tonny05 »

ZOEK: na začátku testu vybehla hláška Das_21 Chyba inicializace NET Framework.


Zoek.exe v5.0.0.1 Updated 01-December-2015
Tool run by Beny on źt 03.12.2015 at 22:36:51,15.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: E:\Users\Beny\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

3.12.2015 22:38:38 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

E:\Users\Beny\AppData\Local\EmieBrowserModeList deleted successfully
E:\Users\Beny\AppData\Local\EmieSiteList deleted successfully
E:\Users\Beny\AppData\Local\EmieUserList deleted successfully
E:\Users\Beny\AppData\Local\GHISLER deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3140568746-3363084839-19983853-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2936C90D-5E70-4514-82A0-BE64A6A8D84B} deleted successfully
HKEY_USERS\S-1-5-21-3140568746-3363084839-19983853-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3140568746-3363084839-19983853-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{00011268-E188-40DF-A514-835FCD78B1BF} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js:
user_pref("browser.newtab.url", "");
user_pref("browser.search.order.1", "Ask Search");
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.search.useDBForOrder", true);

Added to E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

E:\PROGRA~2\Package Cache deleted
E:\Windows\system32\GroupPolicy\Machine deleted
E:\Windows\system32\GroupPolicy\gpt.ini deleted
E:\Windows\System32\AI_RecycleBin deleted
E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default\jetpack deleted
E:\Users\Beny\Desktop\Rapid Downloader.lnk deleted
E:\Users\Beny\Desktop\Continue Vid-Saver Installation.lnk deleted
"E:\Users\Beny\AppData\Roaming\enchant\cs.dic" deleted
"E:\Users\Beny\AppData\Roaming\enchant\cs.exc" deleted
"E:\Users\Beny\AppData\Roaming\enchant" deleted

==== Firefox Start and Search pages ======================

ProfilePath: E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"sp@avast.com"="E:\Program Files\AVAST Software\Avast\SafePrice\FF" [29.11.2015 18:28]

==== Firefox Extensions ======================

ProfilePath: E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default
- Money Viking - %ProfilePath%\extensions\{1580cbf6-d9f3-42e6-8520-4dcf579944dd}.xpi

AppDir: E:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: E:\Users\Beny\AppData\Roaming\Mozilla\Firefox\Profiles\eecyugng.default
E7AC2BFD4928D251DAF1E51176C9EDD0 - E:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll - Adobe Acrobat
7D127425BBE91DF37448A7F44C1DDA52 - E:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll - Google Update
D6015DB8EA402753421FF62CA3909B62 - E:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll - Java(TM) Platform SE 8 U66
776C6B8D53C56500BC355D513F11A105 - E:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 8.0.660.18
F114FBA6246530B89DD1E04351E0EAC5 - E:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll - Shockwave Flash


==== Chromium Look ======================

Google Chrome Version: 46.0.2490.86

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dkmjljdbbgogihjcapfhgkonfmccbffp - No path found[]
gomekmidlodglbbmalcneegieacbdmki - E:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[29.11.2015 18:28]

{scripts [background.js]}content_scripts:[{js:[content.js]matches:[<all_urls>]run_at:document_end}]content_security_policy:script-src 'self' 'unsafe-eval' https://moneyviking-a.akamaihd.net https://moneyviking-a.akamaihd.net https://cdn.moneyviking.net; object-src 'self'description:homepage_url:http://www.moneyviking.neticons:{48:icon.png}key:MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7s1l1h4yVNz5HD2Hjq8l0Y86OChlfjpGlc/Ug3q1E9TmVu6Wahxgv1Tr2M0JQZeietLgKEAyME3BmcLqfQm9tf3XYpMc8E4wum6xLVdZ1pk1iTIuE2LyNN2ZFVAJG4rpMbJ0/nBdyfTEmDyfAGvu3o6RZ+mmPIuMrAEMFECSKsl8CT+e6r5iIJ1ZPTOuYkDosEaSBu9Y1Gu/pDjHEKyX7Kq5Q+aebX8SI0lmn8r5F8MKwRKbvWg6Q2Pi51jhyoeluTgGjQfIdXNBsFLEidvP4sdBAdTln5Yxv3fl8MEVfrPaJLCJFyWjotIhEqvZHQ9ODCqV5+GEyL3z4fQHjPApwIDAQABmanifest_version:2name:Money Vikingpermissions:[managementstoragetabswebRequestwebRequestBlocking<all_urls>webNavigation]update_url:http://cdn.moneyviking.net/updateversion:1.0.5811.20675} - Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjhldpdnjlagbfmhaggmbdjldmgglbb
Avast Online Security - Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
{scripts [background.js]}content_scripts:[{js:[content.js]matches:[<all_urls>]run_at:document_end}]content_security_policy:script-src 'self' 'unsafe-eval' https://moneyviking-a.akamaihd.net https://moneyviking-a.akamaihd.net https://cdn.moneyviking.net; object-src 'self'description:homepage_url:http://www.moneyviking.neticons:{48:icon.png}key:MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7s1l1h4yVNz5HD2Hjq8l0Y86OChlfjpGlc/Ug3q1E9TmVu6Wahxgv1Tr2M0JQZeietLgKEAyME3BmcLqfQm9tf3XYpMc8E4wum6xLVdZ1pk1iTIuE2LyNN2ZFVAJG4rpMbJ0/nBdyfTEmDyfAGvu3o6RZ+mmPIuMrAEMFECSKsl8CT+e6r5iIJ1ZPTOuYkDosEaSBu9Y1Gu/pDjHEKyX7Kq5Q+aebX8SI0lmn8r5F8MKwRKbvWg6Q2Pi51jhyoeluTgGjQfIdXNBsFLEidvP4sdBAdTln5Yxv3fl8MEVfrPaJLCJFyWjotIhEqvZHQ9ODCqV5+GEyL3z4fQHjPApwIDAQABmanifest_version:2name:Money Vikingpermissions:[managementstoragetabswebRequestwebRequestBlocking<all_urls>webNavigation]update_url:http://cdn.moneyviking.net/updateversion:1.0.5811.20675} - Beny\AppData\Roaming\Opera Software\Opera Stable\Extensions\fdjhldpdnjlagbfmhaggmbdjldmgglbb

==== Chromium Fix ======================

E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_mmotraffic.com_0.localstorage deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_mmotraffic.com_0.localstorage-journal deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_c.betrad.com_0.localstorage deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully
E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjhldpdnjlagbfmhaggmbdjldmgglbb deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Extensions\fdjhldpdnjlagbfmhaggmbdjldmgglbb deleted successfully
E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fdjhldpdnjlagbfmhaggmbdjldmgglbb_0.localstorage deleted successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\chrome-extension_fdjhldpdnjlagbfmhaggmbdjldmgglbb_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTer ... ORM=IESR02

==== Reset Google Chrome ======================

E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Preferences was reset successfully
E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data will be reset at reboot
E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data-journal will be reset at reboot

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully

==== Empty IE Cache ======================

E:\Users\Beny\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
E:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
E:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
E:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

E:\Users\Beny\AppData\Local\Mozilla\Firefox\Profiles\eecyugng.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache will be emptied at reboot
E:\Users\Beny\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== E:\zoek_backup content ======================

E:\zoek_backup (files=44 folders=23 10747040 bytes)

==== Empty Temp Folders ======================

E:\Users\Beny\AppData\Local\Temp will be emptied at reboot
E:\Users\Default\AppData\Local\Temp emptied successfully
E:\Users\Default User\AppData\Local\Temp emptied successfully
E:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
E:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
E:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

E:\Windows\Temp successfully emptied
E:\Users\Beny\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

E:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data" not found
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Web Data-journal" not found
"E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_0" deleted
"E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_1" deleted
"E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_2" deleted
"E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\data_3" deleted
"E:\Users\Beny\AppData\Local\Opera Software\Opera Stable\Cache\index" deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_moneyviking-a.akamaihd.net_0.localstorage" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_moneyviking-a.akamaihd.net_0.localstorage-journal" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_c.betrad.com_0.localstorage" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage-journal" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_pstatic.kingtopdeals.com_0.localstorage" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_pstatic.kingtopdeals.com_0.localstorage-journal" not deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Extension Settings\fdjhldpdnjlagbfmhaggmbdjldmgglbb" deleted
"E:\Users\Beny\AppData\Roaming\Opera Software\Opera Stable\Local Extension Settings\fdjhldpdnjlagbfmhaggmbdjldmgglbb" not found

==== EOF on źt 03.12.2015 at 23:14:09,63 ======================
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“