Nejdou aktualizace Dr.Web

Zpráva

ketez67 · #1 Příspěvek od **ketez67** » 17 pro 2015 06:58

Dobrý den.
Prosím o kontrolu logu přestaly mi jít aktualizace antivirového programu Dr.Web a také nejdou stáhnou aktualizace databáze Spybot - Search & Destroy 2.

Log z RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Pater at 2015-12-17 06:38:20
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 95 GB (40%) free of 237 GB
Total RAM: 8053 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:38:40, on 17.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera_crashreporter.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
C:\Program Files\trend micro\Pater.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Okno do Světa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files (x86)\Offline Explorer\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files (x86)\Offline Explorer\Add_AllO.htm
O8 - Extra context menu item: Download All by ASUS Download - C:\Program Files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownloadAll.htm
O8 - Extra context menu item: Download using ASUS Download - C:\Program Files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownload.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%systemroot%\system32\CISVC.EXE,-1 (CISVC) - Unknown owner - C:\Windows\system32\CISVC.EXE (file missing)
O23 - Service: Dr.Web Control Service (DrWebAVService) - Doctor Web, Ltd. - C:\Program Files\DrWeb\dwservice.exe
O23 - Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) - Doctor Web, Ltd. - C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
O23 - Service: Dr.Web Firewall Service (DrWebFwSvc) - Doctor Web, Ltd. - C:\Program Files\DrWeb\frwl_svc.exe
O23 - Service: Dr.Web Net Filtering Service (DrWebNetFilter) - Doctor Web, Ltd. - C:\Program Files\DrWeb\dwnetfilter.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 8569 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\CISVC.EXE
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\DrWeb\dwservice.exe" --logfile="C:\ProgramData\Doctor Web\Logs\dwservice.log"
taskeng.exe {5EFC7AA6-0812-4FB6-9828-571DF95DEF19}
C:\Windows\System32\mobsync.exe -Embedding
"C:\Program Files\DrWeb\frwl_svc.exe"
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
"C:\Program Files\DrWeb\frwl_notify.exe"
"C:\Program Files\Microsoft LifeCam\MSCamS64.exe"
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files\DrWeb\spideragent.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --ran-launcher
"C:\Program Files (x86)\Opera\34.0.2036.25\opera_crashreporter.exe" --ran-launcher --crash-reporter-parent-id=2440
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=gpu-process --channel="2440.0.591964155\1103705916" --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,16,29,57,67 --gpu-vendor-id=0x10de --gpu-device-id=0x0a29 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.2702 --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe"
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=cs --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --channel="2440.2.123971754\452815900" /prefetch:673131151
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=cs --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --channel="2440.3.390518821\511152469" /prefetch:673131151
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwarkdaemon.exe" -arkpipe:\pipe\ARServer -arkinitflags:13
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\DrWeb\dwnetfilter.exe" --ats
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=cs --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --channel="2440.5.708729570\220097762" /prefetch:673131151
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=cs --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --channel="2440.6.1284314381\1890328690" /prefetch:673131151
"C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=cs --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --crash-reporter-pid=2232 --enable-proprietary-codecs-support-for-web-audio-api --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --channel="2440.7.438407120\2075891124" /prefetch:673131151
watcher 2860 448 dwe-spider-b2c-1d1388c7d1b4f8e-watch
C:\Windows\system32\svchost.exe -k WindowsMobile
wmiadap.exe /F /T /R
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
-c postupdate --progress-to-console --verbosity=info --coutname=E40CAA273EECF1DE
\??\C:\Windows\system32\conhost.exe "109698400831577013978900515818178355111674879166-17498528184461376131242266060
"C:\Users\Pater\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player PPAPI Notifier.job - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe -check pepperplugin
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll [2015-10-05 551520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-05 212576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22 517688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpIDerAgent"=C:\Program Files\DrWeb\spideragent.exe [2015-07-18 17123984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"Spotify Web Helper"=C:\Users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2015-11-17 2344768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe [2015-10-19 8551848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
C:\Users\Pater\AppData\Roaming\Spotify\Spotify.exe [2015-11-17 8281920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
C:\Users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2015-11-17 2344768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StudentDOG]
C:\Program Files (x86)\Student DOG\StudentDOG.exe [2011-08-31 2108928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-08-04 597552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Pater^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
C:\PROGRA~2\MICROS~1\Office12\ONENOTEM.EXE [2009-02-26 97680]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DrWebEngine]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DrWebEngine]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveTrack"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"aux1"=wdmaud.drv
"aux2"=wdmaud.drv
"aux3"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - C:\PROGRA~2\PSPADE~1\PSPad.exe "%1"

======List of files/folders created in the last 1 month======

2015-12-17 06:26:11 ----D---- C:\FRST
2015-12-17 06:09:30 ----A---- C:\Windows\SYSWOW64\drivers\Normandy.sys
2015-12-16 22:01:50 ----A---- C:\Windows\ntbtlog.txt
2015-12-09 08:17:44 ----A---- C:\Windows\SYSWOW64\tzres.dll
2015-12-09 08:17:44 ----A---- C:\Windows\system32\tzres.dll
2015-12-09 08:17:38 ----A---- C:\Windows\SYSWOW64\usp10.dll
2015-12-09 08:17:38 ----A---- C:\Windows\system32\usp10.dll
2015-12-09 08:17:34 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-12-09 08:17:34 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-12-09 08:17:34 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-12-09 08:17:34 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-12-09 08:17:34 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wuwebv.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wups2.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wups.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wudriver.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wucltux.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wuaueng.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wuauclt.exe
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wuapp.exe
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wuapi.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-12-09 08:17:34 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-12-09 08:17:28 ----A---- C:\Windows\SYSWOW64\nlsbres.dll
2015-12-09 08:17:28 ----A---- C:\Windows\SYSWOW64\kbdgeoqw.dll
2015-12-09 08:17:28 ----A---- C:\Windows\SYSWOW64\KBDAZEL.DLL
2015-12-09 08:17:28 ----A---- C:\Windows\SYSWOW64\KBDAZE.DLL
2015-12-09 08:17:28 ----A---- C:\Windows\system32\nlsbres.dll
2015-12-09 08:17:28 ----A---- C:\Windows\system32\kbdgeoqw.dll
2015-12-09 08:17:28 ----A---- C:\Windows\system32\KBDAZEL.DLL
2015-12-09 08:17:28 ----A---- C:\Windows\system32\KBDAZE.DLL
2015-12-09 08:17:24 ----A---- C:\Windows\system32\win32k.sys
2015-12-09 08:17:24 ----A---- C:\Windows\system32\DWrite.dll
2015-12-09 08:17:23 ----A---- C:\Windows\system32\FntCache.dll
2015-12-09 08:17:22 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-12-09 08:17:22 ----A---- C:\Windows\system32\user32.dll
2015-12-09 08:17:21 ----A---- C:\Windows\SYSWOW64\user32.dll
2015-12-09 08:17:20 ----A---- C:\Windows\SYSWOW64\wshrm.dll
2015-12-09 08:17:20 ----A---- C:\Windows\system32\wshrm.dll
2015-12-09 08:17:20 ----A---- C:\Windows\system32\drivers\rmcast.sys
2015-12-09 08:17:19 ----A---- C:\Windows\system32\comsvcs.dll
2015-12-09 08:17:19 ----A---- C:\Windows\system32\catsrvut.dll
2015-12-09 08:17:18 ----A---- C:\Windows\SYSWOW64\comsvcs.dll
2015-12-09 08:17:18 ----A---- C:\Windows\SYSWOW64\catsrvut.dll
2015-12-09 08:17:13 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-12-09 08:17:13 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-12-09 08:17:13 ----A---- C:\Windows\system32\iertutil.dll
2015-12-09 08:17:12 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-12-09 08:17:12 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-12-09 08:17:12 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-12-09 08:17:12 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-12-09 08:17:12 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\occache.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-12-09 08:17:11 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-12-09 08:17:11 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-12-09 08:17:11 ----A---- C:\Windows\system32\iernonce.dll
2015-12-09 08:17:11 ----A---- C:\Windows\system32\ie4uinit.exe
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-12-09 08:17:09 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-12-09 08:17:09 ----A---- C:\Windows\system32\urlmon.dll
2015-12-09 08:17:09 ----A---- C:\Windows\system32\occache.dll
2015-12-09 08:17:09 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-12-09 08:17:09 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-12-09 08:17:09 ----A---- C:\Windows\system32\iedkcs32.dll
2015-12-09 08:17:08 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-12-09 08:17:08 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-12-09 08:17:08 ----A---- C:\Windows\system32\msfeeds.dll
2015-12-09 08:17:08 ----A---- C:\Windows\system32\dxtrans.dll
2015-12-09 08:17:07 ----A---- C:\Windows\system32\iesetup.dll
2015-12-09 08:17:07 ----A---- C:\Windows\system32\ieapfltr.dll
2015-12-09 08:17:06 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-12-09 08:17:05 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-12-09 08:17:05 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2015-12-09 08:17:05 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-12-09 08:17:05 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-12-09 08:17:05 ----A---- C:\Windows\system32\vbscript.dll
2015-12-09 08:17:05 ----A---- C:\Windows\system32\jsproxy.dll
2015-12-09 08:17:04 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-12-09 08:17:04 ----A---- C:\Windows\system32\ieui.dll
2015-12-09 08:17:04 ----A---- C:\Windows\system32\dxtmsft.dll
2015-12-09 08:17:03 ----A---- C:\Windows\system32\mshtmled.dll
2015-12-09 08:17:03 ----A---- C:\Windows\system32\ieframe.dll
2015-12-09 08:17:02 ----A---- C:\Windows\system32\webcheck.dll
2015-12-09 08:17:02 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-12-09 08:17:02 ----A---- C:\Windows\system32\jscript9diag.dll
2015-12-09 08:17:02 ----A---- C:\Windows\system32\jscript.dll
2015-12-09 08:17:02 ----A---- C:\Windows\system32\ieUnatt.exe
2015-12-09 08:17:01 ----A---- C:\Windows\system32\wininet.dll
2015-12-09 08:17:01 ----A---- C:\Windows\system32\jscript9.dll
2015-12-09 08:17:00 ----A---- C:\Windows\system32\msrating.dll
2015-12-09 08:17:00 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-12-09 08:16:59 ----A---- C:\Windows\system32\mshtml.dll
2015-12-09 08:16:01 ----A---- C:\Windows\SYSWOW64\els.dll
2015-12-09 08:16:01 ----A---- C:\Windows\system32\els.dll
2015-12-08 04:11:53 ----D---- C:\Windows\SYSWOW64\Macromedia

======List of files/folders modified in the last 1 month======

2015-12-17 06:38:36 ----D---- C:\Windows\Prefetch
2015-12-17 06:38:26 ----D---- C:\Program Files\trend micro
2015-12-17 06:38:20 ----D---- C:\rsit
2015-12-17 06:38:09 ----AD---- C:\Windows\System32
2015-12-17 06:38:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-12-17 06:38:08 ----D---- C:\Windows\inf
2015-12-17 06:37:43 ----D---- C:\Windows\Temp
2015-12-17 06:27:56 ----AD---- C:\Windows
2015-12-17 06:09:30 ----D---- C:\Windows\SYSWOW64\drivers
2015-12-17 05:54:02 ----D---- C:\Windows\system32\config
2015-12-16 23:03:32 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-16 23:03:28 ----D---- C:\Windows\system32\drivers
2015-12-10 05:25:07 ----D---- C:\Windows\rescache
2015-12-10 04:59:16 ----D---- C:\Windows\Microsoft.NET
2015-12-10 04:57:39 ----RSD---- C:\Windows\assembly
2015-12-10 04:55:14 ----D---- C:\Program Files (x86)\Opera
2015-12-10 04:55:13 ----D---- C:\Windows\system32\Tasks
2015-12-10 04:47:34 ----D---- C:\Windows\system32\wbem
2015-12-10 04:45:57 ----D---- C:\Program Files (x86)\Internet Explorer
2015-12-10 04:45:57 ----D---- C:\Program Files (x86)\Glary Utilities
2015-12-10 04:45:52 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2015-12-10 04:45:52 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-10 04:45:52 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2015-12-10 04:45:51 ----D---- C:\Program Files\Internet Explorer
2015-12-10 04:45:50 ----D---- C:\ProgramData\Microsoft Help
2015-12-10 04:45:50 ----D---- C:\Program Files\Microsoft Silverlight
2015-12-10 04:45:48 ----D---- C:\Users\Pater\AppData\Roaming\PSpad
2015-12-10 04:45:28 ----SHD---- C:\Windows\Installer
2015-12-10 04:45:28 ----RSD---- C:\Windows\Fonts
2015-12-10 04:45:28 ----D---- C:\Windows\PolicyDefinitions
2015-12-10 04:45:26 ----SD---- C:\Windows\system32\GWX
2015-12-10 04:45:26 ----D---- C:\Windows\SYSWOW64\en-US
2015-12-10 04:45:26 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-12-10 04:45:26 ----D---- C:\Windows\SysWOW64
2015-12-10 04:45:26 ----D---- C:\Windows\system32\NDF
2015-12-10 04:45:26 ----D---- C:\Windows\system32\en-US
2015-12-10 04:45:26 ----D---- C:\Windows\system32\DriverStore
2015-12-10 04:45:26 ----D---- C:\Windows\system32\cs-CZ
2015-12-10 04:45:26 ----D---- C:\Windows\system32\CodeIntegrity
2015-12-10 04:45:26 ----D---- C:\Windows\system32\catroot2
2015-12-10 04:44:46 ----D---- C:\Windows\winsxs
2015-12-10 04:44:46 ----D---- C:\Windows\Tasks
2015-12-10 04:44:12 ----D---- C:\Windows\registration
2015-12-10 04:39:25 ----SHD---- C:\System Volume Information
2015-12-10 03:14:57 ----D---- C:\Config.Msi
2015-12-10 03:08:27 ----D---- C:\Windows\system32\MRT
2015-12-10 03:03:54 ----D---- C:\Windows\debug
2015-12-10 03:03:32 ----A---- C:\Windows\system32\MRT.exe
2015-12-08 06:38:36 ----D---- C:\Users\Pater\AppData\Roaming\Spotify
2015-12-08 05:31:37 ----AD---- C:\ProgramData\TEMP
2015-11-19 11:09:15 ----D---- C:\Program Files\DrWeb
2015-11-19 11:08:06 ----RD---- C:\Plocha
2015-11-19 09:14:59 ----D---- C:\Program Files\CCleaner

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DrWebLwf;Dr.Web Firewall Kernel-Mode Driver; C:\Windows\system32\drivers\DrWebLwf.sys [2015-07-18 279184]
R0 DwDevGuard;Dr.Web Device Guard; C:\Windows\system32\drivers\dwdg.sys [2015-10-15 85256]
R0 DwProt;DrWeb Protection; C:\Windows\system32\drivers\dwprot.sys [2015-11-19 374680]
R0 mbamchameleon;mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [2015-12-16 109272]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SpiderG3;DrWeb file system scanner; C:\Windows\system32\drivers\spiderg3.sys [2015-02-17 239744]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-03-22 564824]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 DrWebWfp;DrWebWfp; C:\Windows\system32\drivers\dw_wfp.sys [2015-03-23 83600]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 bbcap;bb_capture_driver; C:\Windows\system32\DRIVERS\bbcap.sys [2011-02-04 4608]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btwampfl;Bluetooth AMP USB Filter; C:\Windows\system32\drivers\btwampfl.sys [2012-02-20 615976]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2012-02-20 184360]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2012-02-20 211496]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2012-02-20 39976]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2012-02-20 21544]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2010-02-10 158720]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-10-23 4187664]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2015-10-05 25816]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-03-03 174184]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7; C:\Windows\system32\DRIVERS\ts_athwx.sys [2014-03-31 2157768]
S1 Asapi;Asapi; C:\Windows\system32\drivers\Asapi.sys []
S3 4F888B49E2F1E571;4F888B49E2F1E571; C:\Windows\system32\drivers\4F888B49E2F1E571.sys []
S3 4F966B0D382AEB71;4F966B0D382AEB71; \??\C:\Windows\TEMP\4CD22F3.sys []
S3 832C34E;832C34E; C:\Windows\system32\drivers\832C34E.sys []
S3 athr;Qualcomm Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2012-09-18 3752448]
S3 athur;Atheros AR9271 Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2010-01-05 1847296]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTWDPAN;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\btwdpan.sys [2011-08-25 89640]
S3 cpuz134;cpuz134; \??\C:\Program Files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [2010-07-09 21480]
S3 cpuz137;cpuz137; \??\C:\Program Files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [2014-02-17 26856]
S3 D7AA245;D7AA245; C:\Windows\system32\drivers\D7AA245.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2014-01-22 108800]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\drivers\Dot4Prt.sys [2010-11-20 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter; C:\Windows\system32\DRIVERS\LEqdUsb.Sys [2011-09-02 76056]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter; C:\Windows\system32\DRIVERS\LHidEqd.Sys [2011-09-02 15128]
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2011-09-02 66840]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2011-09-02 60696]
S3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys [2010-08-24 41040]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2015-10-05 63704]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver; C:\Windows\System32\Drivers\nx6000.sys [2010-12-13 36720]
S3 Normandy;Normandy SR2; C:\Windows\system32\drivers\Normandy.sys []
S3 PcaSp60;Rawether NDIS 6.X SPR Protocol Driver; C:\Windows\system32\DRIVERS\PcaSp60.sys [2010-05-19 38912]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2012-03-02 244224]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-11-13 34032]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2014-01-22 206080]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 tmbulk;Thrustmaster Series Bulk Driver (tmbulk); C:\Windows\System32\Drivers\tmbulk.sys [2014-06-20 129264]
S3 tmhidusb;Thrustmaster HID USB Driver; C:\Windows\system32\DRIVERS\tmhidusb.sys [2014-07-22 166640]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 vmci;VMware VMCI Bus Driver; C:\Windows\system32\DRIVERS\vmci.sys []
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys []
S3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CISVC;@%systemroot%\system32\CISVC.EXE,-1; C:\Windows\system32\CISVC.EXE [2009-07-14 19456]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DrWebAVService;Dr.Web Control Service; C:\Program Files\DrWeb\dwservice.exe [2015-11-19 13399096]
R2 DrWebFwSvc;Dr.Web Firewall Service; C:\Program Files\DrWeb\frwl_svc.exe [2015-07-18 1501952]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS64.exe [2010-12-13 194416]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [2015-09-09 2131368]
R3 DrWebNetFilter;Dr.Web Net Filtering Service; C:\Program Files\DrWeb\dwnetfilter.exe [2015-10-15 6717584]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-11-08 114688]
S3 Macromedia Licensing Service;Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [2011-04-25 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-13 1255736]
S4 Adobe LM Service;Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2012-10-16 72704]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2012-02-19 945440]
S4 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-12-07 147624]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-08-29 920864]
S4 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-09-05 1364256]
S4 PCLEPCI;PCLEPCI; C:\Windows\SysWOW64\drivers\pclepci.sys [2005-02-09 14165]
S4 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-10-28 66872]
S4 PS3 Media Server;PS3 Media Server; C:\Program Files (x86)\PS3 Media Server\win32\service\wrapper.exe [2012-11-27 384280]
S4 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
S4 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-06-27 2088408]
S4 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
S4 tmInstall;Thrustmaster Device Driver Installer; C:\Program Files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE [2014-07-22 45296]

-----------------EOF-----------------

#2 Příspěvek od **JaRon** » 17 pro 2015 07:44

ahoj,
SpyBot mozes odinstalovat - je neucinny=zbytocny
- prescanuj PC s ADWCleanerom + TDSSKiller-om

ketez67 · #3 Příspěvek od **ketez67** » 17 pro 2015 08:13

Děkuji za rychlou odpověď. Ani jeden z doporučovaných programů nic nenašel ale gmer našel tohle.

QGMER 1.0.15.14833 - http://www.gmer.net
Rootkit scan 2015-12-17 06:43:23
Windows 6.1.7601 Service Pack 1

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}@ialcobnpbohhboiffm 0x6B 0x61 0x6B 0x64 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}@haffmcmjecfodhdd 0x6B 0x61 0x6B 0x64 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}@ialeaaifibdlglmckf 0x67 0x61 0x69 0x70 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}@kaneaodfkhmdfgpnckajce 0x62 0x62 0x64 0x61 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}@maooenhihhfbpeaebomnmafilc 0x6F 0x61 0x6C 0x6D ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}@abpopmpgchhplpilikilhpmbgbokhcfbkg 0x69 0x61 0x65 0x6F ...

---- EOF - GMER 1.0.15 ----

Nepoznáš prosím tě zda je to problém byl jsem včera večer v internetovém bankovníctví a internet banka se kousala ale web jel normálně mám podezření, že s pc opravdu není něco v pořádku.

#4 Příspěvek od **JaRon** » 17 pro 2015 08:36

pouzi ComboFix - navod kolegu http://forum.viry.cz/viewtopic.php?f=30 ... x#p1429035

ketez67 · #5 Příspěvek od **ketez67** » 17 pro 2015 14:46

log z ComboFix:

ComboFix 15-12-16.01 - Pater 17.12.2015 14:17:59.3.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8053.5730 [GMT 1:00]
Spuštěný z: c:\users\Pater\Downloads\ComboFix.exe
AV: Dr.Web Security Space *Disabled/Outdated* {43B072E9-61D5-D2DF-0530-CE16F6F72D60}
FW: Dr.Web Firewall *Disabled* {7B8BF3CC-2BBA-D387-2E6F-672308246A1B}
SP: Dr.Web Security Space *Disabled/Outdated* {F8D1930D-47EF-DD51-3F80-F5648D7067DD}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\Pater\AppData\Local\assembly\tmp
c:\windows\msdownld.tmp
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Asapi
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-17 do 2015-12-17 )))))))))))))))))))))))))))))))
.
.
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Mistr\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Mikes\AppData\Local\temp
2015-12-17 05:26 . 2015-12-17 05:35 -------- d-----w- C:\FRST
2015-12-17 05:09 . 2015-12-17 05:10 34560 ----a-w- c:\windows\SysWow64\drivers\Normandy.sys
2015-12-09 07:16 . 2015-11-11 16:21 25837568 ----a-w- c:\windows\system32\mshtml.dll
2015-12-09 07:16 . 2015-11-08 22:27 10949120 ----a-w- c:\program files\Internet Explorer\F12Resources.dll
2015-12-09 07:16 . 2015-11-03 19:04 241664 ----a-w- c:\windows\system32\els.dll
2015-12-09 07:16 . 2015-11-03 18:55 179712 ----a-w- c:\windows\SysWow64\els.dll
2015-12-08 03:11 . 2015-12-08 03:11 -------- d-----w- c:\windows\SysWow64\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-17 06:56 . 2014-09-29 01:31 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-16 22:17 . 2014-09-29 01:31 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-12-10 02:03 . 2010-11-12 23:23 140158008 ----a-w- c:\windows\system32\MRT.exe
2015-11-19 09:54 . 2014-08-25 11:17 374680 ----a-w- c:\windows\system32\drivers\dwprot.sys
2015-11-17 09:28 . 2015-09-10 13:46 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-17 09:28 . 2011-05-15 14:59 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-10-29 17:50 . 2015-11-10 19:24 6656 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 342016 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:50 . 2015-11-10 19:24 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 19:24 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 19:24 72192 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:50 . 2015-11-10 19:24 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 19:24 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:50 . 2015-11-10 19:24 5120 ----a-w- c:\windows\SysWow64\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 23552 ----a-w- c:\windows\system32\sdbinst.exe
2015-10-29 17:49 . 2015-11-10 19:24 295936 ----a-w- c:\windows\SysWow64\apphelp.dll
2015-10-29 17:49 . 2015-11-10 19:24 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 19:24 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 19:24 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 19:24 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:49 . 2015-11-10 19:24 20992 ----a-w- c:\windows\SysWow64\sdbinst.exe
2015-10-29 17:39 . 2015-11-10 19:24 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 01:12 . 2015-11-10 19:25 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-20 01:12 . 2015-11-10 19:25 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-10-20 01:12 . 2015-11-10 19:25 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-10-20 01:09 . 2015-11-10 19:25 1730496 ----a-w- c:\windows\system32\ntdll.dll
2015-10-20 01:06 . 2015-11-10 19:25 243712 ----a-w- c:\windows\system32\wow64.dll
2015-10-20 01:06 . 2015-11-10 19:25 215040 ----a-w- c:\windows\system32\winsrv.dll
2015-10-20 01:06 . 2015-11-10 19:25 362496 ----a-w- c:\windows\system32\wow64win.dll
2015-10-20 01:06 . 2015-11-10 19:25 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2015-10-20 01:05 . 2015-11-10 19:25 210944 ----a-w- c:\windows\system32\wdigest.dll
2015-10-20 01:05 . 2015-11-10 19:25 86528 ----a-w- c:\windows\system32\TSpkg.dll
2015-10-20 01:05 . 2015-11-10 19:25 503808 ----a-w- c:\windows\system32\srcore.dll
2015-10-20 01:05 . 2015-11-10 19:25 50176 ----a-w- c:\windows\system32\srclient.dll
2015-10-20 01:05 . 2015-11-10 19:25 136192 ----a-w- c:\windows\system32\sspicli.dll
2015-10-20 01:05 . 2015-11-10 19:25 29184 ----a-w- c:\windows\system32\sspisrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 28160 ----a-w- c:\windows\system32\secur32.dll
2015-10-20 01:05 . 2015-11-10 19:25 344064 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 01:05 . 2015-11-10 19:25 1216512 ----a-w- c:\windows\system32\rpcrt4.dll
2015-10-20 01:05 . 2015-11-10 19:25 312320 ----a-w- c:\windows\system32\ncrypt.dll
2015-10-20 01:05 . 2015-11-10 19:25 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2015-10-20 01:05 . 2015-11-10 19:25 315392 ----a-w- c:\windows\system32\msv1_0.dll
2015-10-20 01:05 . 2015-11-10 19:25 729600 ----a-w- c:\windows\system32\kerberos.dll
2015-10-20 01:05 . 2015-11-10 19:25 1164800 ----a-w- c:\windows\system32\kernel32.dll
2015-10-20 01:05 . 2015-11-10 19:25 1461760 ----a-w- c:\windows\system32\lsasrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 424960 ----a-w- c:\windows\system32\KernelBase.dll
2015-10-20 01:05 . 2015-11-10 19:25 44032 ----a-w- c:\windows\system32\cryptbase.dll
2015-10-20 01:05 . 2015-11-10 19:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 22016 ----a-w- c:\windows\system32\credssp.dll
2015-10-20 01:05 . 2015-11-10 19:25 112640 ----a-w- c:\windows\system32\smss.exe
2015-10-20 01:05 . 2015-11-10 19:25 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-10-20 01:04 . 2015-11-10 19:25 31232 ----a-w- c:\windows\system32\lsass.exe
2015-10-20 01:04 . 2015-11-10 19:25 338432 ----a-w- c:\windows\system32\conhost.exe
2015-10-20 01:04 . 2015-11-10 19:25 64000 ----a-w- c:\windows\system32\auditpol.exe
2015-10-20 01:00 . 2015-11-10 19:25 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-10-20 00:59 . 2015-11-10 19:25 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-20 00:52 . 2015-11-10 19:25 3991488 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-10-20 00:52 . 2015-11-10 19:25 3935680 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-10-20 00:48 . 2015-11-10 19:25 1311768 ----a-w- c:\windows\SysWow64\ntdll.dll
2015-10-20 00:45 . 2015-11-10 19:25 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2015-10-20 00:45 . 2015-11-10 19:25 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
2015-10-20 00:45 . 2015-11-10 19:25 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-10-20 00:45 . 2015-11-10 19:25 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2015-10-20 00:45 . 2015-11-10 19:25 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2015-10-20 00:45 . 2015-11-10 19:25 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2015-10-20 00:45 . 2015-11-10 19:25 223232 ----a-w- c:\windows\SysWow64\ncrypt.dll
2015-10-20 00:45 . 2015-11-10 19:25 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2015-10-20 00:45 . 2015-11-10 19:25 552960 ----a-w- c:\windows\SysWow64\kerberos.dll
2015-10-20 00:45 . 2015-11-10 19:25 36864 ----a-w- c:\windows\SysWow64\cryptbase.dll
2015-10-20 00:45 . 2015-11-10 19:25 17408 ----a-w- c:\windows\SysWow64\credssp.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Spotify Web Helper"="c:\users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe" [2015-11-17 2344768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DrWebEngine]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 4F888B49E2F1E571;4F888B49E2F1E571; [x]
R3 4F966B0D382AEB71;4F966B0D382AEB71;c:\windows\TEMP\4CD22F3.sys;c:\windows\TEMP\4CD22F3.sys [x]
R3 832C34E;832C34E; [x]
R3 athur;Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
R3 cpuz134;cpuz134;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [x]
R3 cpuz137;cpuz137;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [x]
R3 D7AA245;D7AA245; [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
R3 Normandy;Normandy SR2; [x]
R3 PcaSp60;Rawether NDIS 6.X SPR Protocol Driver;c:\windows\system32\DRIVERS\PcaSp60.sys;c:\windows\SYSNATIVE\DRIVERS\PcaSp60.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys;c:\windows\SYSNATIVE\DRIVERS\seehcri.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 tmbulk;Thrustmaster Series Bulk Driver (tmbulk);c:\windows\system32\Drivers\tmbulk.sys;c:\windows\SYSNATIVE\Drivers\tmbulk.sys [x]
R3 tmhidusb;Thrustmaster HID USB Driver;c:\windows\system32\DRIVERS\tmhidusb.sys;c:\windows\SYSNATIVE\DRIVERS\tmhidusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 PS3 Media Server;PS3 Media Server;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe [x]
R4 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R4 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R4 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R4 tmInstall;Thrustmaster Device Driver Installer;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE [x]
S0 DrWebLwf;Dr.Web Firewall Kernel-Mode Driver;c:\windows\system32\drivers\DrWebLwf.sys;c:\windows\SYSNATIVE\drivers\DrWebLwf.sys [x]
S0 DwDevGuard;Dr.Web Device Guard;c:\windows\system32\drivers\dwdg.sys;c:\windows\SYSNATIVE\drivers\dwdg.sys [x]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys;c:\windows\SYSNATIVE\drivers\dwprot.sys [x]
S0 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys;c:\windows\SYSNATIVE\drivers\spiderg3.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 DrWebWfp;DrWebWfp;c:\windows\system32\drivers\dw_wfp.sys;c:\windows\SYSNATIVE\drivers\dw_wfp.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 DrWebAVService;Dr.Web Control Service;c:\program files\DrWeb\dwservice.exe;c:\program files\DrWeb\dwservice.exe [x]
S2 DrWebFwSvc;Dr.Web Firewall Service;c:\program files\DrWeb\frwl_svc.exe;c:\program files\DrWeb\frwl_svc.exe [x]
S3 bbcap;bb_capture_driver;c:\windows\system32\DRIVERS\bbcap.sys;c:\windows\SYSNATIVE\DRIVERS\bbcap.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe;c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [x]
S3 DrWebNetFilter;Dr.Web Net Filtering Service;c:\program files\DrWeb\dwnetfilter.exe;c:\program files\DrWeb\dwnetfilter.exe [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\DRIVERS\ts_athwx.sys;c:\windows\SYSNATIVE\DRIVERS\ts_athwx.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 4F966B873499E071
*Deregistered* - 4F966B873499E071
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2015-12-13 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-17 09:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpIDerAgent"="c:\program files\DrWeb\spideragent.exe" [2015-07-18 17123984]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uInternet Settings,ProxyServer = localhost:8080
IE: + Offline &Explorer: Download the link - file://c:\program files (x86)\Offline Explorer\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page - file://c:\program files (x86)\Offline Explorer\Add_AllO.htm
IE: Download All by ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownloadAll.htm
IE: Download using ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownload.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}*]
@Allowed: (Read) (RestrictedCode)
"ialcobnpbohhboiffm"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"haffmcmjecfodhdd"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"ialeaaifibdlglmckf"=hex:67,61,69,70,6b,65,62,68,6e,62,64,66,6f,6c,00,00
"kaneaodfkhmdfgpnckajce"=hex:62,62,64,61,6f,66,68,6f,6c,64,6e,63,6e,68,6b,64,
6a,62,66,67,64,6f,64,70,6d,6b,63,6a,6d,70,61,6a,68,6d,65,68,00,b0
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}*]
"maooenhihhfbpeaebomnmafilc"=hex:6f,61,6c,6d,66,6a,70,6b,69,6e,63,6a,66,61,67,
6c,63,61,67,63,6f,6e,65,66,68,6c,66,66,65,63,00,00
"abpopmpgchhplpilikilhpmbgbokhcfbkg"=hex:69,61,65,6f,6b,69,67,64,6b,66,66,61,
6f,65,6a,66,64,70,00,00
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="DCC2885B1D784C745984E13C63D57664B6F44391B696D6D43EB3DE1581C1171D66E99F61D4F6DD2DAA41B4D5C6572498EDB3AD4761B610EBF72CA1FC1FA5EFD6F56BEA85FDBEB62313C773511AD113019F3D8DAB5CD20C1CC744FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CBA7FD869164D6794A6A0AC4980AC79333C366C9A23FE34FCE727BD2E66FAC0FC18279F3479608FFD77D6CE099135A15B64468E004768035A4E64DA5FB66E8207233EA09E3028F9E1401011FCFE1D21D90922FD653A01F71D7904CA24238EBB2E5000E7EA20AE6BD9CFF16025B774E06B02EA001BA7DDF63E161AF46903753E9949921C4368B54859665CC68745BFF4EFC6CF1C25236963AFF6CB03D08F13E2655A33AB860ECC77CBE8BD90E09355F63F779820BD23DE28D1945663306B2601A2F2B2424777DCE50C5F1D4CA074630223D39F9DCF834FB3FC0909481098C47954A5F4544BF39E026DF8934F691FE7B858C3D16A7C009FF5FB13462730FD5B2FF12CF0198D32A3BFB2844EB193AAB6BE1250B31E193D09E58E16863B7F67A40769E1B40C3DC64C1716F70DCEAA16F73C7626D917ACBF18FB6618D281A584346D1945DFEBBBABD183C3EB27C6ED4227DD9E196FF6F373ACB62B45CC3DFA6970D055FCA6BA21BA3C05DD9D067E50731556199E322161A6FC17776B26738D8B10A2E5CED14236356B9EF8ECA59E7A55E357E7CFF33F170A90A35B7DA7EE9D4724D98827BD0C7B4013D89EE09612C7F38C1C026B9C3F6EB64566D814ABBE22DB8C716B9659662164383EC99F808946C0DADFCE53A4D1F3254B6B686721B345ED80E8B3CFA9668F8C385FEE771B78BA116DE2AF8C9B6CE834A6C472588C63E10388C1F8AB4761DF8B3FCEEF5AB3989D9E3AEAF3C123C7C0263288586904290C080383C6A6DEF36192D0A5A75B2C64988686C063C172E0A52298D06DC03324094BA0B71DDE30FC973DC47E62B4F91D8C4AEFAF37FBD1F97231DBBAF5AA58345001E8ED71198E9E3785457AE0C2A5478C4F650A1D082297B744D0E72F15490191C034B8AA3E63C1AB4D50BA58054CA9DFDE2BA23820D382BAAA9FFEC791EAF4AD05312EA458AA8F92D83968722321D18128D8D39DA06D47F31CC4A7635AB93D3AACE1E8309875F840CF27AFCC64E68EA2395978D78D0AB88FB3929097C7C44B80FC1B89905267303A3F153FF536F7F42589EC73E48B566BED6E2C6BEF592FD6FD9C872FFDFDB8AC3B17504BF4A8C05CA1F2A828B66396B7A4B08AEE6CB2315A6396A384A5B735A8B1ABFD0C4271C4E16331F2FEB2859FBBFABEFAD2FD999312985AC231A53D3D24BF3692BBCB691765E9E708643402DCD86E449ED58E79B80235BC8964137546E2BB525A"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2015-12-17 14:42:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-12-17 13:42
.
Před spuštěním: Volných bajtů: 102 033 301 504
Po spuštění: Volných bajtů: 101 437 693 952
.
- - End Of File - - 3C70EF2586DF8781018BAB85AB6DD54E
A36C5E4F47E84449FF07ED3517B43A31

ketez67 · #6 Příspěvek od **ketez67** » 17 pro 2015 14:50

A tady log s C:/ComboFix.txt

ComboFix 15-12-16.01 - Pater 17.12.2015 14:17:59.3.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8053.5730 [GMT 1:00]
Spuštěný z: c:\users\Pater\Downloads\ComboFix.exe
AV: Dr.Web Security Space *Disabled/Outdated* {43B072E9-61D5-D2DF-0530-CE16F6F72D60}
FW: Dr.Web Firewall *Disabled* {7B8BF3CC-2BBA-D387-2E6F-672308246A1B}
SP: Dr.Web Security Space *Disabled/Outdated* {F8D1930D-47EF-DD51-3F80-F5648D7067DD}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\Pater\AppData\Local\assembly\tmp
c:\windows\msdownld.tmp
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Asapi
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-17 do 2015-12-17 )))))))))))))))))))))))))))))))
.
.
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Mistr\AppData\Local\temp
2015-12-17 13:32 . 2015-12-17 13:32 -------- d-----w- c:\users\Mikes\AppData\Local\temp
2015-12-17 05:26 . 2015-12-17 05:35 -------- d-----w- C:\FRST
2015-12-17 05:09 . 2015-12-17 05:10 34560 ----a-w- c:\windows\SysWow64\drivers\Normandy.sys
2015-12-09 07:16 . 2015-11-11 16:21 25837568 ----a-w- c:\windows\system32\mshtml.dll
2015-12-09 07:16 . 2015-11-08 22:27 10949120 ----a-w- c:\program files\Internet Explorer\F12Resources.dll
2015-12-09 07:16 . 2015-11-03 19:04 241664 ----a-w- c:\windows\system32\els.dll
2015-12-09 07:16 . 2015-11-03 18:55 179712 ----a-w- c:\windows\SysWow64\els.dll
2015-12-08 03:11 . 2015-12-08 03:11 -------- d-----w- c:\windows\SysWow64\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-17 06:56 . 2014-09-29 01:31 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-16 22:17 . 2014-09-29 01:31 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-12-10 02:03 . 2010-11-12 23:23 140158008 ----a-w- c:\windows\system32\MRT.exe
2015-11-19 09:54 . 2014-08-25 11:17 374680 ----a-w- c:\windows\system32\drivers\dwprot.sys
2015-11-17 09:28 . 2015-09-10 13:46 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-17 09:28 . 2011-05-15 14:59 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-10-29 17:50 . 2015-11-10 19:24 6656 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 342016 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:50 . 2015-11-10 19:24 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 19:24 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 19:24 72192 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:50 . 2015-11-10 19:24 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 19:24 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:50 . 2015-11-10 19:24 5120 ----a-w- c:\windows\SysWow64\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 23552 ----a-w- c:\windows\system32\sdbinst.exe
2015-10-29 17:49 . 2015-11-10 19:24 295936 ----a-w- c:\windows\SysWow64\apphelp.dll
2015-10-29 17:49 . 2015-11-10 19:24 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 19:24 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 19:24 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 19:24 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:49 . 2015-11-10 19:24 20992 ----a-w- c:\windows\SysWow64\sdbinst.exe
2015-10-29 17:39 . 2015-11-10 19:24 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 01:12 . 2015-11-10 19:25 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-20 01:12 . 2015-11-10 19:25 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-10-20 01:12 . 2015-11-10 19:25 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-10-20 01:09 . 2015-11-10 19:25 1730496 ----a-w- c:\windows\system32\ntdll.dll
2015-10-20 01:06 . 2015-11-10 19:25 243712 ----a-w- c:\windows\system32\wow64.dll
2015-10-20 01:06 . 2015-11-10 19:25 215040 ----a-w- c:\windows\system32\winsrv.dll
2015-10-20 01:06 . 2015-11-10 19:25 362496 ----a-w- c:\windows\system32\wow64win.dll
2015-10-20 01:06 . 2015-11-10 19:25 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2015-10-20 01:05 . 2015-11-10 19:25 210944 ----a-w- c:\windows\system32\wdigest.dll
2015-10-20 01:05 . 2015-11-10 19:25 86528 ----a-w- c:\windows\system32\TSpkg.dll
2015-10-20 01:05 . 2015-11-10 19:25 503808 ----a-w- c:\windows\system32\srcore.dll
2015-10-20 01:05 . 2015-11-10 19:25 50176 ----a-w- c:\windows\system32\srclient.dll
2015-10-20 01:05 . 2015-11-10 19:25 136192 ----a-w- c:\windows\system32\sspicli.dll
2015-10-20 01:05 . 2015-11-10 19:25 29184 ----a-w- c:\windows\system32\sspisrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 28160 ----a-w- c:\windows\system32\secur32.dll
2015-10-20 01:05 . 2015-11-10 19:25 344064 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 01:05 . 2015-11-10 19:25 1216512 ----a-w- c:\windows\system32\rpcrt4.dll
2015-10-20 01:05 . 2015-11-10 19:25 312320 ----a-w- c:\windows\system32\ncrypt.dll
2015-10-20 01:05 . 2015-11-10 19:25 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2015-10-20 01:05 . 2015-11-10 19:25 315392 ----a-w- c:\windows\system32\msv1_0.dll
2015-10-20 01:05 . 2015-11-10 19:25 729600 ----a-w- c:\windows\system32\kerberos.dll
2015-10-20 01:05 . 2015-11-10 19:25 1164800 ----a-w- c:\windows\system32\kernel32.dll
2015-10-20 01:05 . 2015-11-10 19:25 1461760 ----a-w- c:\windows\system32\lsasrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 424960 ----a-w- c:\windows\system32\KernelBase.dll
2015-10-20 01:05 . 2015-11-10 19:25 44032 ----a-w- c:\windows\system32\cryptbase.dll
2015-10-20 01:05 . 2015-11-10 19:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 22016 ----a-w- c:\windows\system32\credssp.dll
2015-10-20 01:05 . 2015-11-10 19:25 112640 ----a-w- c:\windows\system32\smss.exe
2015-10-20 01:05 . 2015-11-10 19:25 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-10-20 01:04 . 2015-11-10 19:25 31232 ----a-w- c:\windows\system32\lsass.exe
2015-10-20 01:04 . 2015-11-10 19:25 338432 ----a-w- c:\windows\system32\conhost.exe
2015-10-20 01:04 . 2015-11-10 19:25 64000 ----a-w- c:\windows\system32\auditpol.exe
2015-10-20 01:00 . 2015-11-10 19:25 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-10-20 00:59 . 2015-11-10 19:25 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-20 00:52 . 2015-11-10 19:25 3991488 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-10-20 00:52 . 2015-11-10 19:25 3935680 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-10-20 00:48 . 2015-11-10 19:25 1311768 ----a-w- c:\windows\SysWow64\ntdll.dll
2015-10-20 00:45 . 2015-11-10 19:25 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2015-10-20 00:45 . 2015-11-10 19:25 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
2015-10-20 00:45 . 2015-11-10 19:25 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-10-20 00:45 . 2015-11-10 19:25 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2015-10-20 00:45 . 2015-11-10 19:25 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2015-10-20 00:45 . 2015-11-10 19:25 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2015-10-20 00:45 . 2015-11-10 19:25 223232 ----a-w- c:\windows\SysWow64\ncrypt.dll
2015-10-20 00:45 . 2015-11-10 19:25 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2015-10-20 00:45 . 2015-11-10 19:25 552960 ----a-w- c:\windows\SysWow64\kerberos.dll
2015-10-20 00:45 . 2015-11-10 19:25 36864 ----a-w- c:\windows\SysWow64\cryptbase.dll
2015-10-20 00:45 . 2015-11-10 19:25 17408 ----a-w- c:\windows\SysWow64\credssp.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Spotify Web Helper"="c:\users\Pater\AppData\Roaming\Spotify\SpotifyWebHelper.exe" [2015-11-17 2344768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DrWebEngine]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 4F888B49E2F1E571;4F888B49E2F1E571; [x]
R3 4F966B0D382AEB71;4F966B0D382AEB71;c:\windows\TEMP\4CD22F3.sys;c:\windows\TEMP\4CD22F3.sys [x]
R3 832C34E;832C34E; [x]
R3 athur;Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
R3 cpuz134;cpuz134;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [x]
R3 cpuz137;cpuz137;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [x]
R3 D7AA245;D7AA245; [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
R3 Normandy;Normandy SR2; [x]
R3 PcaSp60;Rawether NDIS 6.X SPR Protocol Driver;c:\windows\system32\DRIVERS\PcaSp60.sys;c:\windows\SYSNATIVE\DRIVERS\PcaSp60.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys;c:\windows\SYSNATIVE\DRIVERS\seehcri.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 tmbulk;Thrustmaster Series Bulk Driver (tmbulk);c:\windows\system32\Drivers\tmbulk.sys;c:\windows\SYSNATIVE\Drivers\tmbulk.sys [x]
R3 tmhidusb;Thrustmaster HID USB Driver;c:\windows\system32\DRIVERS\tmhidusb.sys;c:\windows\SYSNATIVE\DRIVERS\tmhidusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 PS3 Media Server;PS3 Media Server;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe [x]
R4 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R4 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R4 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R4 tmInstall;Thrustmaster Device Driver Installer;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE [x]
S0 DrWebLwf;Dr.Web Firewall Kernel-Mode Driver;c:\windows\system32\drivers\DrWebLwf.sys;c:\windows\SYSNATIVE\drivers\DrWebLwf.sys [x]
S0 DwDevGuard;Dr.Web Device Guard;c:\windows\system32\drivers\dwdg.sys;c:\windows\SYSNATIVE\drivers\dwdg.sys [x]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys;c:\windows\SYSNATIVE\drivers\dwprot.sys [x]
S0 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys;c:\windows\SYSNATIVE\drivers\spiderg3.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 DrWebWfp;DrWebWfp;c:\windows\system32\drivers\dw_wfp.sys;c:\windows\SYSNATIVE\drivers\dw_wfp.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 DrWebAVService;Dr.Web Control Service;c:\program files\DrWeb\dwservice.exe;c:\program files\DrWeb\dwservice.exe [x]
S2 DrWebFwSvc;Dr.Web Firewall Service;c:\program files\DrWeb\frwl_svc.exe;c:\program files\DrWeb\frwl_svc.exe [x]
S3 bbcap;bb_capture_driver;c:\windows\system32\DRIVERS\bbcap.sys;c:\windows\SYSNATIVE\DRIVERS\bbcap.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe;c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [x]
S3 DrWebNetFilter;Dr.Web Net Filtering Service;c:\program files\DrWeb\dwnetfilter.exe;c:\program files\DrWeb\dwnetfilter.exe [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\DRIVERS\ts_athwx.sys;c:\windows\SYSNATIVE\DRIVERS\ts_athwx.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 4F966B873499E071
*Deregistered* - 4F966B873499E071
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2015-12-13 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-17 09:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpIDerAgent"="c:\program files\DrWeb\spideragent.exe" [2015-07-18 17123984]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uInternet Settings,ProxyServer = localhost:8080
IE: + Offline &Explorer: Download the link - file://c:\program files (x86)\Offline Explorer\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page - file://c:\program files (x86)\Offline Explorer\Add_AllO.htm
IE: Download All by ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownloadAll.htm
IE: Download using ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownload.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}*]
@Allowed: (Read) (RestrictedCode)
"ialcobnpbohhboiffm"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"haffmcmjecfodhdd"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"ialeaaifibdlglmckf"=hex:67,61,69,70,6b,65,62,68,6e,62,64,66,6f,6c,00,00
"kaneaodfkhmdfgpnckajce"=hex:62,62,64,61,6f,66,68,6f,6c,64,6e,63,6e,68,6b,64,
6a,62,66,67,64,6f,64,70,6d,6b,63,6a,6d,70,61,6a,68,6d,65,68,00,b0
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}*]
"maooenhihhfbpeaebomnmafilc"=hex:6f,61,6c,6d,66,6a,70,6b,69,6e,63,6a,66,61,67,
6c,63,61,67,63,6f,6e,65,66,68,6c,66,66,65,63,00,00
"abpopmpgchhplpilikilhpmbgbokhcfbkg"=hex:69,61,65,6f,6b,69,67,64,6b,66,66,61,
6f,65,6a,66,64,70,00,00
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="DCC2885B1D784C745984E13C63D57664B6F44391B696D6D43EB3DE1581C1171D66E99F61D4F6DD2DAA41B4D5C6572498EDB3AD4761B610EBF72CA1FC1FA5EFD6F56BEA85FDBEB62313C773511AD113019F3D8DAB5CD20C1CC744FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CBA7FD869164D6794A6A0AC4980AC79333C366C9A23FE34FCE727BD2E66FAC0FC18279F3479608FFD77D6CE099135A15B64468E004768035A4E64DA5FB66E8207233EA09E3028F9E1401011FCFE1D21D90922FD653A01F71D7904CA24238EBB2E5000E7EA20AE6BD9CFF16025B774E06B02EA001BA7DDF63E161AF46903753E9949921C4368B54859665CC68745BFF4EFC6CF1C25236963AFF6CB03D08F13E2655A33AB860ECC77CBE8BD90E09355F63F779820BD23DE28D1945663306B2601A2F2B2424777DCE50C5F1D4CA074630223D39F9DCF834FB3FC0909481098C47954A5F4544BF39E026DF8934F691FE7B858C3D16A7C009FF5FB13462730FD5B2FF12CF0198D32A3BFB2844EB193AAB6BE1250B31E193D09E58E16863B7F67A40769E1B40C3DC64C1716F70DCEAA16F73C7626D917ACBF18FB6618D281A584346D1945DFEBBBABD183C3EB27C6ED4227DD9E196FF6F373ACB62B45CC3DFA6970D055FCA6BA21BA3C05DD9D067E50731556199E322161A6FC17776B26738D8B10A2E5CED14236356B9EF8ECA59E7A55E357E7CFF33F170A90A35B7DA7EE9D4724D98827BD0C7B4013D89EE09612C7F38C1C026B9C3F6EB64566D814ABBE22DB8C716B9659662164383EC99F808946C0DADFCE53A4D1F3254B6B686721B345ED80E8B3CFA9668F8C385FEE771B78BA116DE2AF8C9B6CE834A6C472588C63E10388C1F8AB4761DF8B3FCEEF5AB3989D9E3AEAF3C123C7C0263288586904290C080383C6A6DEF36192D0A5A75B2C64988686C063C172E0A52298D06DC03324094BA0B71DDE30FC973DC47E62B4F91D8C4AEFAF37FBD1F97231DBBAF5AA58345001E8ED71198E9E3785457AE0C2A5478C4F650A1D082297B744D0E72F15490191C034B8AA3E63C1AB4D50BA58054CA9DFDE2BA23820D382BAAA9FFEC791EAF4AD05312EA458AA8F92D83968722321D18128D8D39DA06D47F31CC4A7635AB93D3AACE1E8309875F840CF27AFCC64E68EA2395978D78D0AB88FB3929097C7C44B80FC1B89905267303A3F153FF536F7F42589EC73E48B566BED6E2C6BEF592FD6FD9C872FFDFDB8AC3B17504BF4A8C05CA1F2A828B66396B7A4B08AEE6CB2315A6396A384A5B735A8B1ABFD0C4271C4E16331F2FEB2859FBBFABEFAD2FD999312985AC231A53D3D24BF3692BBCB691765E9E708643402DCD86E449ED58E79B80235BC8964137546E2BB525A"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2015-12-17 14:42:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-12-17 13:42
.
Před spuštěním: Volných bajtů: 102 033 301 504
Po spuštění: Volných bajtů: 101 437 693 952
.
- - End Of File - - 3C70EF2586DF8781018BAB85AB6DD54E
A36C5E4F47E84449FF07ED3517B43A31

#7 Příspěvek od **JaRon** » 17 pro 2015 15:05

pouzi CFScript:

Kód: Vybrat vše

KillAll::

Driver::
Asapi
4F888B49E2F1E571
4F966B0D382AEB71
832C34E
D7AA245
Normandy




Reboot::

ketez67 · #8 Příspěvek od **ketez67** » 17 pro 2015 17:13

Snad jsem vše udělal správně

ComboFix 15-12-16.01 - Pater 17.12.2015 16:25:19.4.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8053.5786 [GMT 1:00]
Spuštěný z: c:\users\Pater\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Pater\Desktop\CFScript.tx.TXT
AV: Dr.Web Security Space *Disabled/Outdated* {43B072E9-61D5-D2DF-0530-CE16F6F72D60}
FW: Dr.Web Firewall *Disabled* {7B8BF3CC-2BBA-D387-2E6F-672308246A1B}
SP: Dr.Web Security Space *Disabled/Outdated* {F8D1930D-47EF-DD51-3F80-F5648D7067DD}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_4F888B49E2F1E571
-------\Service_4F966B0D382AEB71
-------\Service_832C34E
-------\Service_D7AA245
-------\Service_Normandy
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-17 do 2015-12-17 )))))))))))))))))))))))))))))))
.
.
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\Mistr\AppData\Local\temp
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\Mikes\AppData\Local\temp
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-12-17 15:39 . 2015-12-17 15:39 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2015-12-17 05:26 . 2015-12-17 05:35 -------- d-----w- C:\FRST
2015-12-17 05:09 . 2015-12-17 05:10 34560 ----a-w- c:\windows\SysWow64\drivers\Normandy.sys
2015-12-09 07:16 . 2015-11-11 16:21 25837568 ----a-w- c:\windows\system32\mshtml.dll
2015-12-09 07:16 . 2015-11-08 22:27 10949120 ----a-w- c:\program files\Internet Explorer\F12Resources.dll
2015-12-09 07:16 . 2015-11-03 19:04 241664 ----a-w- c:\windows\system32\els.dll
2015-12-09 07:16 . 2015-11-03 18:55 179712 ----a-w- c:\windows\SysWow64\els.dll
2015-12-08 03:11 . 2015-12-08 03:11 -------- d-----w- c:\windows\SysWow64\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-17 06:56 . 2014-09-29 01:31 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-16 22:17 . 2014-09-29 01:31 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-12-10 02:03 . 2010-11-12 23:23 140158008 ----a-w- c:\windows\system32\MRT.exe
2015-11-19 09:54 . 2014-08-25 11:17 374680 ----a-w- c:\windows\system32\drivers\dwprot.sys
2015-11-17 09:28 . 2015-09-10 13:46 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-17 09:28 . 2011-05-15 14:59 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-10-29 17:50 . 2015-11-10 19:24 6656 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 342016 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:50 . 2015-11-10 19:24 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 19:24 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 19:24 72192 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:50 . 2015-11-10 19:24 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 19:24 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:50 . 2015-11-10 19:24 5120 ----a-w- c:\windows\SysWow64\shimeng.dll
2015-10-29 17:50 . 2015-11-10 19:24 23552 ----a-w- c:\windows\system32\sdbinst.exe
2015-10-29 17:49 . 2015-11-10 19:24 295936 ----a-w- c:\windows\SysWow64\apphelp.dll
2015-10-29 17:49 . 2015-11-10 19:24 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 19:24 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 19:24 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 19:24 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:49 . 2015-11-10 19:24 20992 ----a-w- c:\windows\SysWow64\sdbinst.exe
2015-10-29 17:39 . 2015-11-10 19:24 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 01:12 . 2015-11-10 19:25 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-20 01:12 . 2015-11-10 19:25 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-10-20 01:12 . 2015-11-10 19:25 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-10-20 01:09 . 2015-11-10 19:25 1730496 ----a-w- c:\windows\system32\ntdll.dll
2015-10-20 01:06 . 2015-11-10 19:25 243712 ----a-w- c:\windows\system32\wow64.dll
2015-10-20 01:06 . 2015-11-10 19:25 215040 ----a-w- c:\windows\system32\winsrv.dll
2015-10-20 01:06 . 2015-11-10 19:25 362496 ----a-w- c:\windows\system32\wow64win.dll
2015-10-20 01:06 . 2015-11-10 19:25 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2015-10-20 01:05 . 2015-11-10 19:25 210944 ----a-w- c:\windows\system32\wdigest.dll
2015-10-20 01:05 . 2015-11-10 19:25 86528 ----a-w- c:\windows\system32\TSpkg.dll
2015-10-20 01:05 . 2015-11-10 19:25 503808 ----a-w- c:\windows\system32\srcore.dll
2015-10-20 01:05 . 2015-11-10 19:25 50176 ----a-w- c:\windows\system32\srclient.dll
2015-10-20 01:05 . 2015-11-10 19:25 136192 ----a-w- c:\windows\system32\sspicli.dll
2015-10-20 01:05 . 2015-11-10 19:25 29184 ----a-w- c:\windows\system32\sspisrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 28160 ----a-w- c:\windows\system32\secur32.dll
2015-10-20 01:05 . 2015-11-10 19:25 344064 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 01:05 . 2015-11-10 19:25 1216512 ----a-w- c:\windows\system32\rpcrt4.dll
2015-10-20 01:05 . 2015-11-10 19:25 312320 ----a-w- c:\windows\system32\ncrypt.dll
2015-10-20 01:05 . 2015-11-10 19:25 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2015-10-20 01:05 . 2015-11-10 19:25 315392 ----a-w- c:\windows\system32\msv1_0.dll
2015-10-20 01:05 . 2015-11-10 19:25 729600 ----a-w- c:\windows\system32\kerberos.dll
2015-10-20 01:05 . 2015-11-10 19:25 1164800 ----a-w- c:\windows\system32\kernel32.dll
2015-10-20 01:05 . 2015-11-10 19:25 1461760 ----a-w- c:\windows\system32\lsasrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 424960 ----a-w- c:\windows\system32\KernelBase.dll
2015-10-20 01:05 . 2015-11-10 19:25 44032 ----a-w- c:\windows\system32\cryptbase.dll
2015-10-20 01:05 . 2015-11-10 19:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2015-10-20 01:05 . 2015-11-10 19:25 22016 ----a-w- c:\windows\system32\credssp.dll
2015-10-20 01:05 . 2015-11-10 19:25 112640 ----a-w- c:\windows\system32\smss.exe
2015-10-20 01:05 . 2015-11-10 19:25 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-10-20 01:04 . 2015-11-10 19:25 31232 ----a-w- c:\windows\system32\lsass.exe
2015-10-20 01:04 . 2015-11-10 19:25 338432 ----a-w- c:\windows\system32\conhost.exe
2015-10-20 01:04 . 2015-11-10 19:25 64000 ----a-w- c:\windows\system32\auditpol.exe
2015-10-20 01:00 . 2015-11-10 19:25 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-10-20 00:59 . 2015-11-10 19:25 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-20 00:53 . 2015-11-10 19:25 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-10-20 00:53 . 2015-11-10 19:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-20 00:52 . 2015-11-10 19:25 3991488 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-10-20 00:52 . 2015-11-10 19:25 3935680 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-10-20 00:48 . 2015-11-10 19:25 1311768 ----a-w- c:\windows\SysWow64\ntdll.dll
2015-10-20 00:45 . 2015-11-10 19:25 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2015-10-20 00:45 . 2015-11-10 19:25 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
2015-10-20 00:45 . 2015-11-10 19:25 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-10-20 00:45 . 2015-11-10 19:25 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2015-10-20 00:45 . 2015-11-10 19:25 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2015-10-20 00:45 . 2015-11-10 19:25 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2015-10-20 00:45 . 2015-11-10 19:25 223232 ----a-w- c:\windows\SysWow64\ncrypt.dll
2015-10-20 00:45 . 2015-11-10 19:25 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2015-10-20 00:45 . 2015-11-10 19:25 552960 ----a-w- c:\windows\SysWow64\kerberos.dll
2015-10-20 00:45 . 2015-11-10 19:25 36864 ----a-w- c:\windows\SysWow64\cryptbase.dll
2015-10-20 00:45 . 2015-11-10 19:25 17408 ----a-w- c:\windows\SysWow64\credssp.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DrWebEngine]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 athur;Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
R3 cpuz134;cpuz134;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [x]
R3 cpuz137;cpuz137;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
R3 PcaSp60;Rawether NDIS 6.X SPR Protocol Driver;c:\windows\system32\DRIVERS\PcaSp60.sys;c:\windows\SYSNATIVE\DRIVERS\PcaSp60.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys;c:\windows\SYSNATIVE\DRIVERS\seehcri.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 tmbulk;Thrustmaster Series Bulk Driver (tmbulk);c:\windows\system32\Drivers\tmbulk.sys;c:\windows\SYSNATIVE\Drivers\tmbulk.sys [x]
R3 tmhidusb;Thrustmaster HID USB Driver;c:\windows\system32\DRIVERS\tmhidusb.sys;c:\windows\SYSNATIVE\DRIVERS\tmhidusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 PS3 Media Server;PS3 Media Server;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe [x]
R4 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R4 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R4 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R4 tmInstall;Thrustmaster Device Driver Installer;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE;c:\program files\Thrustmaster\FFB Racing wheel\drivers\amd64\tmInstall.EXE [x]
S0 DrWebLwf;Dr.Web Firewall Kernel-Mode Driver;c:\windows\system32\drivers\DrWebLwf.sys;c:\windows\SYSNATIVE\drivers\DrWebLwf.sys [x]
S0 DwDevGuard;Dr.Web Device Guard;c:\windows\system32\drivers\dwdg.sys;c:\windows\SYSNATIVE\drivers\dwdg.sys [x]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys;c:\windows\SYSNATIVE\drivers\dwprot.sys [x]
S0 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys;c:\windows\SYSNATIVE\drivers\spiderg3.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 DrWebWfp;DrWebWfp;c:\windows\system32\drivers\dw_wfp.sys;c:\windows\SYSNATIVE\drivers\dw_wfp.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 DrWebAVService;Dr.Web Control Service;c:\program files\DrWeb\dwservice.exe;c:\program files\DrWeb\dwservice.exe [x]
S2 DrWebFwSvc;Dr.Web Firewall Service;c:\program files\DrWeb\frwl_svc.exe;c:\program files\DrWeb\frwl_svc.exe [x]
S3 bbcap;bb_capture_driver;c:\windows\system32\DRIVERS\bbcap.sys;c:\windows\SYSNATIVE\DRIVERS\bbcap.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe;c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [x]
S3 DrWebNetFilter;Dr.Web Net Filtering Service;c:\program files\DrWeb\dwnetfilter.exe;c:\program files\DrWeb\dwnetfilter.exe [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\DRIVERS\ts_athwx.sys;c:\windows\SYSNATIVE\DRIVERS\ts_athwx.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 4F966BA916A97F71
*Deregistered* - 4F966BA916A97F71
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2015-12-13 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-17 09:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpIDerAgent"="c:\program files\DrWeb\spideragent.exe" [2015-07-18 17123984]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uInternet Settings,ProxyServer = localhost:8080
IE: + Offline &Explorer: Download the link - file://c:\program files (x86)\Offline Explorer\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page - file://c:\program files (x86)\Offline Explorer\Add_AllO.htm
IE: Download All by ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownloadAll.htm
IE: Download using ASUS Download - c:\program files (x86)\ASUS\RT-N16 Wireless Router Utilities\ASDownload.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23C4E82F-C544-1FBA-2070-E25C30DF96E9}*]
@Allowed: (Read) (RestrictedCode)
"ialcobnpbohhboiffm"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"haffmcmjecfodhdd"=hex:6b,61,6b,64,64,6c,63,6f,64,67,6b,68,63,61,65,70,70,62,
63,6f,61,6f,00,00
"ialeaaifibdlglmckf"=hex:67,61,69,70,6b,65,62,68,6e,62,64,66,6f,6c,00,00
"kaneaodfkhmdfgpnckajce"=hex:62,62,64,61,6f,66,68,6f,6c,64,6e,63,6e,68,6b,64,
6a,62,66,67,64,6f,64,70,6d,6b,63,6a,6d,70,61,6a,68,6d,65,68,00,b0
.
[HKEY_USERS\S-1-5-21-4213455190-1121324071-2762663974-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ED27F17A-65D3-59BB-C227-2061B01D39AE}*]
"maooenhihhfbpeaebomnmafilc"=hex:6f,61,6c,6d,66,6a,70,6b,69,6e,63,6a,66,61,67,
6c,63,61,67,63,6f,6e,65,66,68,6c,66,66,65,63,00,00
"abpopmpgchhplpilikilhpmbgbokhcfbkg"=hex:69,61,65,6f,6b,69,67,64,6b,66,66,61,
6f,65,6a,66,64,70,00,00
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="DCC2885B1D784C745984E13C63D57664B6F44391B696D6D43EB3DE1581C1171D66E99F61D4F6DD2DAA41B4D5C6572498EDB3AD4761B610EBF72CA1FC1FA5EFD6F56BEA85FDBEB62313C773511AD113019F3D8DAB5CD20C1CC744FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CBA7FD869164D6794A6A0AC4980AC79333C366C9A23FE34FCE727BD2E66FAC0FC18279F3479608FFD77D6CE099135A15B64468E004768035A4E64DA5FB66E8207233EA09E3028F9E1401011FCFE1D21D90922FD653A01F71D7904CA24238EBB2E5000E7EA20AE6BD9CFF16025B774E06B02EA001BA7DDF63E161AF46903753E9949921C4368B54859665CC68745BFF4EFC6CF1C25236963AFF6CB03D08F13E2655A33AB860ECC77CBE8BD90E09355F63F779820BD23DE28D1945663306B2601A2F2B2424777DCE50C5F1D4CA074630223D39F9DCF834FB3FC0909481098C47954A5F4544BF39E026DF8934F691FE7B858C3D16A7C009FF5FB13462730FD5B2FF12CF0198D32A3BFB2844EB193AAB6BE1250B31E193D09E58E16863B7F67A40769E1B40C3DC64C1716F70DCEAA16F73C7626D917ACBF18FB6618D281A584346D1945DFEBBBABD183C3EB27C6ED4227DD9E196FF6F373ACB62B45CC3DFA6970D055FCA6BA21BA3C05DD9D067E50731556199E322161A6FC17776B26738D8B10A2E5CED14236356B9EF8ECA59E7A55E357E7CFF33F170A90A35B7DA7EE9D4724D98827BD0C7B4013D89EE09612C7F38C1C026B9C3F6EB64566D814ABBE22DB8C716B9659662164383EC99F808946C0DADFCE53A4D1F3254B6B686721B345ED80E8B3CFA9668F8C385FEE771B78BA116DE2AF8C9B6CE834A6C472588C63E10388C1F8AB4761DF8B3FCEEF5AB3989D9E3AEAF3C123C7C0263288586904290C080383C6A6DEF36192D0A5A75B2C64988686C063C172E0A52298D06DC03324094BA0B71DDE30FC973DC47E62B4F91D8C4AEFAF37FBD1F97231DBBAF5AA58345001E8ED71198E9E3785457AE0C2A5478C4F650A1D082297B744D0E72F15490191C034B8AA3E63C1AB4D50BA58054CA9DFDE2BA23820D382BAAA9FFEC791EAF4AD05312EA458AA8F92D83968722321D18128D8D39DA06D47F31CC4A7635AB93D3AACE1E8309875F840CF27AFCC64E68EA2395978D78D0AB88FB3929097C7C44B80FC1B89905267303A3F153FF536F7F42589EC73E48B566BED6E2C6BEF592FD6FD9C872FFDFDB8AC3B17504BF4A8C05CA1F2A828B66396B7A4B08AEE6CB2315A6396A384A5B735A8B1ABFD0C4271C4E16331F2FEB2859FBBFABEFAD2FD999312985AC231A53D3D24BF3692BBCB691765E9E708643402DCD86E449ED58E79B80235BC8964137546E2BB525A"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2015-12-17 16:50:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-12-17 15:49
ComboFix2.txt 2015-12-17 13:42
.
Před spuštěním: Volných bajtů: 101 591 269 376
Po spuštění: Volných bajtů: 101 428 326 400
.
- - End Of File - - E48777B89B39142C03AB1026EBE8EE4C
A36C5E4F47E84449FF07ED3517B43A31

#9 Příspěvek od **JaRon** » 17 pro 2015 19:48

nastala nejaka zmena

ketez67 · #10 Příspěvek od **ketez67** » 18 pro 2015 06:52

Dr.Web nejde stále aktualizovat a to od 2.12.2015. Psal jsem již na technickou podporu a odeslal jsem jim log.
Dále jsem ve správci úloh našel běžící soubor WMIADAP.exe s cestou WMIADAP.exe R/L. Tento soubor neběží stále ale objevuje se nahodile. Na různých forech jsem zjišťoval co je zač a je to proces Wmiadap který přesune výkonu knihoven do úložiště Windows Management Instrumentation a 38% respondentů jej označilo za šmejda pro v stup do windows prostřednictvím jiných programů.

Taky jsem zkoušel banku a zdá se, že došlo ke zlepšení. Větší zatížení na systém banky bohužel již letos nepodniknu tak uvidím jak to bude po novém roce.

Subjektivně se mi zdá být internet rychlejší a lépe reaguje, takže jste odvedl kus dobré práce za což vám děkuji a zašlu drobný obelisk na Váš účet.

ketez67 · #11 Příspěvek od **ketez67** » 18 pro 2015 07:00

Obelisk odeslán.

#12 Příspěvek od **JaRon** » 18 pro 2015 07:11

dakujeme

zastav sa za mesiac-dva na preventivku
---
skoro som zabudol:
premenuj Combofix na Uninstall a spust a bude vycistene

+
pekne sviatky

VIRY.CZ

Nejdou aktualizace Dr.Web

Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web

Re: Nejdou aktualizace Dr.Web