VIRY.CZ

ComboFix 13-12-10.01 - Haba Baba 15.12.2013 13:30:27.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1033.18.2047.479 [GMT 1:00]
Spuštěný z: c:\users\Haba Baba\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Haba Baba\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: AVG Internet Security 2014 *Enabled/Outdated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: AVG Internet Security 2014 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: AVG Internet Security 2014 *Enabled/Outdated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1000Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1000UA.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1001Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1001UA.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\RegCure Pro.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ESGIGUARD
-------\Service_esgiguard
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-11-15 do 2013-12-15 )))))))))))))))))))))))))))))))
.
.
2013-12-15 12:42 . 2013-12-15 12:42 -------- d-----w- c:\users\dida\AppData\Local\temp
2013-12-15 12:42 . 2013-12-15 12:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-12-15 11:53 . 2013-12-15 11:53 -------- d-----w- C:\avast! sandbox
2013-12-14 01:48 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-14 01:48 . 2013-05-10 03:48 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-13 16:33 . 2013-12-13 16:33 -------- d-----w- c:\users\Haba Baba\AppData\Roaming\AVG2014
2013-12-13 16:24 . 2013-12-13 16:24 -------- d-----w- c:\users\Haba Baba\AppData\Roaming\AVAST Software
2013-12-13 16:23 . 2013-12-13 16:22 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-13 16:23 . 2013-12-13 16:22 178304 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-13 16:23 . 2013-12-13 16:22 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-13 16:23 . 2013-12-13 16:22 403440 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-12-13 16:23 . 2013-12-13 16:22 774392 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-12-13 16:23 . 2013-12-13 16:22 70384 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-12-13 16:23 . 2013-12-13 16:22 35656 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-12-13 16:23 . 2013-12-13 16:22 79720 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-13 16:22 . 2013-12-13 16:22 43152 ----a-w- c:\windows\avastSS.scr
2013-12-13 15:36 . 2013-10-30 02:19 301568 ----a-w- c:\windows\system32\msieftp.dll
2013-12-13 15:36 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2013-12-13 15:36 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2013-12-13 15:36 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2013-12-13 15:36 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2013-12-13 15:36 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2013-12-13 15:35 . 2013-11-23 18:26 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-12-13 15:35 . 2013-11-12 02:07 2048 ----a-w- c:\windows\system32\tzres.dll
2013-12-13 15:35 . 2013-10-30 01:27 2349056 ----a-w- c:\windows\system32\win32k.sys
2013-12-13 15:35 . 2013-10-04 01:49 81408 ----a-w- c:\windows\system32\drivers\drmk.sys
2013-12-13 15:35 . 2013-10-04 01:17 177152 ----a-w- c:\windows\system32\drivers\portcls.sys
2013-12-10 19:02 . 2013-12-10 20:21 -------- d-----w- C:\FRST
2013-12-07 16:27 . 2013-12-07 16:39 -------- d-----w- C:\AdwCleaner
2013-12-07 15:41 . 2013-12-07 15:41 -------- d-----w- c:\windows\ERUNT
2013-12-05 17:02 . 2013-12-05 17:02 -------- d-----w- c:\users\dida\AppData\Local\Opera Software
2013-12-05 17:01 . 2013-12-05 17:01 -------- d-----w- c:\users\dida\AppData\Roaming\Opera Software
2013-12-02 16:13 . 2013-12-02 16:13 -------- d-----w- c:\users\Haba Baba\AppData\Local\Opera Software
2013-12-02 16:13 . 2013-12-02 16:13 -------- d-----w- c:\users\Haba Baba\AppData\Roaming\Opera Software
2013-12-02 15:10 . 2013-12-10 20:14 -------- d-----w- c:\windows\DB847E94446B49E0AC5DC5627EC8B0C0.TMP
2013-11-25 17:45 . 2013-11-27 16:29 -------- d-----w- c:\windows\220FB0354744483A9A0B41DF77061583.TMP
2013-11-23 09:25 . 2013-11-23 09:25 -------- d-----w- c:\programdata\Oracle
2013-11-23 09:25 . 2013-11-23 09:25 -------- d-----w- c:\program files\Common Files\Java
2013-11-23 09:25 . 2013-10-08 06:50 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-11-22 17:22 . 2013-12-13 16:34 -------- d-----w- c:\programdata\AVG2014
2013-11-22 17:08 . 2013-11-22 17:08 -------- d-----w- c:\program files\AVG
2013-11-22 15:25 . 2013-11-27 17:11 -------- d-----w- c:\users\Haba Baba\AppData\Roaming\Media Player Classic
2013-11-22 11:21 . 2013-11-22 11:23 -------- d-----w- c:\windows\rescache
2013-11-20 21:04 . 2013-12-11 20:18 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5AC23D54-C9B6-45A2-857C-6553C101599E}\offreg.dll
2013-11-20 20:46 . 2013-12-02 17:50 -------- d-sh--w- c:\programdata\blacksilver0
2013-11-19 17:02 . 2013-11-08 01:15 7772552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5AC23D54-C9B6-45A2-857C-6553C101599E}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-13 16:22 . 2013-08-13 18:14 269216 ----a-w- c:\windows\system32\aswBoot.exe
2013-12-11 17:02 . 2012-04-12 14:10 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-11 17:02 . 2012-04-12 14:10 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-11-10 20:00 . 2013-11-10 20:00 2829 ----a-w- c:\windows\War3Unin.pif
2013-11-10 20:00 . 2013-11-10 20:00 126976 ----a-w- c:\windows\War3Unin.exe
2013-11-05 20:50 . 2013-11-05 20:50 120600 ----a-w- c:\windows\system32\drivers\avgdiskx.sys
2013-11-04 20:57 . 2013-11-04 20:57 209176 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2013-10-31 22:00 . 2013-10-31 22:00 176952 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2013-10-31 21:30 . 2013-10-31 21:30 222520 ----a-w- c:\windows\system32\drivers\avglogx.sys
2013-10-24 21:28 . 2013-10-24 21:28 147768 ----a-w- c:\windows\system32\drivers\avgidshx.sys
2013-10-12 02:03 . 2013-11-14 07:41 656896 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:01 . 2013-11-14 07:41 679424 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:01 . 2013-11-14 07:41 216576 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-05 19:57 . 2013-11-14 07:41 1168384 ----a-w- c:\windows\system32\crypt32.dll
2013-10-04 01:58 . 2013-11-14 07:41 152576 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-14 07:41 168960 ----a-w- c:\windows\system32\credui.dll
2013-10-04 01:56 . 2013-11-14 07:41 1796096 ----a-w- c:\windows\system32\authui.dll
2013-10-03 01:58 . 2013-11-14 07:41 305152 ----a-w- c:\windows\system32\gdi32.dll
2013-09-30 23:49 . 2013-09-30 23:49 102712 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2013-09-25 02:01 . 2013-11-14 07:41 136640 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-09-25 02:01 . 2013-11-14 07:41 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2013-09-25 01:57 . 2013-11-14 07:41 99840 ----a-w- c:\windows\system32\sspicli.dll
2013-09-25 01:57 . 2013-11-14 07:41 22016 ----a-w- c:\windows\system32\secur32.dll
2013-09-25 01:57 . 2013-11-14 07:41 247808 ----a-w- c:\windows\system32\schannel.dll
2013-09-25 01:56 . 2013-11-14 07:41 220160 ----a-w- c:\windows\system32\ncrypt.dll
2013-09-25 01:56 . 2013-11-14 07:41 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2013-09-25 00:49 . 2013-11-14 07:41 22016 ----a-w- c:\windows\system32\lsass.exe
2013-09-25 00:49 . 2013-11-14 07:41 15872 ----a-w- c:\windows\system32\sspisrv.dll
2013-09-16 23:57 . 2013-09-16 23:57 22840 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-13 16:22 321752 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-13 3568312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
R0 aswRvrt;avast! Revert; [x]
R0 aswVmm;avast! VM Monitor; [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-05-15 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-12-13 774392]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-12-13 403440]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2013-11-05 120600]
R1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-11-04 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-09-16 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-10-31 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-08-01 193848]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-12-13 35656]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-12-13 70384]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2014\avgfws.exe [2013-09-24 1358944]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [2013-11-11 3478544]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [2013-09-24 348008]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-09 3275136]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 123648]
R3 Start BT in service;Start BT in service;c:\program files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [2007-04-21 52080]
R3 TsUsbFlt;TsUsbFlt; [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-10-24 147768]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-10-31 222520]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-09-09 27448]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 17:08 1210320 ----a-w- c:\program files\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-12-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-19 17:02]
.
2013-12-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1000Core.job
- c:\users\Haba Baba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-23 18:52]
.
2013-12-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1000UA.job
- c:\users\Haba Baba\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-23 18:52]
.
2013-12-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1001Core.job
- c:\users\dida\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-15 20:35]
.
2013-12-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4117245281-1480158384-2095474572-1001UA.job
- c:\users\dida\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-15 20:35]
.
2013-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-04 22:38]
.
2013-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-04 22:38]
.
2013-12-07 c:\windows\Tasks\RegCure Pro.job
- d:\program files\ParetoLogic\RegCure Pro\RegCurePro.exe [2012-10-22 20:06]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.230.1
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2013-12-15 14:15:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-12-15 13:15
ComboFix2.txt 2013-12-11 22:52
.
Před spuštěním: 6 129 643 520
Po spuštění: 5 930 377 216
.
- - End Of File - - 49A929A032B5E08577C45B26A11CB9E7
A36C5E4F47E84449FF07ED3517B43A31

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

Jo jo, CCleaner sem používal aj před tím. Ne každej týden, ale jo x)

Jinak to vypadá v pohodě. Mockráde děkuji .. jste můj hrdina ...

Nemate zac, rad jsem pomohl Zase nekdy

A na zaklade Pravidla o zamykani temat