Re: Infekce
Napsal: 02 bře 2016 15:23
trojan killer by som neprecenoval - moze si vymyslat 
ak sa nepodari FRST, vloz oba logy RSIT
ak sa nepodari FRST, vloz oba logy RSIT
info.txt logfile of random's system information tool 1.10 2016-03-02 21:00:18
======MBR======
0x33C08ED0BC007C8EC08ED8BE007CBF0006B90002FCF3A450681C06CBFBB90400BDBE07807E00007C0B0F85100183C510E2F1CD1888560055C6461105C6461000B441BBAA55CD135D720F81FB55AA7509F7C101007403FE46106660807E1000742666680000000066FF760868000068007C680100681000B4428A56008BF4CD139F83C4109EEB14B80102BB007C8A56008A76018A4E028A6E03CD136661731EFE4E110F850C00807E00800F848A00B280EB825532E48A5600CD135DEB9C813EFE7D55AA756EFF7600E88A000F851500B0D1E664E87F00B0DFE660E87800B0FFE664E87100B800BBCD1A6623C0753B6681FB54435041753281F90201722C666807BB00006668000200006668080000006653665366556668000000006668007C0000666168000007CD1A5A32F6EA007C0000CD18A0B707EB08A0B607EB03A0B50732E40500078BF0AC3C0074FCBB0700B40ECD10EBF22BC9E464EB002402E0F82402C3496E76616C696420706172746974696F6E207461626C65004572726F72206C6F6164696E67206F7065726174696E672073797374656D004D697373696E67206F7065726174696E672073797374656D00000000627A9900000010000000010100DEFE3F083F0000008A340200800D050907FEFFFF0038020000205257000000000000000000000000000000000000000000000000000000000000000055AA
======Uninstall list======
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{107254A0-0ADF-11D4-9397-00D0B7020B38}\setup.exe"
15354 Webcam Live-->C:\Program Files\InstallShield Installation Information\{3AC11667-B4DD-4984-AD0B-B2D4E40AB573}\setup.exe -runfromtemp -l0x0009 -removeonly
Adobe Flash Player 20 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil32_20_0_0_306_ActiveX.exe -maintain activex
Adobe Flash Player 20 NPAPI-->C:\Windows\system32\Macromed\Flash\FlashUtil32_20_0_0_306_Plugin.exe -maintain plugin
Adobe Reader X (10.1.16) - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-AA1000000001}
Adobe Refresh Manager-->MsiExec.exe /I{AC76BA86-0804-1033-1959-001824166751}
Aktualizace NVIDIA 1.10.8-->"C:\Windows\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.Update
Ashampoo Burning Studio 6 FREE v.6.84-->"C:\Program Files\Ashampoo\Ashampoo Burning Studio 6 FREE\unins000.exe"
aTube Catcher verze 3.8-->"C:\Program Files\DsNET Corp\aTube Catcher 2.0\unins000.exe"
aTube Catcher-->C:\Program Files\DsNET Corp\aTube Catcher 2.0\uninstall.exe
Avast Free Antivirus-->C:\Program Files\AVAST Software\Avast\Setup\Instup.exe /control_panel /instop:uninstall
AVS Video Converter 9.1-->"C:\Program Files\AVS4YOU\AVSVideoConverter\unins000.exe"
Bullzip PDF Printer 9.3.0.1516-->"C:\Program Files\Bullzip\PDF Printer\unins000.exe"
calibre-->MsiExec.exe /I{4E08670C-1F32-44CC-848E-CB6662DE92BF}
Canon Easy-WebPrint EX-->"C:\Program Files\Canon\Easy-WebPrint EX\uninst.exe" /UninstallRemove C:\Program Files\Canon\Easy-WebPrint EX\uninst.ini
Canon IJ Scan Utility-->"C:\Program Files\Canon\IJ Scan Utility\MAINT.exe" /UninstallRemove C:\Program Files\Canon\IJ Scan Utility\uninst.ini
Canon iP2700 series Printer Driver-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP2700_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP2700_series /L0x0005
Canon MG7500 series MP Drivers-->"C:\Program Files\CanonBJ\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG7500_series\DELDRV.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG7500_series /L0x0005
Canon MG7500 series On-screen Manual-->C:\Program Files\Canon\IJ Manual\Canon MG7500 series\uninstall.exe
Canon MP Navigator EX 2.0-->"C:\Program Files\Canon\MP Navigator EX 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator EX 2.0\uninst.ini
Canon MP630 series MP Drivers-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP630_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP630_series /L0x0005
Canon My Image Garden Design Files-->"C:\Program Files\Canon\My Image Garden\AddOn\uninst.exe" /UninstallRemove C:\Program Files\Canon\My Image Garden\AddOn\uninst.ini
Canon My Image Garden-->"C:\Program Files\Canon\My Image Garden\uninst.exe" /UninstallRemove C:\Program Files\Canon\My Image Garden\uninst.ini
Canon My Printer-->"C:\Program Files\Canon\MyPrinter\uninst.exe" /UninstallRemove C:\Program Files\Canon\MyPrinter\uninst.ini
Canon Quick Menu-->"C:\Program Files\Canon\Quick Menu\uninst.exe" /UninstallRemove C:\Program Files\Canon\Quick Menu\uninst.ini
Canon Utilities Easy-PhotoPrint EX-->C:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe uninst.ini
Canon Utilities Solution Menu-->C:\Program Files\Canon\SolutionMenu\uninst.exe uninst.ini
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CoreAAC-->"C:\Program Files\CoreAAC\Uninstall.exe"
CrystalDiskInfo 6.2.1-->"C:\Program Files\CrystalDiskInfo\unins000.exe"
Český telefon 2004 STANDARD-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{0310CC17-4A4D-4521-A6BD-44B38612FA0A}
Defraggler-->"C:\Program Files\Defraggler\uninst.exe"
Ekonomický systém Money S3-->C:\Program Files\Common Files\CIGLER SOFTWARE\Money S3\Setup\Uninst.exe
FileOpen Client B964-->"C:\Program Files\FileOpen\unins000.exe"
FormApps Plug-in-->rundll32.exe advpack.dll,LaunchINFSection C:\Program Files\Software602\WebFF\webff.inf,DefaultUninstall.NT,,N
FormApps Signing Extension-->MsiExec.exe /X{801F9351-A8A7-441D-9398-6A56E143E316}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
GridinSoft Anti-Malware-->C:\Program Files\GridinSoft Anti-Malware\uninst.exe
Handset USB Driver-->"C:\Program Files\Handset USB Driver\unins000.exe"
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Install Intel Desktop Utilities-->MsiExec.exe /I{5A79D3F9-1EB9-424A-A4EB-721677E56740}
Intel(R) Management Engine Interface-->C:\Windows\system32\heciudlg.exe -uninstall
Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
IP Camera Viewer 2-->"C:\Program Files\Deskshare\IP Camera Viewer 2\unins000.exe"
IrfanView (remove only)-->"C:\Program Files\IrfanView\iv_uninstall.exe"
Java 8 Update 73-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83218073F0}
Java(TM) 6 Update 30-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216030FF}
K-Lite Mega Codec Pack 10.0.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Magical Jelly Bean KeyFinder-->"C:\Program Files\Magical Jelly Bean\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - csy-->MsiExec.exe /I{DD73CA82-EA82-38AA-863D-9A24A018DC96}
Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - csy\setup.exe
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft .NET Framework 4.5.2 (CSY)-->MsiExec.exe /X{69EDC871-8A8A-34A8-B511-FF7CE3C4B0B7}
Microsoft .NET Framework 4.5.2 (čeština)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\CSY\\Setup.exe /repair /x86 /lcid 1029
Microsoft .NET Framework 4.5.2-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\\Setup.exe /repair /x86
Microsoft .NET Framework 4.5.2-->MsiExec.exe /X{3911CF56-9EF2-39BA-846A-C27BD3CD0685}
Microsoft Office File Validation Add-In-->MsiExec.exe /I{90140000-2005-0000-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161-->MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729-->MsiExec.exe /X{6AFCA4E1-9B78-3640-8F72-A7BF33448200}
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-->MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005-->MsiExec.exe /X{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005-->MsiExec.exe /X{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}
Mozilla Firefox 44.0.2 (x86 cs)-->"C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
Mozilla Maintenance Service-->"C:\Program Files\Mozilla Maintenance Service\uninstall.exe"
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 4.0 SP3 Parser (KB2758694)-->MsiExec.exe /I{1D95BA90-F4F8-47EC-A882-441C99D30C1E}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NetSoftware-->"C:\Program Files\NetSoftware\rmNetSoftware.exe" "C:\Program Files\NetSoftware"
NVIDIA Ovladače grafiky 307.83-->"C:\Windows\system32\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.{78030D07-3F06-405D-B7A0-688744F51378}\NVI2.DLL",UninstallPackage Display.Driver
OpenOffice 4.1.2 Language Pack (Czech)-->MsiExec.exe /I{E70E663E-19DE-425B-98EB-3ADBDE08D5EA}
OpenOffice 4.1.2-->MsiExec.exe /I{E6AD67BB-1C33-4AB3-A387-E0D48137AB70}
PC Wizard 2013.2.12-->"C:\Program Files\CPUID\PC Wizard 2013\unins000.exe"
PDF to JPG 4.2-->"C:\Program Files\PDF Helper\PDF to JPG\unins000.exe"
PowerChute Personal Edition 3.0.2-->MsiExec.exe /X{8ED262EE-FC73-47A9-BB86-D92223246881}
ProFact 3.0 Free-->"C:\Program Files\ProFact 3.0 Free\unins000.exe"
Příjmové a výdajové doklady-->"C:\Program Files\Příjmové a výdajové doklady\unins000.exe"
Recuva-->"C:\Program Files\Recuva\uninst.exe"
Registrace uživatele zařízení Canon MG7500 series-->C:\Program Files\Canon\IJEREG\MG7500 series\UNINST.EXE
Revo Uninstaller 1.95-->C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {94EFE014-E577-310B-B2D5-6973A21D8A90} /qb+ REBOOTPROMPT=""
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {939AF4BC-EC42-38D1-AE82-91D4A7ED8911} /qb+ REBOOTPROMPT=""
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8433C01-319F-3370-850E-87C35496299A} /qb+ REBOOTPROMPT=""
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {48B0C142-A0F4-3263-90E1-1984CBB8DD18} /qb+ REBOOTPROMPT=""
Security Update for Microsoft .NET Framework 4.5.2 (KB3074230)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {CCEC28F6-82A2-35B0-8FE6-39C22A698F23}
Security Update for Microsoft .NET Framework 4.5.2 (KB3074550)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {A4953275-5880-3E7F-ABC2-BE1904624135}
Security Update for Microsoft .NET Framework 4.5.2 (KB3097996)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {63474770-8265-373F-8E8A-63BE4DB58739}
Security Update for Microsoft .NET Framework 4.5.2 (KB3098781)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {DB389F39-13F5-33DE-B9A2-C2AF6E3D4EDE}
Security Update for Microsoft .NET Framework 4.5.2 (KB3099869)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {4B390C27-9F65-33F8-9483-F5A6BC9F78B1}
Security Update for Microsoft .NET Framework 4.5.2 (KB3122656)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {BCC414C0-8FCC-3249-B692-4A832E0A9326}
Security Update for Microsoft .NET Framework 4.5.2 (KB3127229)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\v4.5.51209\setup.exe /uninstallpatch {DB5B33BE-851E-30AC-AFEC-32082B3448EC}
Software602 Form Filler-->MsiExec.exe /X{F8F79FE0-64EA-439C-A6AE-B1946A178F24}
SpyHunter 4-->C:\Users\Jirka\AppData\Roaming\Enigma Software Group\sh_installer.exe -r sh
TablEdit 2.73-->"C:\Program Files\TablEdit\unins000.exe"
Trojan Killer-->C:\Program Files\GridinSoft Trojan Killer\uninst.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
UZEL Evidence-->"C:\Program Files\JPeTFree\Uzel\unins000.exe"
Visual Studio 2012 x86 Redistributables-->MsiExec.exe /I{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}
Vit Registry Fix 9.5.9 (remove only)-->C:\Program Files\VITSOFT\Vit Registry Fix\Uninstall.exe
VLC media player-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WinRAR 4.20 (32-bit)-->C:\Program Files\WinRAR\uninstall.exe
Zoner Photo Studio 16-->"C:\Program Files\Zoner\Photo Studio 16\unins000.exe"
======Security center information======
AV: AVG Anti-Virus Free Edition 2013
AS: AVG Anti-Virus Free Edition 2013 (disabled)
AS: Windows Defender (disabled)
======System event log======
Computer Name: Jirka-PC
Event Code: 1103
Message: Počítači byla úspěšně přidělena adresa ze sítě, takže se nyní může připojovat k jiným počítačům.
Record Number: 209233
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20150227064714.000000-000
Event Type: Informace
User:
Computer Name: Jirka-PC
Event Code: 4201
Message: Systém zjistil, že síťový adaptér Připojení k místní síti byl připojen k síti a inicializoval normální činnost.
Record Number: 209232
Source Name: Tcpip
Time Written: 20150227064712.390120-000
Event Type: Informace
User:
Computer Name: Jirka-PC
Event Code: 4201
Message: Systém zjistil, že síťový adaptér Připojení k místní síti byl připojen k síti a inicializoval normální činnost.
Record Number: 209231
Source Name: Tcpip
Time Written: 20150227064712.322741-000
Event Type: Informace
User:
Computer Name: Jirka-PC
Event Code: 8033
Message: Prohledávač vyvolal v síti \Device\NetBT_Tcpip_{C1127E1E-07F9-4B8A-BCD9-D5E8EF04B696} volby, protože hlavní prohledávač byl zastaven.
Record Number: 209230
Source Name: BROWSER
Time Written: 20150226190932.000000-000
Event Type: Informace
User:
Computer Name: Jirka-PC
Event Code: 42
Message: Systém přechází do režimu spánku.
Record Number: 209229
Source Name: Microsoft-Windows-Kernel-Power
Time Written: 20150226190924.606828-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM
=====Application event log=====
Computer Name: Jirka-PC
Event Code: 1000
Message: Čítače výkonu pro službu .NET Memory Cache 4.0 (.NET Memory Cache 4.0) byly úspěšně načteny. Data záznamu v datové části obsahují nové indexové hodnoty přiřazené této službě.
Record Number: 934
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20130217131846.000000-000
Event Type: Informace
User:
Computer Name: Jirka-PC
Event Code: 10000
Message: Zahajování relace 1 – 2013-02-17T13:18:26.258Z.
Record Number: 933
Source Name: Microsoft-Windows-RestartManager
Time Written: 20130217131826.258623-000
Event Type: Informace
User: Jirka-PC\Jirka
Computer Name: Jirka-PC
Event Code: 10001
Message: Ukončování relace 1, zahájení 2013-02-17T13:14:33.202Z.
Record Number: 932
Source Name: Microsoft-Windows-RestartManager
Time Written: 20130217131826.053558-000
Event Type: Informace
User: Jirka-PC\Jirka
Computer Name: Jirka-PC
Event Code: 1040
Message: Zahajuji transakci Instalační služby systému Windows: C:\Users\Jirka\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Extended_x86.msi. ID procesu klienta: 2236.
Record Number: 931
Source Name: MsiInstaller
Time Written: 20130217131826.000000-000
Event Type: Informace
User: Jirka-PC\Jirka
Computer Name: Jirka-PC
Event Code: 1042
Message: Ukončuji transakci Instalační služby systému Windows: C:\Users\Jirka\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Core_x86.msi. ID procesu klienta: 2236.
Record Number: 930
Source Name: MsiInstaller
Time Written: 20130217131826.000000-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM