VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

řešení problému

https://forum.viry.cz:443/viewtopic.php?t=126864

Stránka 1 z 2

řešení problému

Napsal: 29 pro 2012 22:39
od povison
Logfile of random's system information tool 1.09 (written by random/random)
Run by Sexy at 2012-12-29 22:15:30
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 397 GB (83%) free of 477 GB
Total RAM: 2047 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:15:43, on 29.12.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASRock Utility\OCTuner\ASROC.exe
C:\Program Files (x86)\ASRock Utility\IES\AsrIes.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
C:\Program Files (x86)\XFastUSB\XFastUsb.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Sexy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/?ocid=EIE9HP&PC=UP50
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
R3 - URLSearchHook: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: SmartView VisualBookmark - {0E5680D1-BF44-4929-94AF-FD30D784AD1D} - C:\Program Files (x86)\DeviceVM\SmartView\SmartView.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: GomPicker - {F0181C6E-9218-4792-9F3C-E8DF52B2F1AC} - C:\Program Files (x86)\GRETECH\GomPicker\GomPickerBHO.dll
O4 - HKLM\..\Run: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
O4 - HKLM\..\Run: [SmartViewAgent] C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
O4 - HKCU\..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-328227116-3705980005-1290579923-1004\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-328227116-3705980005-1290579923-1004\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} (Battlefield Play4Free Updater) - https://battlefield.play4free.com/stati ... 0.80.2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\ASRock\XFast LAN\spd.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) - Unknown owner - C:\Windows\system32\viakaraokesrv.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9658 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files\ASRock\XFast LAN\spd.exe" -service
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\viakaraokesrv.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_0000065c
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {815A84BB-FA98-4731-9EE1-D5EA9FCCBD9B}
"C:\Program Files (x86)\ASRock Utility\OCTuner\ASROC.exe"
"C:\Program Files (x86)\ASRock Utility\IES\AsrIes.exe"
"C:\Program Files\ASRock\XFast LAN\cfosspeed.exe"
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\AmbRunE.dll,RunDLLEntry
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" -tray
"C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --app-id=oiokahphinmbmakkehgelkmpolmnbkdh
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="2708.1.1851604835\1226708828" --gpu-vendor-id=0x10de --gpu-device-id=0x0dc4 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.1070 --ignored=" --type=renderer " /prefetch:12
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="2708.3.1346126269\394881084" --lang=cs --ignored=" --type=renderer " /prefetch:13
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AsyncDns/disabled/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/EnableStage3D/enabled_default/ForceCompositingMode/disable/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/InfiniteCache/No/NewTabButton/default/OmniboxDisallowInlineHQP/Standard/OmniboxSearchSuggest/2/OneClickSignIn/Standard/Prerender/PrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SBInterstitial/V2/SpdyCwnd/cwndMin10/SpeculativePrefetchingLearning/SpeculativePrefetchingDisabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-1-Percent/group_41/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/ --renderer-print-preview --channel="2708.27.979864222\626371228" /prefetch:3
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AsyncDns/disabled/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/EnableStage3D/enabled_default/ForceCompositingMode/disable/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/InfiniteCache/No/NewTabButton/default/OmniboxDisallowInlineHQP/Standard/OmniboxSearchSuggest/2/OneClickSignIn/Standard/Prerender/PrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SBInterstitial/V2/SpdyCwnd/cwndMin10/SpeculativePrefetchingLearning/SpeculativePrefetchingDisabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-1-Percent/group_41/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/ --renderer-print-preview --channel="2708.36.1588308576\476930395" /prefetch:3
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials=AsyncDns/disabled/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/EnableStage3D/enabled_default/ForceCompositingMode/disable/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/InfiniteCache/No/NewTabButton/default/OmniboxDisallowInlineHQP/Standard/OmniboxSearchSuggest/2/OneClickSignIn/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/ProxyConnectionImpact/proxy_connections_32/SBInterstitial/V2/SpdyCwnd/cwndMin10/SpeculativePrefetchingLearning/SpeculativePrefetchingDisabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-1-Percent/group_41/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-20-Percent/group_03/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/WarmSocketImpact/warm_socket/ --renderer-print-preview --channel="2708.39.160693732\564501467" /prefetch:3
{7B46F996-A0B7-4B3A-A0F7-10E813EAD15D}
"taskhost.exe"
C:\Windows\system32\AUDIODG.EXE 0x514
"C:\Users\Sexy\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}]
SmartView VisualBookmark - C:\Program Files (x86)\DeviceVM\SmartView\SmartView.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-30 75232]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-09-01 426736]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-12-04 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-12-04 155384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0181C6E-9218-4792-9F3C-E8DF52B2F1AC}]
GretechBHO Class - C:\Program Files (x86)\GRETECH\GomPicker\GomPickerBHO.dll [2012-04-24 2483320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"XFast LAN"=C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2011-10-19 1441152]
"RunDLLEntry"=C:\Windows\system32\AmbRunE.dll [2009-02-26 17920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ASRockOCTuner"= []
"ASRockIES"= []
"zASRockInstantBoot"= []
""= []
"RGSC"=C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent []
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"NokiaSuite.exe"=C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [2012-10-13 1088424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-11 919008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-07-31 38872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2011-06-20 5199984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [2012-10-13 1088424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [2012-09-01 296096]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"XFastUSB"=C:\Program Files (x86)\XFastUSB\XFastUsb.exe [2012-10-22 5019360]
"SmartViewAgent"=C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe []
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2012-12-14 384800]
"ROC_roc_ssl_v12"=C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe / /PROMPT /CMPID=roc_ssl_v12 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux1"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-12-29 22:15:33 ----D---- C:\Program Files\trend micro
2012-12-29 22:15:30 ----D---- C:\rsit
2012-12-29 20:22:10 ----D---- C:\Program Files (x86)\ESET
2012-12-21 11:36:36 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2012-12-21 11:36:36 ----A---- C:\Windows\system32\atmlib.dll
2012-12-21 11:36:36 ----A---- C:\Windows\system32\atmfd.dll
2012-12-21 11:36:35 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2012-12-17 21:01:20 ----HD---- C:\ProgramData\Common Files
2012-12-17 18:03:37 ----D---- C:\Users\Sexy\AppData\Roaming\PerfView
2012-12-14 00:14:45 ----D---- C:\Users\Sexy\AppData\Roaming\Avira
2012-12-14 00:09:15 ----D---- C:\Program Files (x86)\Avira
2012-12-14 00:09:15 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2012-12-14 00:09:15 ----A---- C:\Windows\system32\drivers\avipbb.sys
2012-12-14 00:09:15 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2012-12-13 00:49:06 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-12-13 00:49:06 ----A---- C:\Windows\system32\mshtmled.dll
2012-12-13 00:49:05 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2012-12-13 00:49:04 ----A---- C:\Windows\SYSWOW64\url.dll
2012-12-13 00:49:04 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2012-12-13 00:49:04 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-12-13 00:49:04 ----A---- C:\Windows\system32\url.dll
2012-12-13 00:49:04 ----A---- C:\Windows\system32\ieUnatt.exe
2012-12-13 00:49:04 ----A---- C:\Windows\system32\ieui.dll
2012-12-13 00:49:03 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-12-13 00:49:03 ----A---- C:\Windows\system32\urlmon.dll
2012-12-13 00:49:02 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2012-12-13 00:49:02 ----A---- C:\Windows\system32\msfeeds.dll
2012-12-13 00:49:02 ----A---- C:\Windows\system32\jscript9.dll
2012-12-13 00:49:01 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-12-13 00:49:01 ----A---- C:\Windows\system32\wininet.dll
2012-12-13 00:49:01 ----A---- C:\Windows\system32\jsproxy.dll
2012-12-13 00:49:00 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-12-13 00:49:00 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-12-13 00:49:00 ----A---- C:\Windows\system32\vbscript.dll
2012-12-13 00:49:00 ----A---- C:\Windows\system32\jscript.dll
2012-12-13 00:48:59 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-12-13 00:48:59 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-12-13 00:48:59 ----A---- C:\Windows\system32\iertutil.dll
2012-12-13 00:48:57 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-12-13 00:48:55 ----A---- C:\Windows\system32\mshtml.dll
2012-12-13 00:48:55 ----A---- C:\Windows\system32\ieframe.dll
2012-12-13 00:48:54 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-12-12 23:53:54 ----A---- C:\Windows\SYSWOW64\tzres.dll
2012-12-12 23:53:54 ----A---- C:\Windows\system32\tzres.dll
2012-12-12 23:53:35 ----A---- C:\Windows\system32\KernelBase.dll
2012-12-12 23:53:35 ----A---- C:\Windows\system32\kernel32.dll
2012-12-12 23:53:35 ----A---- C:\Windows\system32\conhost.exe
2012-12-12 23:53:34 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2012-12-12 23:53:34 ----A---- C:\Windows\system32\winsrv.dll
2012-12-12 23:53:33 ----A---- C:\Windows\SYSWOW64\setup16.exe
2012-12-12 23:53:33 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2012-12-12 23:53:33 ----A---- C:\Windows\system32\wow64win.dll
2012-12-12 23:53:33 ----A---- C:\Windows\system32\wow64.dll
2012-12-12 23:53:32 ----A---- C:\Windows\SYSWOW64\wow32.dll
2012-12-12 23:53:32 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2012-12-12 23:53:32 ----A---- C:\Windows\system32\wow64cpu.dll
2012-12-12 23:53:32 ----A---- C:\Windows\system32\ntvdm64.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-12-12 23:53:31 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-12-12 23:53:31 ----A---- C:\Windows\SYSWOW64\instnm.exe
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-12-12 23:53:30 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-12-12 23:53:29 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2012-12-12 23:53:29 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-12-12 23:53:29 ----A---- C:\Windows\SYSWOW64\user.exe
2012-12-12 23:52:37 ----A---- C:\Windows\system32\win32k.sys
2012-12-12 23:52:35 ----A---- C:\Windows\SYSWOW64\dpnet.dll
2012-12-12 23:52:35 ----A---- C:\Windows\system32\dpnet.dll
2012-12-04 22:04:45 ----A---- C:\Windows\SYSWOW64\javaws.exe
2012-12-04 22:04:36 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2012-12-04 22:04:36 ----A---- C:\Windows\SYSWOW64\javaw.exe
2012-12-04 22:04:36 ----A---- C:\Windows\SYSWOW64\java.exe
2012-12-04 22:04:27 ----D---- C:\Program Files (x86)\Java
2012-12-04 21:55:08 ----D---- C:\Program Files (x86)\AGEIA Technologies
2012-12-04 21:49:58 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2012-12-04 21:49:58 ----A---- C:\Windows\SYSWOW64\nvinit.dll
2012-12-04 21:49:58 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2012-12-04 21:49:58 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2012-12-04 21:49:58 ----A---- C:\Windows\system32\nvoglv64.dll
2012-12-04 21:49:58 ----A---- C:\Windows\system32\nvd3dumx.dll
2012-12-04 21:49:58 ----A---- C:\Windows\system32\nvcuda.dll
2012-12-04 21:49:57 ----A---- C:\Windows\SYSWOW64\nvumdshim.dll
2012-12-04 21:49:57 ----A---- C:\Windows\SYSWOW64\nvopencl.dll
2012-12-04 21:49:57 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2012-12-04 21:49:57 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2012-12-04 21:49:57 ----A---- C:\Windows\system32\nvopencl.dll
2012-12-04 21:49:57 ----A---- C:\Windows\system32\nvcuvenc.dll
2012-12-04 21:49:57 ----A---- C:\Windows\system32\nvcompiler.dll
2012-12-04 21:49:56 ----A---- C:\Windows\system32\nvinitx.dll
2012-12-04 21:49:56 ----A---- C:\Windows\system32\nvcuvid.dll
2012-12-04 21:49:54 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2012-12-04 21:49:54 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2012-12-04 21:49:54 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2012-12-04 20:42:11 ----D---- C:\Users\Sexy\AppData\Roaming\Media Player Classic
2012-12-04 19:27:24 ----D---- C:\Users\Sexy\AppData\Roaming\dvdcss
2012-11-30 22:43:52 ----A---- C:\Windows\SYSWOW64\nvStreaming.exe

======List of files/folders modified in the last 1 month======

2012-12-29 22:15:44 ----D---- C:\Windows\Prefetch
2012-12-29 22:15:40 ----D---- C:\Windows\Temp
2012-12-29 22:15:33 ----RD---- C:\Program Files
2012-12-29 20:22:10 ----RD---- C:\Program Files (x86)
2012-12-29 17:35:07 ----D---- C:\Windows\SysWOW64
2012-12-29 17:35:03 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2012-12-29 07:06:07 ----D---- C:\Windows\system32\config
2012-12-29 06:55:22 ----D---- C:\Windows\SYSWOW64\drivers
2012-12-29 06:51:58 ----D---- C:\ProgramData\NVIDIA
2012-12-24 14:08:15 ----D---- C:\Windows\System32
2012-12-24 14:08:15 ----D---- C:\Windows\inf
2012-12-24 14:08:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-12-24 01:20:04 ----D---- C:\Users\Sexy\AppData\Roaming\uTorrent
2012-12-22 14:22:26 ----D---- C:\Program Files (x86)\DAEMON Tools Toolbar
2012-12-22 14:21:37 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-12-22 14:21:26 ----SHD---- C:\System Volume Information
2012-12-22 14:01:40 ----D---- C:\Program Files (x86)\Ubisoft
2012-12-22 14:01:25 ----SHD---- C:\Windows\Installer
2012-12-22 14:01:25 ----SHD---- C:\Config.Msi
2012-12-22 14:00:46 ----RSD---- C:\Windows\assembly
2012-12-21 11:41:32 ----D---- C:\ProgramData\Ubisoft
2012-12-21 11:38:45 ----D---- C:\Windows\winsxs
2012-12-21 11:36:47 ----D---- C:\Windows\system32\catroot
2012-12-21 11:36:46 ----D---- C:\Windows\system32\catroot2
2012-12-17 21:04:21 ----D---- C:\Windows\system32\drivers
2012-12-17 21:04:14 ----HD---- C:\ProgramData
2012-12-17 21:01:34 ----D---- C:\Program Files (x86)\Common Files
2012-12-17 18:08:40 ----D---- C:\Ubisoft
2012-12-17 07:45:06 ----D---- C:\Windows\system32\NDF
2012-12-14 17:45:34 ----D---- C:\Users\Sexy\AppData\Roaming\vlc
2012-12-14 00:09:15 ----D---- C:\ProgramData\Avira
2012-12-13 09:18:50 ----D---- C:\Windows\rescache
2012-12-13 01:29:09 ----D---- C:\Windows\SYSWOW64\cs-CZ
2012-12-13 01:29:09 ----D---- C:\Windows\system32\cs-CZ
2012-12-13 01:29:07 ----D---- C:\Windows\AppPatch
2012-12-13 01:29:06 ----D---- C:\Windows\SYSWOW64\migration
2012-12-13 01:29:06 ----D---- C:\Windows\system32\migration
2012-12-13 01:29:06 ----D---- C:\Program Files (x86)\Internet Explorer
2012-12-13 01:29:05 ----D---- C:\Program Files\Internet Explorer
2012-12-13 00:51:09 ----A---- C:\Windows\system32\MRT.exe
2012-12-12 21:30:51 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-12-05 06:06:44 ----D---- C:\Windows
2012-12-04 22:04:28 ----A---- C:\Windows\SYSWOW64\npDeployJava1.dll
2012-12-04 22:04:28 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2012-12-04 21:55:21 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2012-12-04 21:54:19 ----D---- C:\Windows\system32\DriverStore
2012-12-04 20:52:25 ----D---- C:\Windows\system32\Tasks
2012-12-03 16:47:14 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2012-12-03 16:47:14 ----A---- C:\Windows\system32\nvwgf2umx.dll
2012-12-03 16:47:14 ----A---- C:\Windows\system32\nvumdshimx.dll
2012-12-03 16:47:14 ----A---- C:\Windows\system32\nvdispgenco64.dll
2012-12-03 16:47:14 ----A---- C:\Windows\system32\nvdispco64.dll
2012-12-03 16:47:14 ----A---- C:\Windows\system32\nvapi64.dll
2012-12-01 06:49:26 ----A---- C:\Windows\system32\nvsvcr.dll
2012-12-01 06:49:25 ----A---- C:\Windows\system32\nvshext.dll
2012-12-01 06:49:25 ----A---- C:\Windows\system32\nvmctray.dll
2012-12-01 06:49:24 ----A---- C:\Windows\system32\nvvsvc.exe
2012-12-01 06:48:41 ----A---- C:\Windows\system32\nvcpl.dll
2012-12-01 06:48:37 ----A---- C:\Windows\system32\nvsvc64.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor64;nvstor64; C:\Windows\system32\DRIVERS\nvstor64.sys [2012-10-21 241184]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-11-10 564824]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 AsrAppCharger;AsrAppCharger; C:\Windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2012-07-03 19600]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2012-12-14 129216]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
R1 cFosSpeed;cFosSpeed for faster Internet connections (NDIS 6); C:\Windows\system32\DRIVERS\cfosspeed6.sys [2011-07-04 1632128]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 FNETURPX;FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [2012-10-22 15936]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2012-12-14 99912]
R3 AsrOcDrv;AsrOcDrv; \??\C:\Windows\SysWOW64\Drivers\AsrOcDrv.sys []
R3 IesDrv;IesDrv; \??\C:\Windows\SysWOW64\Drivers\IesDrv.sys []
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2012-07-03 189288]
R3 NVNET;NVIDIA nForce Ethernet Driver; C:\Windows\system32\DRIVERS\nvmf6264.sys [2010-08-12 350952]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2011-06-14 2159728]
S3 a7lsowol;a7lsowol; C:\Windows\system32\drivers\a7lsowol.sys []
S3 FNETTBOH_305;FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [2012-12-24 32320]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2012-06-11 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2012-06-11 27136]
S3 nmwcdnsucx64;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800]
S3 nmwcdnsux64;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-06-27 26112]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2012-06-11 9216]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2012-06-11 9216]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-12-14 109344]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-14 85280]
R2 cFosSpeedS;cFosSpeed System Service; C:\Program Files\ASRock\XFast LAN\spd.exe [2011-10-19 395136]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service; C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-05-14 4901888]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-12-01 890216]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-12-03 1259880]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-11-10 76888]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
R2 VIAKaraokeService;VIA Karaoke digital mixer Service; C:\Windows\system32\viakaraokesrv.exe [2012-10-21 27760]
R3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2012-10-03 725400]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-12 250808]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 136176]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Re: řešení problému

Napsal: 30 pro 2012 10:38
od Rudy
Zdravím!
Topic nadepsaný "řešení problému" s logem RSIT bez dalšího vysvětlení je k ničemu, když nevím, o jaký problém jde. Prosil bych o nějakou podrobnost.

Re: řešení problému

Napsal: 30 pro 2012 16:48
od povison
Dobrý den, jedná se o to, že včera při hraní hry online Battlefield Play4Free někdo převzal ovládání mé postavy ve hře a začal psát, tak jako bych já psal svým spoluhráčům ve hře. Dost mě to šokovalo, a tak jsem psal na stránkách CZBF o pomoc, a tam mě admin odkázal zde na stránky s programem. Postupoval jsem podle návodu, ale nevím zda správně. Ten program mi vygeneroval již výše uvedenou stránku s daty a potom ještě jednu. Obě jsem zde vložil a čekal radu, pomoc a co bude dál. Moc těmto věcem totiž nerozumím. Pokud tedy budete moci mi pomoc, budu moc rád. Nyní se totiž bojím se přihlásit do banky. S pozdravem Povala

Re: řešení problému

Napsal: 30 pro 2012 17:31
od Rudy
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

Re: řešení problému

Napsal: 30 pro 2012 18:55
od povison
Děkuju, stáhl jsem a spustil Vámi zadaný program, ten se ukončil a zanechal otevřený log - poznámkový blok . Ale co teď s tím, vůbec tomu nerozumím. Mám to zde zveřejnit, zda tomu někdo rozumí?

Re: řešení problému

Napsal: 30 pro 2012 19:25
od Rudy
Pokud znáte kopírovat/vložit, zkopírujte to sem.

Re: řešení problému

Napsal: 30 pro 2012 20:11
od povison
ComboFix 12-12-30.01 - Sexy 30.12.2012 17:49:57.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.1222 [GMT 1:00]
Spuštěný z: c:\users\Sexy\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\tmp8F74.tmp
c:\windows\SysWow64\tmp8FA4.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-28 do 2012-12-30 )))))))))))))))))))))))))))))))
.
.
2012-12-30 17:00 . 2012-12-30 17:00 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-12-30 17:00 . 2012-12-30 17:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-30 16:51 . 2012-12-30 16:51 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8524BA20-6918-445E-AD4C-7649178E9B1D}\offreg.dll
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- c:\program files\trend micro
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- C:\rsit
2012-12-22 13:04 . 2012-12-30 11:10 -------- d-----w- c:\users\Sexy\AppData\Local\Ubisoft Game Launcher
2012-12-21 10:36 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 10:36 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 18:08 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8524BA20-6918-445E-AD4C-7649178E9B1D}\mpengine.dll
2012-12-17 20:01 . 2012-12-17 20:04 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2012-12-17 20:01 . 2012-12-17 20:01 -------- d--h--w- c:\programdata\Common Files
2012-12-17 17:03 . 2012-12-17 17:03 -------- d-----w- c:\users\Sexy\AppData\Roaming\PerfView
2012-12-13 23:14 . 2012-12-13 23:14 -------- d-----w- c:\users\Sexy\AppData\Roaming\Avira
2012-12-13 23:09 . 2012-12-14 10:40 99912 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-13 23:09 . 2012-12-14 10:40 129216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-12-13 23:09 . 2012-12-13 23:09 -------- d-----w- c:\program files (x86)\Avira
2012-12-13 23:09 . 2012-09-24 08:58 27800 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-12-12 23:48 . 2012-11-14 06:06 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 05:55 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-12-12 23:48 . 2012-11-14 02:00 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll
2012-12-12 23:48 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-12-12 22:52 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 22:52 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 22:52 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-12-04 21:04 . 2012-12-04 21:04 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Java
2012-12-04 20:55 . 2012-12-04 20:55 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-12-04 19:42 . 2012-12-04 19:42 -------- d-----w- c:\users\Sexy\AppData\Roaming\Media Player Classic
2012-12-04 18:27 . 2012-12-04 20:00 -------- d-----w- c:\users\Sexy\AppData\Roaming\dvdcss
2012-11-30 21:43 . 2012-11-30 21:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-29 16:35 . 2012-08-07 10:37 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-12-29 16:35 . 2012-08-07 10:34 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-12-29 16:34 . 2012-08-07 10:34 234768 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-12-24 13:07 . 2012-11-20 17:46 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS
2012-12-12 23:51 . 2012-08-04 21:38 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-12 20:30 . 2012-08-04 21:16 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 20:30 . 2012-08-04 21:16 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-04 21:04 . 2012-08-29 09:17 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-12-04 21:04 . 2012-08-29 09:17 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-12-03 15:47 . 2012-10-22 09:25 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-10-22 09:25 983936 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-12-03 15:47 . 2012-10-22 09:25 2816824 ----a-w- c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1805672 ----a-w- c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 15016256 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-12-01 05:49 . 2012-10-22 09:27 3663213 ----a-w- c:\windows\system32\nvcoproc.bin
2012-12-01 05:49 . 2012-10-22 09:27 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-12-01 05:49 . 2012-10-22 09:27 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2012-10-22 09:27 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2012-10-22 09:27 890216 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2012-10-22 09:27 6223208 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2012-10-22 09:27 3311464 ----a-w- c:\windows\system32\nvsvc64.dll
2012-11-18 17:41 . 2012-11-18 17:41 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2012-11-17 21:16 . 2012-11-17 21:16 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll
2012-11-17 21:16 . 2012-11-17 21:16 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll
2012-11-10 14:15 . 2012-08-07 10:34 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-11-10 13:33 . 2012-11-09 22:55 564824 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-10-30 22:50 . 2012-08-04 20:59 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-22 08:52 . 2012-10-22 08:52 15936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2012-10-21 20:18 . 2012-10-21 20:22 506400 ----a-w- c:\windows\system32\nvusmu.exe
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-10-21 20:10 . 2009-06-30 15:33 241184 ----a-w- c:\windows\system32\drivers\nvstor64.sys
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraiins.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraidco.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-10-21 19:55 . 2012-10-21 19:56 414632 ------w- c:\windows\difxapi.dll
2012-10-21 19:55 . 2011-06-08 16:19 85504 ----a-w- c:\windows\system32\nQPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 87152 ----a-w- c:\windows\system32\ViaMicArrayPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 202864 ----a-w- c:\windows\system32\ViaMicArrayAPO.dll
2012-10-21 19:55 . 2011-06-14 19:42 27760 ----a-w- c:\windows\system32\ViakaraokeSrv.exe
2012-10-21 19:55 . 2011-06-14 19:42 116848 ----a-w- c:\windows\system32\ViaKaraokePropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 1161328 ----a-w- c:\windows\system32\ViaKaraokeApo.dll
2012-10-21 19:55 . 2011-06-08 16:19 83968 ----a-w- c:\windows\system32\nQAPO.dll
2012-10-21 19:55 . 2010-12-23 10:34 57856 ----a-w- c:\windows\system32\VMPPLD64.DLL
2012-10-21 19:55 . 2010-10-26 16:55 74240 ----a-w- c:\windows\system32\VMWRP64.DLL
2012-10-21 19:55 . 2010-12-23 10:35 869376 ----a-w- c:\windows\system32\VMAPO64.DLL
2012-10-21 19:55 . 2010-12-23 10:29 731648 ----a-w- c:\windows\SysWow64\VMAPO32.DLL
2012-10-21 19:55 . 2010-10-26 16:54 53760 ----a-w- c:\windows\system32\VMPPCN64.DLL
2012-10-21 19:55 . 2011-06-14 19:42 559216 ----a-w- c:\windows\system32\VIASysFx.dll
2012-10-20 13:12 . 2009-04-30 10:46 899584 ----a-w- c:\windows\system32\fdco1.dll
2012-10-04 16:40 . 2012-12-12 22:53 44032 ----a-w- c:\windows\apppatch\acwow64.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2010-11-20 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2012-08-05 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"XFastUSB"="c:\program files (x86)\XFastUSB\XFastUsb.exe" [2012-10-22 5019360]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-14 384800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-12-24 32320]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]
S1 aswKbd;aswKbd; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-10-22 15936]
S1 MpKslb7c5bd45;MpKslb7c5bd45;c:\windows\Temp\MpKslb7c5bd45.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-14 85280]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-05-14 4901888]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2012-10-21 27760]
S3 AsrOcDrv;AsrOcDrv;c:\windows\SysWOW64\Drivers\AsrOcDrv.sys [x]
S3 IesDrv;IesDrv;c:\windows\SysWOW64\Drivers\IesDrv.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-06-14 2159728]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 20:30]
.
2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 20:59]
.
2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 20:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-10-19 1441152]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
Wow6432Node-HKCU-Run-ASRockOCTuner - (no file)
Wow6432Node-HKCU-Run-ASRockIES - (no file)
Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)
Wow6432Node-HKLM-Run-SmartViewAgent - c:\program files (x86)\DeviceVM\SmartView\SmartViewAgent.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-328227116-3705980005-1290579923-1001\Software\SecuROM\License information*]
"datasecu"=hex:71,0f,4b,ea,41,25,1f,7a,be,f2,f5,f2,82,be,dc,e2,de,0c,7c,c0,8d,
63,49,60,05,0e,09,15,ff,86,77,77,b9,9a,30,c8,9b,78,a2,78,8e,6e,be,75,ce,21,\
"rkeysecu"=hex:b5,84,33,86,57,b2,aa,59,75,d9,f0,97,d1,c6,6e,8f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-12-30 18:21:08
ComboFix-quarantined-files.txt 2012-12-30 17:21
.
Před spuštěním: Volných bajtů: 430 989 078 528
Po spuštění: Volných bajtů: 436 973 744 128
.
- - End Of File - - A64EEA6CF875C0C4EF0B4A4802B62351

Re: řešení problému

Napsal: 30 pro 2012 20:45
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

FCopy::
c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll | c:\windows\system32\user32.dll
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll | c:\windows\SysWOW64\user32.dll

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Regnull::
[HKEY_USERS\S-1-5-21-328227116-3705980005-1290579923-1001\Software\SecuROM\License information*]

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: řešení problému

Napsal: 30 pro 2012 22:17
od povison
Tak jsem tedy udělal přesně to jak jste mi řekl a program vygeneroval další poznámkový blok, kde bylo toto:


ComboFix 12-12-30.01 - Sexy 30.12.2012 21:29:36.2.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.979 [GMT 1:00]
Spuštěný z: c:\users\Sexy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Sexy\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-28 do 2012-12-30 )))))))))))))))))))))))))))))))
.
.
2012-12-30 20:40 . 2012-12-30 20:40 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-12-30 20:40 . 2012-12-30 20:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-30 16:51 . 2012-12-30 16:51 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8524BA20-6918-445E-AD4C-7649178E9B1D}\offreg.dll
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- c:\program files\trend micro
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- C:\rsit
2012-12-22 13:04 . 2012-12-30 11:10 -------- d-----w- c:\users\Sexy\AppData\Local\Ubisoft Game Launcher
2012-12-21 10:36 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 10:36 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 18:08 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8524BA20-6918-445E-AD4C-7649178E9B1D}\mpengine.dll
2012-12-17 20:01 . 2012-12-17 20:04 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2012-12-17 20:01 . 2012-12-17 20:01 -------- d--h--w- c:\programdata\Common Files
2012-12-17 17:03 . 2012-12-17 17:03 -------- d-----w- c:\users\Sexy\AppData\Roaming\PerfView
2012-12-13 23:14 . 2012-12-13 23:14 -------- d-----w- c:\users\Sexy\AppData\Roaming\Avira
2012-12-13 23:09 . 2012-12-14 10:40 99912 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-13 23:09 . 2012-12-14 10:40 129216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-12-13 23:09 . 2012-12-13 23:09 -------- d-----w- c:\program files (x86)\Avira
2012-12-13 23:09 . 2012-09-24 08:58 27800 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-12-12 23:48 . 2012-11-14 06:06 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 05:55 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-12-12 23:48 . 2012-11-14 02:00 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll
2012-12-12 23:48 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-12-12 22:52 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 22:52 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 22:52 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-12-04 21:04 . 2012-12-04 21:04 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Java
2012-12-04 20:55 . 2012-12-04 20:55 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-12-04 19:42 . 2012-12-04 19:42 -------- d-----w- c:\users\Sexy\AppData\Roaming\Media Player Classic
2012-12-04 18:27 . 2012-12-04 20:00 -------- d-----w- c:\users\Sexy\AppData\Roaming\dvdcss
2012-11-30 21:43 . 2012-11-30 21:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-30 18:21 . 2012-08-07 10:37 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-12-30 18:21 . 2012-08-07 10:34 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-12-30 18:20 . 2012-08-07 10:34 234768 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-12-24 13:07 . 2012-11-20 17:46 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS
2012-12-12 23:51 . 2012-08-04 21:38 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-12 20:30 . 2012-08-04 21:16 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 20:30 . 2012-08-04 21:16 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-04 21:04 . 2012-08-29 09:17 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-12-04 21:04 . 2012-08-29 09:17 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-12-03 15:47 . 2012-10-22 09:25 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-10-22 09:25 983936 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-12-03 15:47 . 2012-10-22 09:25 2816824 ----a-w- c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1805672 ----a-w- c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 15016256 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-12-01 05:49 . 2012-10-22 09:27 3663213 ----a-w- c:\windows\system32\nvcoproc.bin
2012-12-01 05:49 . 2012-10-22 09:27 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-12-01 05:49 . 2012-10-22 09:27 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2012-10-22 09:27 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2012-10-22 09:27 890216 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2012-10-22 09:27 6223208 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2012-10-22 09:27 3311464 ----a-w- c:\windows\system32\nvsvc64.dll
2012-11-18 17:41 . 2012-11-18 17:41 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2012-11-17 21:16 . 2012-11-17 21:16 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll
2012-11-17 21:16 . 2012-11-17 21:16 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll
2012-11-10 14:15 . 2012-08-07 10:34 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-11-10 13:33 . 2012-11-09 22:55 564824 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-10-30 22:50 . 2012-08-04 20:59 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-22 08:52 . 2012-10-22 08:52 15936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2012-10-21 20:18 . 2012-10-21 20:22 506400 ----a-w- c:\windows\system32\nvusmu.exe
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-10-21 20:10 . 2009-06-30 15:33 241184 ----a-w- c:\windows\system32\drivers\nvstor64.sys
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraiins.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraidco.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-10-21 19:55 . 2012-10-21 19:56 414632 ------w- c:\windows\difxapi.dll
2012-10-21 19:55 . 2011-06-08 16:19 85504 ----a-w- c:\windows\system32\nQPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 87152 ----a-w- c:\windows\system32\ViaMicArrayPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 202864 ----a-w- c:\windows\system32\ViaMicArrayAPO.dll
2012-10-21 19:55 . 2011-06-14 19:42 27760 ----a-w- c:\windows\system32\ViakaraokeSrv.exe
2012-10-21 19:55 . 2011-06-14 19:42 116848 ----a-w- c:\windows\system32\ViaKaraokePropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 1161328 ----a-w- c:\windows\system32\ViaKaraokeApo.dll
2012-10-21 19:55 . 2011-06-08 16:19 83968 ----a-w- c:\windows\system32\nQAPO.dll
2012-10-21 19:55 . 2010-12-23 10:34 57856 ----a-w- c:\windows\system32\VMPPLD64.DLL
2012-10-21 19:55 . 2010-10-26 16:55 74240 ----a-w- c:\windows\system32\VMWRP64.DLL
2012-10-21 19:55 . 2010-12-23 10:35 869376 ----a-w- c:\windows\system32\VMAPO64.DLL
2012-10-21 19:55 . 2010-12-23 10:29 731648 ----a-w- c:\windows\SysWow64\VMAPO32.DLL
2012-10-21 19:55 . 2010-10-26 16:54 53760 ----a-w- c:\windows\system32\VMPPCN64.DLL
2012-10-21 19:55 . 2011-06-14 19:42 559216 ----a-w- c:\windows\system32\VIASysFx.dll
2012-10-20 13:12 . 2009-04-30 10:46 899584 ----a-w- c:\windows\system32\fdco1.dll
2012-10-04 16:40 . 2012-12-12 22:53 44032 ----a-w- c:\windows\apppatch\acwow64.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2010-11-20 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2012-08-05 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"XFastUSB"="c:\program files (x86)\XFastUSB\XFastUsb.exe" [2012-10-22 5019360]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-14 384800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-12-24 32320]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]
S1 aswKbd;aswKbd; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-10-22 15936]
S1 MpKslb7c5bd45;MpKslb7c5bd45;c:\windows\Temp\MpKslb7c5bd45.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-14 85280]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-05-14 4901888]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2012-10-21 27760]
S3 AsrOcDrv;AsrOcDrv;c:\windows\SysWOW64\Drivers\AsrOcDrv.sys [x]
S3 IesDrv;IesDrv;c:\windows\SysWOW64\Drivers\IesDrv.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-06-14 2159728]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 20:30]
.
2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 20:59]
.
2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04 20:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-10-19 1441152]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-328227116-3705980005-1290579923-1001\Software\SecuROM\License information*]
"datasecu"=hex:71,0f,4b,ea,41,25,1f,7a,be,f2,f5,f2,82,be,dc,e2,de,0c,7c,c0,8d,
63,49,60,05,0e,09,15,ff,86,77,77,b9,9a,30,c8,9b,78,a2,78,8e,6e,be,75,ce,21,\
"rkeysecu"=hex:b5,84,33,86,57,b2,aa,59,75,d9,f0,97,d1,c6,6e,8f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-12-30 22:00:14
ComboFix-quarantined-files.txt 2012-12-30 21:00
ComboFix2.txt 2012-12-30 17:21
.
Před spuštěním: Volných bajtů: 432 781 070 336
Po spuštění: Volných bajtů: 432 708 653 056
.
- - End Of File - - 37FC9A90B8FDB5E20EAED711552939D1

Re: řešení problému

Napsal: 30 pro 2012 22:23
od Rudy
Log je již OK. Nastala nějaká změna?

Re: řešení problému

Napsal: 30 pro 2012 22:30
od povison
Omlouvám se, musím to udělat znovu. Chtěl jste, abych zkopíroval váš odkaz, já zato zkopíroval vygenerovaný log z programu. Takže teď jsem uložil váš odkaz a nyní jej přesunu do programu. Se cítím jak vůl.

Re: řešení problému

Napsal: 30 pro 2012 22:49
od Rudy
OK.

Re: řešení problému

Napsal: 30 pro 2012 23:06
od povison
Teď by to už tedy mělo být správné:


ComboFix 12-12-30.01 - Sexy 30.12.2012 22:33:16.3.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.705 [GMT 1:00]
Spuštěný z: c:\users\Sexy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Sexy\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll --> c:\windows\system32\user32.dll
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll --> c:\windows\SysWOW64\user32.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-28 do 2012-12-30 )))))))))))))))))))))))))))))))
.
.
2012-12-30 21:43 . 2012-12-30 21:43 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- c:\program files\trend micro
2012-12-29 21:15 . 2012-12-29 21:15 -------- d-----w- C:\rsit
2012-12-22 13:04 . 2012-12-30 11:10 -------- d-----w- c:\users\Sexy\AppData\Local\Ubisoft Game Launcher
2012-12-21 10:36 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 10:36 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 10:36 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 18:08 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8524BA20-6918-445E-AD4C-7649178E9B1D}\mpengine.dll
2012-12-17 20:01 . 2012-12-17 20:04 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2012-12-17 20:01 . 2012-12-17 20:01 -------- d--h--w- c:\programdata\Common Files
2012-12-17 17:03 . 2012-12-17 17:03 -------- d-----w- c:\users\Sexy\AppData\Roaming\PerfView
2012-12-13 23:14 . 2012-12-13 23:14 -------- d-----w- c:\users\Sexy\AppData\Roaming\Avira
2012-12-13 23:09 . 2012-12-14 10:40 99912 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-13 23:09 . 2012-12-14 10:40 129216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-12-13 23:09 . 2012-12-13 23:09 -------- d-----w- c:\program files (x86)\Avira
2012-12-13 23:09 . 2012-09-24 08:58 27800 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-12-12 23:48 . 2012-11-14 06:06 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 05:55 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-12-12 23:48 . 2012-11-14 02:00 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-12-12 23:48 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-12-12 23:48 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll
2012-12-12 23:48 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-12-12 22:52 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 22:52 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 22:52 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-12-04 21:04 . 2012-12-04 21:04 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-12-04 21:04 . 2012-12-04 21:04 -------- d-----w- c:\program files (x86)\Java
2012-12-04 20:55 . 2012-12-04 20:55 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-12-04 19:42 . 2012-12-04 19:42 -------- d-----w- c:\users\Sexy\AppData\Roaming\Media Player Classic
2012-12-04 18:27 . 2012-12-04 20:00 -------- d-----w- c:\users\Sexy\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-30 18:21 . 2012-08-07 10:37 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-12-30 18:21 . 2012-08-07 10:34 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-12-30 18:20 . 2012-08-07 10:34 234768 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-12-24 13:07 . 2012-11-20 17:46 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS
2012-12-12 23:51 . 2012-08-04 21:38 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-12 20:30 . 2012-08-04 21:16 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 20:30 . 2012-08-04 21:16 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-04 21:04 . 2012-08-29 09:17 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-12-04 21:04 . 2012-08-29 09:17 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-12-03 15:47 . 2012-10-22 09:25 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-10-22 09:25 983936 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-12-03 15:47 . 2012-10-22 09:25 2816824 ----a-w- c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1805672 ----a-w- c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-10-22 09:25 15016256 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-12-01 05:49 . 2012-10-22 09:27 3663213 ----a-w- c:\windows\system32\nvcoproc.bin
2012-12-01 05:49 . 2012-10-22 09:27 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-12-01 05:49 . 2012-10-22 09:27 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2012-10-22 09:27 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2012-10-22 09:27 890216 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2012-10-22 09:27 6223208 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2012-10-22 09:27 3311464 ----a-w- c:\windows\system32\nvsvc64.dll
2012-11-30 21:43 . 2012-11-30 21:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-11-18 17:41 . 2012-11-18 17:41 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2012-11-17 21:16 . 2012-11-17 21:16 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll
2012-11-17 21:16 . 2012-11-17 21:16 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll
2012-11-10 14:15 . 2012-08-07 10:34 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-11-10 13:33 . 2012-11-09 22:55 564824 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-10-30 22:50 . 2012-08-04 20:59 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-10-22 08:52 . 2012-10-22 08:52 15936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2012-10-21 20:18 . 2012-10-21 20:22 506400 ----a-w- c:\windows\system32\nvusmu.exe
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZht.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoSv.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoRu.dll
2012-10-21 20:10 . 2009-06-30 15:34 15904 ----a-w- c:\windows\system32\NvRCoZhc.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoPtb.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNo.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoNl.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoIt.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoKo.dll
2012-10-21 20:10 . 2009-06-30 15:34 16416 ----a-w- c:\windows\system32\NvRCoJa.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoFr.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoFi.dll
2012-10-21 20:10 . 2009-06-30 15:33 241184 ----a-w- c:\windows\system32\drivers\nvstor64.sys
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEsm.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoEs.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoENU.dll
2012-10-21 20:10 . 2009-06-30 15:34 17952 ----a-w- c:\windows\system32\NvRCoEng.dll
2012-10-21 20:10 . 2009-06-30 15:34 18976 ----a-w- c:\windows\system32\NvRCoDe.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraiins.dll
2012-10-21 20:10 . 2009-06-30 15:34 402976 ----a-w- c:\windows\system32\nvraidco.dll
2012-10-21 20:10 . 2009-06-30 15:34 18464 ----a-w- c:\windows\system32\NvRCoDa.dll
2012-10-21 19:55 . 2012-10-21 19:56 414632 ------w- c:\windows\difxapi.dll
2012-10-21 19:55 . 2011-06-08 16:19 85504 ----a-w- c:\windows\system32\nQPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 87152 ----a-w- c:\windows\system32\ViaMicArrayPropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 202864 ----a-w- c:\windows\system32\ViaMicArrayAPO.dll
2012-10-21 19:55 . 2011-06-14 19:42 27760 ----a-w- c:\windows\system32\ViakaraokeSrv.exe
2012-10-21 19:55 . 2011-06-14 19:42 116848 ----a-w- c:\windows\system32\ViaKaraokePropPageExt.dll
2012-10-21 19:55 . 2011-06-14 19:42 1161328 ----a-w- c:\windows\system32\ViaKaraokeApo.dll
2012-10-21 19:55 . 2011-06-08 16:19 83968 ----a-w- c:\windows\system32\nQAPO.dll
2012-10-21 19:55 . 2010-12-23 10:34 57856 ----a-w- c:\windows\system32\VMPPLD64.DLL
2012-10-21 19:55 . 2010-10-26 16:55 74240 ----a-w- c:\windows\system32\VMWRP64.DLL
2012-10-21 19:55 . 2010-12-23 10:35 869376 ----a-w- c:\windows\system32\VMAPO64.DLL
2012-10-21 19:55 . 2010-12-23 10:29 731648 ----a-w- c:\windows\SysWow64\VMAPO32.DLL
2012-10-21 19:55 . 2010-10-26 16:54 53760 ----a-w- c:\windows\system32\VMPPCN64.DLL
2012-10-21 19:55 . 2011-06-14 19:42 559216 ----a-w- c:\windows\system32\VIASysFx.dll
2012-10-20 13:12 . 2009-04-30 10:46 899584 ----a-w- c:\windows\system32\fdco1.dll
2012-10-04 16:40 . 2012-12-12 22:53 44032 ----a-w- c:\windows\apppatch\acwow64.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"XFastUSB"="c:\program files (x86)\XFastUSB\XFastUsb.exe" [2012-10-22 5019360]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-14 384800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-12-24 32320]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]
S1 aswKbd;aswKbd; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-10-22 15936]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-14 85280]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-05-14 4901888]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2012-10-21 27760]
S3 AsrOcDrv;AsrOcDrv;c:\windows\SysWOW64\Drivers\AsrOcDrv.sys [x]
S3 IesDrv;IesDrv;c:\windows\SysWOW64\Drivers\IesDrv.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-06-14 2159728]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASROCDRV
*NewlyCreated* - IESDRV
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 20:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-10-19 1441152]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = my.daemon-search.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\ASRock Utility\OCTuner\ASROC.exe
c:\program files (x86)\ASRock Utility\IES\AsrIes.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
.
**************************************************************************
.
Celkový čas: 2012-12-30 23:01:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-12-30 22:00
ComboFix2.txt 2012-12-30 21:00
ComboFix3.txt 2012-12-30 17:21
.
Před spuštěním: Volných bajtů: 432 537 309 184
Po spuštění: Volných bajtů: 432 482 451 456
.
- - End Of File - - 28668A6B50F1972A8EA7A2FE65C4B88C

Re: řešení problému

Napsal: 31 pro 2012 09:03
od Rudy
Log je OK.

Re: řešení problému

Napsal: 31 pro 2012 10:05
od povison
Tak to je super, sice nevím co je to log, kromě toho že to vygeneroval váš program, ale doufám, že už budu mít klid. Moc vám děkuju. A ještě, dá se těmhle útokům předcházet?
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz