VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

prosím o kontrolu

https://forum.viry.cz:443/viewtopic.php?t=131320

Stránka 1 z 1

prosím o kontrolu

Napsal: 06 črc 2013 10:34
od nlc_nlc
Při kontrole Combofix našel Dvbpws.dll. Prosím o kontrolu logu:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Doma at 2013-07-06 11:25:23
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 63 GB (62%) free of 101 GB
Total RAM: 3325 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:25:26, on 6.7.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16611)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
D:\Program Files\Kies\KiesTrayAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
D:\Program Files\FlashGet Network\FlashGet 3\Flashget3.exe
D:\Program Files\Kies\Kies.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
d:\Program Files\DAEMON Tools Lite\DTShellHlp.exe
D:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\notepad.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinFast\WFDTV\DVBTAP.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Doma\Desktop\RSIT.exe
C:\Program Files\trend micro\Doma.exe
C:\Windows\system32\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Doma\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [KiesTrayAgent] D:\Program Files\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKCU\..\Run: [FlashGet 3] "d:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" -minimize
O4 - HKCU\..\Run: [KiesPreload] D:\Program Files\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [KiesAirMessage] D:\Program Files\Kies\KiesAirMessage.exe -startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: Download all links by FlashGet3 - d:\Program Files\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm
O8 - Extra context menu item: Download by FlashGet3 - d:\Program Files\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
O23 - Service: AODService - Unknown owner - D:\Program Files\AMD\OverDrive\AODAssist.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON V5 Service4(04) (EPSON_EB_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - d:\Program Files\SiSoftware Sandra Lite 2012.SP2\RpcAgentSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7266 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\zx9hrupn.default-1361980948369

prefs.js - "browser.startup.homepage" - "www.google.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-06-12 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-06-22 192592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0}]
FlashGetBHO - C:\Users\Doma\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll [2012-01-06 149128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-06-12 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-06-22 192592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2013-01-31 103424]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-10-11 59280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2012-10-25 421888]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-12-19 642808]
"KiesTrayAgent"=D:\Program Files\Kies\KiesTrayAgent.exe [2013-03-28 310640]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2012-10-26 11680400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-01-01 39408]
"WinFast Schedule"=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2013-01-09 2916352]
"FlashGet 3"=d:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe [2012-03-15 3090056]
"KiesPreload"=D:\Program Files\Kies\Kies.exe [2013-03-28 1511792]
"KiesAirMessage"=D:\Program Files\Kies\KiesAirMessage.exe [2013-03-20 578560]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-03-14 3672640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"d:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="d:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave6"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux5"=wdmaud.drv
"wave7"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux6"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux4"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2013-07-06 11:25:23 ----D---- C:\rsit
2013-07-06 11:25:23 ----D---- C:\Program Files\trend micro
2013-07-06 09:22:46 ----SHD---- C:\$RECYCLE.BIN
2013-07-06 09:22:44 ----A---- C:\ComboFix.txt
2013-07-03 08:19:35 ----D---- C:\Program Files\Mozilla Firefox
2013-07-02 17:36:13 ----D---- C:\ProgramData\Logs
2013-06-24 19:17:55 ----A---- C:\Windows\zip.exe
2013-06-24 19:17:55 ----A---- C:\Windows\SWSC.exe
2013-06-24 19:17:55 ----A---- C:\Windows\SWREG.exe
2013-06-24 19:17:55 ----A---- C:\Windows\sed.exe
2013-06-24 19:17:55 ----A---- C:\Windows\PEV.exe
2013-06-24 19:17:55 ----A---- C:\Windows\NIRCMD.exe
2013-06-24 19:17:55 ----A---- C:\Windows\MBR.exe
2013-06-24 19:17:55 ----A---- C:\Windows\grep.exe
2013-06-24 19:17:49 ----D---- C:\Qoobox
2013-06-24 19:17:31 ----D---- C:\Windows\erdnt
2013-06-24 19:16:53 ----D---- C:\Users\Doma\AppData\Roaming\GetRightToGo
2013-06-24 17:14:59 ----A---- C:\Windows\graphedt_x86_20090713.INI
2013-06-24 05:25:29 ----D---- C:\Windows\pss
2013-06-21 20:21:08 ----A---- C:\Windows\system32\javaws.exe
2013-06-21 20:21:06 ----A---- C:\Windows\system32\WindowsAccessBridge.dll
2013-06-21 20:21:06 ----A---- C:\Windows\system32\javaw.exe
2013-06-21 20:21:06 ----A---- C:\Windows\system32\java.exe
2013-06-12 05:40:25 ----A---- C:\Windows\system32\urlmon.dll
2013-06-12 05:40:25 ----A---- C:\Windows\system32\ieui.dll
2013-06-12 05:40:24 ----A---- C:\Windows\system32\ieframe.dll
2013-06-12 05:40:23 ----A---- C:\Windows\system32\mshtml.dll
2013-06-12 05:40:23 ----A---- C:\Windows\system32\iertutil.dll
2013-06-12 05:38:47 ----A---- C:\Windows\system32\jscript.dll
2013-06-12 05:38:46 ----A---- C:\Windows\system32\jsproxy.dll
2013-06-12 05:38:46 ----A---- C:\Windows\system32\jscript9.dll
2013-06-12 05:38:46 ----A---- C:\Windows\system32\iesetup.dll
2013-06-12 05:38:45 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-12 05:38:45 ----A---- C:\Windows\system32\msfeeds.dll
2013-06-12 05:38:45 ----A---- C:\Windows\system32\iesysprep.dll
2013-06-12 05:38:45 ----A---- C:\Windows\system32\iernonce.dll
2013-06-12 05:38:45 ----A---- C:\Windows\system32\ie4uinit.exe
2013-06-12 05:38:44 ----A---- C:\Windows\system32\wininet.dll
2013-06-12 05:29:16 ----A---- C:\Windows\system32\d3d11.dll
2013-06-12 05:29:13 ----A---- C:\Windows\system32\cryptdlg.dll
2013-06-12 05:29:12 ----A---- C:\Windows\system32\win32spl.dll
2013-06-12 05:29:11 ----A---- C:\Windows\system32\crypt32.dll
2013-06-12 05:29:11 ----A---- C:\Windows\system32\certutil.exe
2013-06-12 05:29:10 ----A---- C:\Windows\system32\cryptsvc.dll
2013-06-12 05:29:10 ----A---- C:\Windows\system32\cryptnet.dll
2013-06-12 05:29:10 ----A---- C:\Windows\system32\certenc.dll
2013-06-12 05:29:08 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-06-12 05:29:07 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-06-12 05:29:07 ----A---- C:\Windows\system32\ntkrnlpa.exe
2013-06-12 05:29:05 ----A---- C:\Windows\system32\drivers\tcpip.sys

======List of files/folders modified in the last 1 month======

2013-07-06 11:25:25 ----D---- C:\Windows\Temp
2013-07-06 11:25:23 ----RD---- C:\Program Files
2013-07-06 11:24:13 ----D---- C:\Users\Doma\AppData\Roaming\uTorrent
2013-07-06 09:21:23 ----D---- C:\Windows
2013-07-06 09:21:23 ----A---- C:\Windows\system.ini
2013-07-06 09:21:19 ----D---- C:\Windows\system32\drivers\etc
2013-07-06 09:20:58 ----D---- C:\Windows\System32
2013-07-06 09:19:40 ----D---- C:\Windows\system32\drivers
2013-07-06 09:19:40 ----D---- C:\Windows\AppPatch
2013-07-06 09:19:39 ----D---- C:\Program Files\Common Files
2013-07-06 09:17:41 ----SHD---- C:\System Volume Information
2013-07-06 07:08:15 ----D---- C:\Windows\system32\config
2013-07-05 19:14:24 ----D---- C:\Windows\Prefetch
2013-07-05 18:27:01 ----SHD---- C:\Windows\Installer
2013-07-05 18:27:01 ----D---- C:\Config.Msi
2013-07-05 06:49:51 ----D---- C:\Windows\inf
2013-07-05 06:49:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-07-04 15:10:54 ----D---- C:\Windows\system32\catroot2
2013-07-04 05:21:44 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-07-02 17:38:38 ----D---- C:\Windows\system32\Tasks
2013-07-02 17:36:26 ----AD---- C:\ProgramData\TEMP
2013-07-02 17:36:13 ----D---- C:\ProgramData
2013-06-26 10:07:35 ----RSD---- C:\Windows\assembly
2013-06-26 10:07:35 ----D---- C:\Windows\Microsoft.NET
2013-06-25 21:12:23 ----D---- C:\Windows\winsxs
2013-06-25 19:52:44 ----D---- C:\Windows\system32\catroot
2013-06-24 17:14:52 ----A---- C:\Windows\win.ini
2013-06-23 15:18:55 ----D---- C:\Windows\system32\drivers\UMDF
2013-06-21 20:21:06 ----D---- C:\Program Files\Java
2013-06-18 17:29:08 ----D---- C:\Program Files\HD Tune Pro
2013-06-18 14:01:01 ----D---- C:\Windows\rescache
2013-06-17 16:47:27 ----HD---- C:\Program Files\InstallShield Installation Information
2013-06-12 21:48:23 ----A---- C:\Windows\system32\npdeployJava1.dll
2013-06-12 21:48:17 ----A---- C:\Windows\system32\deployJava1.dll
2013-06-12 20:04:07 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-06-12 18:45:30 ----D---- C:\Windows\system32\cs-CZ
2013-06-12 18:45:30 ----D---- C:\Program Files\Internet Explorer
2013-06-12 05:39:10 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-04 14392]
R0 giveio;giveio; C:\Windows\system32\giveio.sys [1996-04-03 5248]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 speedfan;speedfan; C:\Windows\system32\speedfan.sys [2012-12-29 24184]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 wfcxacap;WinFast TV PCI Audio Capture Driver; C:\Windows\system32\DRIVERS\wfcxacap.sys [2007-09-19 9856]
R2 AODDriver4.2.0;AODDriver4.2.0; \??\D:\Program Files\AMD\OverDrive\i386\AODDriver2.sys [2013-02-06 49248]
R2 AODDriver4.2;AODDriver4.2; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-04-09 48256]
R2 cpuz135;cpuz135; \??\C:\Windows\system32\drivers\cpuz135_x32.sys [2011-09-21 21992]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2010-12-14 27648]
R2 wfcxatun;WinFast TV Analog Tuner Driver; C:\Windows\system32\drivers\wfcxatun.sys [2007-09-19 31744]
R2 WFCXVCAP;WinFast TV Video Capture Driver; C:\Windows\system32\drivers\wfcxvcap.sys [2007-09-19 167040]
R3 actser;actser; C:\Windows\system32\drivers\actser.sys [2006-02-17 29184]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-12-19 9647104]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-12-19 442368]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2012-11-06 84992]
R3 catchme;catchme; \??\C:\Users\Doma\AppData\Local\Temp\catchme.sys []
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-04-25 242240]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2012-10-30 3340880]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver; C:\Windows\system32\drivers\wfcxdtun.sys [2007-09-19 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver; C:\Windows\system32\drivers\wfcxtcap.sys [2007-09-19 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver; C:\Windows\system32\drivers\wfcxxbar.sys [2007-09-19 10496]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 amdiox86;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox86.sys []
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2013-02-22 32064]
S3 AODDriver;AODDriver; \??\C:\Program Files\GIGABYTE\ET6\i386\AODDriver.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-12-19 9647104]
S3 atillk64;atillk64; \??\D:\Program Files\AMD\System Monitor\atillk64.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 cpuz130;cpuz130; \??\C:\Users\Doma\AppData\Local\Temp\cpuz130\cpuz_x32.sys []
S3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2013-06-18 17488]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2013-06-18 17488]
S3 GPU-Z;GPU-Z; \??\C:\Users\Doma\AppData\Local\Temp\GPU-Z.sys []
S3 GVTDrv;GVTDrv; \??\C:\Windows\system32\Drivers\GVTDrv.sys [2013-06-18 24944]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2); C:\Windows\system32\DRIVERS\RtVlan60.sys [2010-12-14 19968]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 SANDRA;SANDRA; \??\d:\Program Files\SiSoftware Sandra Lite 2012.SP2\WNt500x86\Sandra.sys [2009-08-07 23112]
S3 Ser2pl;SIEMENS USB Data Cable Driver; C:\Windows\system32\DRIVERS\ser2pl.sys [2002-11-14 40704]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2013-02-22 136904]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2013-02-22 17864]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2013-02-22 153672]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2013-02-22 130248]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2013-02-22 136776]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2013-02-22 17864]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2013-02-22 153672]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0); C:\Windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2); C:\Windows\system32\DRIVERS\RtVLAN60.sys [2010-12-14 19968]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S4 RsFx0103;RsFx0103 Driver; C:\Windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-12-19 219136]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 291840]
R2 AMD_RAIDXpert;AMD RAIDXpert; C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-09-19 122880]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04); C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2013-04-20 153600]
R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04); C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2013-04-20 121856]
R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [2006-12-19 94208]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [2009-03-30 43010392]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-07-10 98840]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
S2 AODService;AODService; D:\Program Files\AMD\OverDrive\AODAssist.exe [2013-02-06 137096]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-01 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12 256904]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-01 136176]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-21 194032]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2011-08-30 160256]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-07-03 117144]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service; d:\Program Files\SiSoftware Sandra Lite 2012.SP2\RpcAgentSrv.exe [2009-02-04 95896]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-01-01 1343400]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2009-03-30 254808]

-----------------EOF-----------------

Re: prosím o kontrolu

Napsal: 06 črc 2013 10:37
od vyosek
Zdravim :)


:arrow: Co se tyce ComboFixu, ktery jste pouzil, tak na zaklade licence a pravidel fora ptam, umite s nim pracovat (spusteni, rozlusteni logu, napsani skriptu)?

:arrow: licencni podminky hovori jasne "Nikdy by nemel byt pouzit v prostredi bez dozoru zkusene osoby"
Obrázek

:arrow: Nebezpeci CFka
  • Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
  • Maze stopy po haveti, takze v logu z RSIT neni nic videt
  • Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
  • CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
  • CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal
:arrow: Dejte mi sem jeho log c:\combofix.txt

Re: prosím o kontrolu

Napsal: 06 črc 2013 10:47
od nlc_nlc
Díky za odpověď. Připouštím, že jsem ComboFix spustil ukvapeně, už se to nestane.

ComboFix 13-07-06.02 - Doma 06.07.2013 9:17.2.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3325.2215 [GMT 2:00]
Spuštěný z: c:\users\Doma\Desktop\ativir\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Dvbpws.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-06 do 2013-07-06 )))))))))))))))))))))))))))))))
.
.
2013-07-06 07:21 . 2013-07-06 07:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-03 03:37 . 2013-06-12 04:18 7068072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB8FDED4-2FF0-4466-B00E-1D6F1BF898D1}\mpengine.dll
2013-07-02 15:36 . 2013-07-02 15:36 -------- d-----w- c:\programdata\Logs
2013-06-24 17:16 . 2013-06-24 17:17 -------- d-----w- c:\users\Doma\AppData\Roaming\GetRightToGo
2013-06-21 18:21 . 2013-06-12 19:48 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-06-12 03:40 . 2013-06-08 11:41 218112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2013-06-12 03:40 . 2013-06-08 11:13 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-06-12 03:29 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\system32\d3d11.dll
2013-06-12 03:29 . 2013-05-10 03:20 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-06-12 03:29 . 2013-04-26 04:55 492544 ----a-w- c:\windows\system32\win32spl.dll
2013-06-12 03:29 . 2013-05-13 04:45 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-06-12 03:29 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2013-06-12 03:29 . 2013-05-13 04:45 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-06-12 03:29 . 2013-05-13 04:45 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-06-12 03:29 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2013-06-12 03:29 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-06-12 03:29 . 2013-05-06 05:06 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-12 03:29 . 2013-05-06 05:06 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-06-12 03:29 . 2013-05-08 05:38 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-18 15:22 . 2008-01-01 00:47 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2013-06-18 15:22 . 2012-02-17 18:42 17488 ----a-w- c:\windows\gdrv.sys
2013-06-18 03:17 . 2013-03-09 12:27 17488 ----a-w- c:\windows\etdrv.sys
2013-06-12 19:48 . 2012-09-04 15:07 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-06-12 19:48 . 2012-02-18 16:57 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-12 18:04 . 2012-05-19 08:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 18:04 . 2010-01-01 00:26 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-31 03:21 . 2013-05-31 03:21 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-05-31 03:21 . 2013-05-31 03:21 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-05-09 11:16 . 2013-05-09 11:16 119808 ----a-r- c:\users\Doma\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2013-05-02 00:06 . 2012-02-18 08:17 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-30 03:33 . 2013-04-30 03:33 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 03:33 . 2013-04-30 03:33 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-04-30 03:33 . 2013-04-30 03:33 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 03:33 . 2013-04-30 03:33 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-30 03:33 . 2013-04-30 03:33 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-04-30 03:33 . 2013-04-30 03:33 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-04-30 03:33 . 2013-04-30 03:33 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-30 03:33 . 2013-04-30 03:33 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-04-30 03:33 . 2013-04-30 03:33 361984 ----a-w- c:\windows\system32\html.iec
2013-04-30 03:33 . 2013-04-30 03:33 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-30 03:33 . 2013-04-30 03:33 158720 ----a-w- c:\windows\system32\msls31.dll
2013-04-30 03:33 . 2013-04-30 03:33 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-04-30 03:33 . 2013-04-30 03:33 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-30 03:33 . 2013-04-30 03:33 138752 ----a-w- c:\windows\system32\wextract.exe
2013-04-30 03:33 . 2013-04-30 03:33 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-30 03:33 . 2013-04-30 03:33 12800 ----a-w- c:\windows\system32\mshta.exe
2013-04-30 03:33 . 2013-04-30 03:33 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-25 14:11 . 2013-04-25 14:11 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-04-20 07:40 . 2013-04-20 07:42 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2013-04-20 07:40 . 2013-04-20 07:42 63488 ----a-w- c:\windows\system32\E_FD4BGCE.DLL
2013-04-19 11:14 . 2013-06-04 08:05 139264 ----a-w- c:\windows\system32\bzpdfc.dll
2013-04-19 11:14 . 2013-06-04 08:05 200192 ----a-w- c:\windows\system32\bzpdf.dll
2013-04-13 04:45 . 2013-05-15 03:27 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 03:27 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-24 03:21 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:18 . 2013-05-15 03:27 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 05:18 . 2013-05-15 03:27 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 03:14 . 2013-05-15 03:27 2347520 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-01 39408]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2013-01-09 2916352]
"FlashGet 3"="d:\program files\FlashGet Network\FlashGet 3\FlashGet3.exe" [2012-03-15 3090056]
"KiesPreload"="d:\program files\Kies\Kies.exe" [2013-03-28 1511792]
"KiesAirMessage"="d:\program files\Kies\KiesAirMessage.exe" [2013-03-20 578560]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2013-01-31 103424]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"KiesTrayAgent"="d:\program files\Kies\KiesTrayAgent.exe" [2013-03-28 310640]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-10-26 11680400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AODService;AODService;d:\program files\AMD\OverDrive\AODAssist.exe [2013-02-06 137096]
R3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2013-02-22 32064]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [x]
R3 atillk64;atillk64;d:\program files\AMD\System Monitor\atillk64.sys [x]
R3 cpuz130;cpuz130;c:\users\Doma\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2013-06-18 17488]
R3 GPU-Z;GPU-Z;c:\users\Doma\AppData\Local\Temp\GPU-Z.sys [x]
R3 GVTDrv;GVTDrv;c:\windows\system32\Drivers\GVTDrv.sys [2013-06-18 24944]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2011-08-30 160256]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-12-14 19968]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware Sandra Lite 2012.SP2\RpcAgentSrv.exe [2009-02-03 95896]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2013-02-22 136904]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2013-02-22 17864]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2013-02-22 153672]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2013-02-22 130248]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys [2010-12-14 19968]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-01-01 1343400]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S1 wfcxacap;WinFast TV PCI Audio Capture Driver;c:\windows\system32\DRIVERS\wfcxacap.sys [2007-09-19 9856]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 219136]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 291840]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-09-19 122880]
S2 AODDriver4.2.0;AODDriver4.2.0;d:\program files\AMD\OverDrive\i386\AODDriver2.sys [2013-02-06 49248]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-04-09 48256]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-09-21 21992]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2013-04-20 153600]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2013-04-20 121856]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-12-14 27648]
S2 wfcxatun;WinFast TV Analog Tuner Driver;c:\windows\system32\drivers\wfcxatun.sys [2007-09-19 31744]
S2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\system32\drivers\wfcxvcap.sys [2007-09-19 167040]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-11-06 84992]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-04-25 242240]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
S3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\system32\drivers\wfcxdtun.sys [2007-09-19 21248]
S3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\system32\drivers\wfcxtcap.sys [2007-09-19 15872]
S3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\system32\drivers\wfcxxbar.sys [2007-09-19 10496]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-19 18:04]
.
2013-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-01 00:26]
.
2013-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-01 00:26]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Download all links by FlashGet3 - d:\program files\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm
IE: Download by FlashGet3 - d:\program files\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\zx9hrupn.default-1361980948369\
FF - prefs.js: browser.startup.homepage - www.google.com
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-07-06 09:22:43
ComboFix-quarantined-files.txt 2013-07-06 07:22
ComboFix2.txt 2013-06-24 17:28
.
Před spuštěním: Volných bajtů: 64 250 802 176
Po spuštění: Volných bajtů: 65 396 170 752
.
- - End Of File - - 6FA335619A7FD8134302931C8C6D766B
A36C5E4F47E84449FF07ED3517B43A31

Re: prosím o kontrolu

Napsal: 07 črc 2013 07:10
od vyosek
Je s PC nejaky jiny problem :???:

Re: prosím o kontrolu

Napsal: 07 črc 2013 07:40
od nlc_nlc
S PC jiný problém není. Ten ComboFix jsem pustil preventivně, i když teď vím, že jsem neměl.

Re: prosím o kontrolu

Napsal: 08 črc 2013 12:35
od vyosek
Poprosim o log z DDS http://forum.viry.cz/viewtopic.php?f=30&t=125172

Re: prosím o kontrolu

Napsal: 08 črc 2013 15:54
od nlc_nlc
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 10.0.9200.16611 BrowserJavaVersion: 10.25.2
Run by Doma at 16:50:12 on 2013-07-08
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3325.1933 [GMT 2:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
D:\Program Files\Kies\KiesTrayAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
D:\Program Files\FlashGet Network\FlashGet 3\Flashget3.exe
D:\Program Files\Kies\Kies.exe
d:\Program Files\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\WinMsgBalloonServer.exe
C:\Windows\system32\WinMsgBalloonClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Program Files\WinFast\WFDTV\DVBTAP.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.cz/
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: FlashGetBHO: {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - c:\users\doma\appdata\roaming\flashgetbho\FlashGetBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WinFast Schedule] c:\program files\winfast\wfdtv\WFWIZ.exe
uRun: [FlashGet 3] "d:\program files\flashget network\flashget 3\FlashGet3.exe" -minimize
uRun: [KiesPreload] d:\program files\kies\Kies.exe /preload
uRun: [KiesAirMessage] d:\program files\kies\KiesAirMessage.exe -startup
uRun: [DAEMON Tools Lite] "d:\program files\daemon tools lite\DTLite.exe" -autorun
mRun: [WinFastDTV] c:\program files\winfast\wfdtv\DTVSchdl.exe
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [KiesTrayAgent] d:\program files\kies\KiesTrayAgent.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Download all links by FlashGet3 - d:\program files\flashget network\flashget 3\bho\fdgetallurl.htm
IE: Download by FlashGet3 - d:\program files\flashget network\flashget 3\bho\fdgeturl.htm
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{3DA5214B-1B84-41E6-8679-D7507684EE43} : DHCPNameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{A4BEDDDD-C69F-482E-AB3F-BFD5B1CD5F3C} : DHCPNameServer = 213.46.172.36 213.46.172.37
SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\doma\appdata\roaming\mozilla\firefox\profiles\zx9hrupn.default-1361980948369\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.149\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 wfcxacap;WinFast TV PCI Audio Capture Driver;c:\windows\system32\drivers\wfcxacap.sys [2012-5-19 9856]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 219136]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2012-12-19 291840]
R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\amd\raidxpert\bin\RAIDXpertService.exe [2009-9-19 122880]
R2 AODDriver4.2.0;AODDriver4.2.0;d:\program files\amd\overdrive\i386\AODDriver2.sys [2013-2-6 49248]
R2 AODDriver4.2;AODDriver4.2;c:\program files\ati technologies\ati.ace\fuel\i386\aoddriver2.sys [2012-4-9 48256]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-1-1 21992]
R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\common files\epson\epw!3 ssrp\E_S50ST7.EXE [2013-4-20 153600]
R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\common files\epson\epw!3 ssrp\E_S50RP7.EXE [2013-4-20 121856]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2008-3-14 27648]
R2 wfcxatun;WinFast TV Analog Tuner Driver;c:\windows\system32\drivers\wfcxatun.sys [2012-5-19 31744]
R2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\system32\drivers\wfcxvcap.sys [2012-5-19 167040]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-11-6 84992]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2013-4-25 242240]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2008-3-14 490088]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2008-3-14 27320]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\system32\drivers\wfcxdtun.sys [2012-5-19 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\system32\drivers\wfcxtcap.sys [2012-5-19 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\system32\drivers\wfcxxbar.sys [2012-5-19 10496]
S2 AODService;AODService;d:\program files\amd\overdrive\AODAssist.exe [2013-2-6 137096]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2013-4-3 32064]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 62464]
S3 etdrv;etdrv;c:\windows\etdrv.sys [2013-3-9 17488]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-1-1 24944]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files\intel\intel(r) integrated clock controller service\ICCProxy.exe [2013-3-9 160256]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\drivers\RtTeam60.sys [2008-3-14 50280]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\drivers\RtVlan60.sys [2008-3-14 19968]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\sisoftware sandra lite 2012.sp2\RpcAgentSrv.exe [2010-1-1 95896]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2013-4-3 136904]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2013-4-3 17864]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2013-4-3 153672]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [2013-4-3 130248]
S3 StorSvc;Služba úložiště;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\drivers\RtTeam60.sys [2008-3-14 50280]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\drivers\RtVlan60.sys [2008-3-14 19968]
S3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-1-1 1343400]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-23 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
.
=============== Created Last 30 ================
.
2013-07-07 16:51:37 -------- d-----w- c:\program files\CCleaner
2013-07-06 10:00:42 7068072 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{327d16fb-1b98-47f6-9083-7f3a5d7dea77}\mpengine.dll
2013-07-06 10:00:16 2 ----a-w- c:\windows\system32\Dvbpws.dll
2013-07-06 09:25:23 -------- d-----w- c:\program files\trend micro
2013-07-06 07:22:46 -------- d-sh--w- C:\$RECYCLE.BIN
2013-07-02 15:36:13 -------- d-----w- c:\programdata\Logs
2013-06-24 17:17:55 98816 ----a-w- c:\windows\sed.exe
2013-06-24 17:17:55 256000 ----a-w- c:\windows\PEV.exe
2013-06-24 17:17:55 208896 ----a-w- c:\windows\MBR.exe
2013-06-24 17:16:53 -------- d-----w- c:\users\doma\appdata\roaming\GetRightToGo
2013-06-24 03:25:29 -------- d-----w- c:\windows\pss
2013-06-21 18:21:06 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-06-12 03:40:25 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-06-12 03:40:25 218112 ----a-w- c:\program files\internet explorer\sqmapi.dll
2013-06-12 03:29:16 1505280 ----a-w- c:\windows\system32\d3d11.dll
2013-06-12 03:29:13 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-06-12 03:29:12 492544 ----a-w- c:\windows\system32\win32spl.dll
2013-06-12 03:29:11 903168 ----a-w- c:\windows\system32\certutil.exe
2013-06-12 03:29:11 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-06-12 03:29:10 43008 ----a-w- c:\windows\system32\certenc.dll
2013-06-12 03:29:10 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-06-12 03:29:10 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-06-12 03:29:08 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-06-12 03:29:07 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-12 03:29:07 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-06-12 03:29:05 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
==================== Find3M ====================
.
2013-06-18 15:22:20 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2013-06-18 15:22:18 17488 ----a-w- c:\windows\gdrv.sys
2013-06-18 03:17:48 17488 ----a-w- c:\windows\etdrv.sys
2013-06-12 19:48:23 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-06-12 19:48:17 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-12 18:04:07 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-12 18:04:07 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-17 01:25:57 1767936 ----a-w- c:\windows\system32\wininet.dll
2013-05-17 01:25:27 2877440 ----a-w- c:\windows\system32\jscript9.dll
2013-05-17 01:25:26 61440 ----a-w- c:\windows\system32\iesetup.dll
2013-05-17 01:25:26 109056 ----a-w- c:\windows\system32\iesysprep.dll
2013-05-14 08:40:13 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-05-02 00:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-25 14:11:12 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-04-20 07:40:39 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2013-04-20 07:40:38 63488 ----a-w- c:\windows\system32\E_FD4BGCE.DLL
2013-04-19 11:14:12 200192 ----a-w- c:\windows\system32\bzpdf.dll
2013-04-19 11:14:12 139264 ----a-w- c:\windows\system32\bzpdfc.dll
2013-04-13 04:45:16 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45:15 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45:29 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:18:40 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 05:18:40 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 03:14:06 2347520 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 16:50:20,37 ===============

Re: prosím o kontrolu

Napsal: 08 črc 2013 22:04
od vyosek
:arrow: Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222
  • Provedte aktualizaci
  • Provedte uplny sken - nic nemazte :!:
  • MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Re: prosím o kontrolu

Napsal: 09 črc 2013 17:49
od nlc_nlc
Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2013.07.09.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16618
Doma :: NEW-PC [administrátor]

Ochrana: Povolena

9.7.2013 17:34:31
mbam-log-2013-07-09 (17-34-31).txt

Typ: Kompletní kontrola (C:\|D:\|E:\|F:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 547390
Uplynulý čas: 1 hodin, 13 minut, 1 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Re: prosím o kontrolu

Napsal: 10 črc 2013 21:45
od vyosek
:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
"FlashGet 3"=-
"KiesPreload"=-
"KiesAirMessage"=-
"DAEMON Tools Lite"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=-
"QuickTime Task"=-
"KiesTrayAgent"=-
"SunJavaUpdateSched"=-

File::
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\PCW\Security]

ClearJavaCache::

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Re: prosím o kontrolu

Napsal: 12 črc 2013 15:45
od nlc_nlc
ComboFix 13-07-11.03 - Doma 12.07.2013 16:30:59.3.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3325.2274 [GMT 2:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Doma\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\PFRO.log
c:\windows\system32\Dvbpws.dll
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-12 do 2013-07-12 )))))))))))))))))))))))))))))))
.
.
2013-07-12 14:34 . 2013-07-12 14:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-11 19:24 . 2013-06-12 04:18 7068072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B4400B9-62D1-4D6E-AAE7-824F1401574B}\mpengine.dll
2013-07-11 12:53 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\system32\DWrite.dll
2013-07-11 12:53 . 2013-06-04 04:53 509440 ----a-w- c:\windows\system32\qedit.dll
2013-07-11 12:53 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-11 12:53 . 2013-06-05 03:05 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-07-11 12:53 . 2013-04-10 05:03 936448 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 12:53 . 2013-04-10 05:03 988672 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-07-11 12:53 . 2013-04-10 05:03 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-07-11 12:53 . 2013-04-10 05:04 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-07-11 12:53 . 2013-05-27 04:57 680960 ----a-w- c:\program files\Windows Defender\MpSvc.dll
2013-07-11 12:53 . 2013-05-27 04:57 392704 ----a-w- c:\program files\Windows Defender\MpClient.dll
2013-07-11 12:53 . 2013-05-27 04:57 224768 ----a-w- c:\program files\Windows Defender\MpCommu.dll
2013-07-09 14:14 . 2013-07-09 14:14 -------- d-----w- c:\users\Doma\AppData\Roaming\Malwarebytes
2013-07-09 14:14 . 2013-07-09 14:14 -------- d-----w- c:\programdata\Malwarebytes
2013-07-09 14:14 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-07 16:51 . 2013-07-07 16:51 -------- d-----w- c:\program files\CCleaner
2013-07-06 09:25 . 2013-07-06 09:25 -------- d-----w- C:\rsit
2013-07-06 09:25 . 2013-07-06 09:25 -------- d-----w- c:\program files\trend micro
2013-07-02 15:36 . 2013-07-02 15:36 -------- d-----w- c:\programdata\Logs
2013-06-24 17:16 . 2013-06-24 17:17 -------- d-----w- c:\users\Doma\AppData\Roaming\GetRightToGo
2013-06-21 18:21 . 2013-06-12 19:48 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-18 15:22 . 2008-01-01 00:47 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2013-06-18 15:22 . 2012-02-17 18:42 17488 ----a-w- c:\windows\gdrv.sys
2013-06-18 03:17 . 2013-03-09 12:27 17488 ----a-w- c:\windows\etdrv.sys
2013-06-12 19:48 . 2012-09-04 15:07 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-06-12 19:48 . 2012-02-18 16:57 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-12 18:04 . 2012-05-19 08:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 18:04 . 2010-01-01 00:26 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-31 03:21 . 2013-05-31 03:21 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-05-31 03:21 . 2013-05-31 03:21 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-05-13 04:45 . 2013-06-12 03:29 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 04:45 . 2013-06-12 03:29 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 03:29 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 03:08 . 2013-06-12 03:29 903168 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 03:29 43008 ----a-w- c:\windows\system32\certenc.dll
2013-05-10 03:20 . 2013-06-12 03:29 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-09 11:16 . 2013-05-09 11:16 119808 ----a-r- c:\users\Doma\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2013-05-08 05:38 . 2013-06-12 03:29 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-05-06 05:06 . 2013-06-12 03:29 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-05-06 05:06 . 2013-06-12 03:29 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-02 00:06 . 2012-02-18 08:17 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-30 03:33 . 2013-04-30 03:33 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 03:33 . 2013-04-30 03:33 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-04-30 03:33 . 2013-04-30 03:33 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 03:33 . 2013-04-30 03:33 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-30 03:33 . 2013-04-30 03:33 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-04-30 03:33 . 2013-04-30 03:33 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-04-30 03:33 . 2013-04-30 03:33 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-30 03:33 . 2013-04-30 03:33 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-04-30 03:33 . 2013-04-30 03:33 361984 ----a-w- c:\windows\system32\html.iec
2013-04-30 03:33 . 2013-04-30 03:33 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-30 03:33 . 2013-04-30 03:33 158720 ----a-w- c:\windows\system32\msls31.dll
2013-04-30 03:33 . 2013-04-30 03:33 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-04-30 03:33 . 2013-04-30 03:33 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-30 03:33 . 2013-04-30 03:33 138752 ----a-w- c:\windows\system32\wextract.exe
2013-04-30 03:33 . 2013-04-30 03:33 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-30 03:33 . 2013-04-30 03:33 12800 ----a-w- c:\windows\system32\mshta.exe
2013-04-30 03:33 . 2013-04-30 03:33 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-26 04:55 . 2013-06-12 03:29 492544 ----a-w- c:\windows\system32\win32spl.dll
2013-04-25 23:30 . 2013-06-12 03:29 1505280 ----a-w- c:\windows\system32\d3d11.dll
2013-04-25 14:11 . 2013-04-25 14:11 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-04-20 07:40 . 2013-04-20 07:42 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
2013-04-20 07:40 . 2013-04-20 07:42 63488 ----a-w- c:\windows\system32\E_FD4BGCE.DLL
2013-04-19 11:14 . 2013-06-04 08:05 139264 ----a-w- c:\windows\system32\bzpdfc.dll
2013-04-19 11:14 . 2013-06-04 08:05 200192 ----a-w- c:\windows\system32\bzpdf.dll
2013-04-17 07:02 . 2013-06-12 03:29 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2013-01-09 2916352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2013-01-31 103424]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-10-26 11680400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-10-11 20:56 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 02:12 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-01-01 00:26 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
R2 AODService;AODService;d:\program files\AMD\OverDrive\AODAssist.exe [2013-02-06 137096]
R2 MBAMService;MBAMService;d:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2013-02-22 32064]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [x]
R3 atillk64;atillk64;d:\program files\AMD\System Monitor\atillk64.sys [x]
R3 cpuz130;cpuz130;c:\users\Doma\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2013-06-18 17488]
R3 GPU-Z;GPU-Z;c:\users\Doma\AppData\Local\Temp\GPU-Z.sys [x]
R3 GVTDrv;GVTDrv;c:\windows\system32\Drivers\GVTDrv.sys [2013-06-18 24944]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2011-08-30 160256]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-12-14 19968]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware Sandra Lite 2012.SP2\RpcAgentSrv.exe [2009-02-03 95896]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2013-02-22 136904]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2013-02-22 17864]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2013-02-22 153672]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2013-02-22 130248]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-12-14 50280]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys [2010-12-14 19968]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-01-01 1343400]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S1 wfcxacap;WinFast TV PCI Audio Capture Driver;c:\windows\system32\DRIVERS\wfcxacap.sys [2007-09-19 9856]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 219136]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 291840]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-09-19 122880]
S2 AODDriver4.2.0;AODDriver4.2.0;d:\program files\AMD\OverDrive\i386\AODDriver2.sys [2013-02-06 49248]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-04-09 48256]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-09-21 21992]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2013-04-20 153600]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2013-04-20 121856]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-12-14 27648]
S2 wfcxatun;WinFast TV Analog Tuner Driver;c:\windows\system32\drivers\wfcxatun.sys [2007-09-19 31744]
S2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\system32\drivers\wfcxvcap.sys [2007-09-19 167040]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-11-06 84992]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-04-25 242240]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 27320]
S3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\system32\drivers\wfcxdtun.sys [2007-09-19 21248]
S3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\system32\drivers\wfcxtcap.sys [2007-09-19 15872]
S3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\system32\drivers\wfcxxbar.sys [2007-09-19 10496]
.
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Download all links by FlashGet3 - d:\program files\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm
IE: Download by FlashGet3 - d:\program files\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\zx9hrupn.default-1361980948369\
FF - prefs.js: browser.startup.homepage - www.google.com
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\AMD\RAIDXpert\bin\RAIDXpert.exe
c:\windows\system32\conhost.exe
d:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
d:\program files\DAEMON Tools Lite\DTShellHlp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2013-07-12 16:40:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-12 14:40
ComboFix2.txt 2013-07-06 07:22
ComboFix3.txt 2013-06-24 17:28
.
Před spuštěním: Volných bajtů: 64 927 264 768
Po spuštění: Volných bajtů: 64 880 787 456
.
- - End Of File - - FC45C551D43F81A796E182DAC03A2A00
A36C5E4F47E84449FF07ED3517B43A31

Re: prosím o kontrolu

Napsal: 13 črc 2013 21:50
od vyosek
Tak jeste uklidime :James008:

:arrow: Odinstalujte Combofix
  • Prejmenujte ComboFix na Uninstall
  • Spustte jej
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|

Re: prosím o kontrolu

Napsal: 14 črc 2013 16:53
od nlc_nlc
Vše vykonáno. Velmi děkuji.
Ještě se zeptám, jednalo se o (vážnou) infekci?

Re: prosím o kontrolu

Napsal: 14 črc 2013 23:42
od vyosek
:arrow: Spise jen zbytecnosti

Nemate zac, rad jsem pomohl :worship: Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat :lock:
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz