VIRY.CZ

Zdravím, zkontrolujete mi prosím log? Děkuji.

ComboFix 13-09-23.02 - petrorlet 23.09.2013 21:44:37.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2012.1056 [GMT 2:00]
Spuštěný z: c:\users\petrorlet\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\eliska\AppData\Roaming\msconfig.ini
c:\windows\iun6002.exe
c:\windows\msvcr71.dll
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-23 do 2013-09-23 )))))))))))))))))))))))))))))))
.
.
2013-09-23 20:13 . 2013-09-23 20:25 -------- d-----w- c:\users\petrorlet\AppData\Local\temp
2013-09-23 20:13 . 2013-09-23 20:13 -------- d-----w- c:\users\eliska\AppData\Local\temp
2013-09-23 20:13 . 2013-09-23 20:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-23 18:16 . 2013-09-23 18:16 -------- d-----w- c:\program files\CCleaner
2013-09-23 18:12 . 2013-09-23 19:34 -------- d-----w- c:\users\petrorlet\AppData\Local\Google
2013-09-23 18:12 . 2013-09-23 18:17 -------- d-----w- c:\program files\Google
2013-09-23 17:37 . 2013-09-05 05:02 7328304 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{17C80047-0A16-4560-BE95-858FC8BBBB0F}\mpengine.dll
2013-09-22 09:01 . 2013-09-05 05:02 7328304 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-09-22 08:57 . 2013-08-08 01:45 2049536 ----a-w- c:\windows\system32\win32k.sys
2013-09-15 15:50 . 2013-07-16 04:35 615936 ----a-w- c:\windows\system32\themeui.dll
2013-09-15 15:43 . 2013-09-15 15:29 718712 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{677FCD67-D728-4166-B1AB-016686E0B75A}\gapaengine.dll
2013-09-03 14:23 . 2013-08-02 04:09 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-23 20:25 . 2008-10-12 01:18 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-09-22 08:38 . 2012-10-18 15:13 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-22 08:38 . 2011-07-17 09:35 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-23 17:08 . 2012-10-16 20:54 697992 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-07-17 19:41 . 2013-08-15 13:50 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-10 09:47 . 2013-08-15 13:50 783360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 12:10 . 2013-08-15 13:49 1205168 ----a-w- c:\windows\system32\ntdll.dll
2013-07-08 04:55 . 2013-08-15 13:49 3551680 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-08 04:55 . 2013-08-15 13:49 3603904 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-08 04:20 . 2013-08-15 13:49 172544 ----a-w- c:\windows\system32\wintrust.dll
2013-07-08 04:16 . 2013-08-15 13:49 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-08 04:16 . 2013-08-15 13:49 98304 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-08 04:16 . 2013-08-15 13:49 992768 ----a-w- c:\windows\system32\crypt32.dll
2013-07-05 03:20 . 2013-08-15 13:50 914880 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-07-05 01:43 . 2013-08-15 13:50 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2008-01-23 7766016]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-17 6111232]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2008-02-01 61440]
"CognizanceTS"="c:\progra~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 17920]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2008-01-26 677144]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-02 857648]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2008-10-12 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2008-10-12 33136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-18 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-05-04 1561768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-10 752168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-23 18:17 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-09-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-18 08:38]
.
2013-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-23 18:12]
.
2013-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-23 18:12]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz
Trusted Zone: mojebanka.cz
TCP: DhcpNameServer = 10.0.0.138
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-23 22:27
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3376)
c:\windows\system32\APSHook.dll
c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItClient.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\ASUS\SmartLogon\smartlogon.exe
c:\program files\ATK Hotkey\ASLDRSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\WLANExt.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\System32\IFXTCS.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\IfxPsdSv.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\program files\ATK Hotkey\Hcontrol.exe
c:\program files\ATK Hotkey\MsgTranAgt.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\program files\ASUS\ASUS CopyProtect\aspg.exe
c:\windows\System32\ACEngSvr.exe
c:\windows\system32\conime.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\ATK Hotkey\KBFiltr.exe
c:\program files\ATK Hotkey\WDC.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\WerCon.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2013-09-23 22:32:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-09-23 20:32
.
Před spuštěním: Volných bajtů: 97 207 009 280
Po spuštění: Volných bajtů: 96 902 598 656
.
- - End Of File - - 385CCF9E4B20CCEF1761F2AE36995ACB
64B1E91C5C6C2157642651010728F90F

Zdravim

V prve rade jsem Vam prispevek oddelil, do cizich temat se nevstupuje

Ke ComboFixu, ktery jste pouzil, tak na zaklade licence a pravidel fora ptam, umite s nim pracovat (spusteni, rozlusteni logu, napsani skriptu)?

Licencni podminky ComboFixu hovori jasne "Nikdy by nemel byt pouzit v prostredi bez dozoru zkusene osoby"


Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Jej, pardoon - vypadalo to veřejně
Tak to asi budu muset radši někomu přenechat, aby se na to podíval, protože už si nevím rady
Od doby, co byl noťas napadenej, tak zmizela plocha, nezobrazují se ikony, nic - prostě úplně prázdná plocha... nastavením to není, combofix se zdálo, že problém vyřešil, vše se zobrazilo, jak má, ale po zapnutí druhý den zase jako předtím Děkuji.

Ono si staci cist jen pravidla fora. Proc myslite, ze se jedno z pravidel fora jmenuje Pravidla a skutečnosti - čtěte před položením dotazu http://forum.viry.cz/viewtopic.php?f=12&t=5601

2. Před položením dotazu použijte tlačítko Hledat. Možná již někdo problém podobným Vašemu řešil. Pokud ale ve vyřešeném tématu budou aplikovány různé utility\aplikace, nespouštějte je! Utility se používají až na pokyn rádce, jelikož mohou mazat stopy po havěti a v rukou ne-oborníka může mít jejich použití nedozírné následky.

3. Zvláště utilitu ComboFix nespouštějte i když Vám ji poradil kamarád či nějaký rádoby odborný web. Naše fórum je jediné z CZ\SK antivirových fór, které má právo luštit logy z ComboFixu a máme též plnou podporu autora této utility a přístup k nejaktuálnějším informacím a návodům.

4. Na svůj problém si založte jen jedno téma - založením témat do více sekcí řešení neuspíší, ba naopak problém znepřehledníte a jen přidáte práci rádcům a moderátorům. Taktéž nevkládejte žádost o pomoc do cizího tématu, jen tím uděláte rádci v tématu guláš.

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Aaano, aaano. Polepším se
První log:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.2 (09.22.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by petrorlet on Łt 24.09.2013 at 21:01:48,44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values




~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\genericasktoolbar.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\features\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86d4b82a-abed-442a-be86-96357b70f4fe}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{EA8DA111-CF4D-4932-9838-9F75548D587F}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Successfully deleted: [Registry Key] "hkey_current_user\software\apn"
Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\asktoolbar"
Successfully deleted: [Registry Key] "hkey_current_user\software\ask.com"
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\apn"
Successfully deleted: [Registry Key] "hkey_local_machine\software\asktoolbar"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\appid\{9b0cb95c-933a-4b8c-b6d4-edcd19a43874}"



~~~ Files

Successfully deleted: [File] "C:\Windows\System32\Tasks\scheduled update for ask toolbar"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ask"
Successfully deleted: [Folder] "C:\Users\petrorlet\appdata\locallow\asktoolbar"
Successfully deleted: [Folder] "C:\Program Files\ask.com"
Successfully deleted: [Folder] "C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 24.09.2013 at 21:09:17,00
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A druhý:

# AdwCleaner v3.005 - Report created 24/09/2013 at 21:22:19
# Updated 22/09/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : petrorlet - PETRORLET-PC
# Running from : C:\Users\petrorlet\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\eliska\AppData\LocalLow\AskToolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C5053CD6-D577-4148-8DC0-2580A23B6051}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C5053CD6-D577-4148-8DC0-2580A23B6051}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Key Deleted : HKLM\Software\DeviceVM
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Product Deleted : Ask Toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16506

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Google Chrome v29.0.1547.76

[ File : C:\Users\petrorlet\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2301 octets] - [24/09/2013 21:20:58]
AdwCleaner[S0].txt - [2091 octets] - [24/09/2013 21:22:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2151 octets] ##########

Pokracujte AdwCleanerem

# AdwCleaner v3.005 - Report created 24/09/2013 at 21:22:19
# Updated 22/09/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : petrorlet - PETRORLET-PC
# Running from : C:\Users\petrorlet\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\eliska\AppData\LocalLow\AskToolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C5053CD6-D577-4148-8DC0-2580A23B6051}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C5053CD6-D577-4148-8DC0-2580A23B6051}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Key Deleted : HKLM\Software\DeviceVM
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Product Deleted : Ask Toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16506

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Google Chrome v29.0.1547.76

[ File : C:\Users\petrorlet\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2301 octets] - [24/09/2013 21:20:58]
AdwCleaner[S0].txt - [2091 octets] - [24/09/2013 21:22:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2151 octets] ##########

Needitujte prispevky, ja si toho nevsimnu, jelikoz edit se nezobrazuje jako novy prispevek

Stahnete FRST 32-bit version z teto stranky http://www.bleepingcomputer.com/downloa ... scan-tool/

Spuštění FRST

• Po spuštění FRST odsouhlasíme licenční podmínky kliknutím na [Ano].
• Dooznačíme položku Addition.txt - viz obrázek.
  
• Klikneme na tlačítko [Scan], čímž spustíme skenování.
• Počkáme na dokončení skenování FRST
• Otevře se nám textový soubor FRST.txt, což je požadovaný log a jehož obsah vložíme do svého tématu na fóru.
• Na ploše nám zbyde utilita FRST a dva logy - FRST.txt a Addition.txt - nic z toho zatím nemažeme!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-09-2013
Ran by petrorlet (administrator) on PETRORLET-PC on 25-09-2013 21:29:25
Running from C:\Users\petrorlet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KY2PJ6JF
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Czech
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
() C:\Program Files\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Broadcom Corporation.) c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Infineon Technologies AG) C:\Windows\system32\ifxspmgt.exe
(Infineon Technologies AG) C:\Windows\System32\IFXTCS.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Infineon Technologies AG) C:\Windows\system32\IfxPsdSv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
(Cognizance Corporation) c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
(ATK0100) C:\Program Files\ATK Hotkey\Hcontrol.exe
() C:\Program Files\ATKOSD2\ATKOSD2.exe
() C:\Program Files\ATK Hotkey\MsgTranAgt.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(Motorola Inc.) C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
() C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
() C:\Program Files\ASUS\ATK Media\DMedia.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\ATK Hotkey\ATKOSD.exe
() C:\Windows\ASScrPro.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files\ATK Hotkey\KBFiltr.exe
() C:\Program Files\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
(Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\SpTna.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_175_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ATKOSD2] - C:\Program Files\ATKOSD2\ATKOSD2.exe [7766016 2008-01-24] ()
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6111232 2008-04-17] (Realtek Semiconductor)
HKLM\...\Run: [SMSERIAL] - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [1466368 2009-05-05] (Motorola Inc.)
HKLM\...\Run: [ATKMEDIA] - C:\Program Files\ASUS\ATK Media\DMEDIA.EXE [61440 2008-02-01] ()
HKLM\...\Run: [CognizanceTS] - rundll32.exe c:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
HKLM\...\Run: [IFXSPMGT] - C:\Windows\system32\ifxspmgt.exe [677144 2008-01-26] (Infineon Technologies AG)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-02] (Synaptics, Inc.)
HKLM\...\Run: [ASUS Camera ScreenSaver] - C:\Windows\ASScrProlog.exe [37232 2008-10-12] ()
HKLM\...\Run: [ASUS Screen Saver Protector] - C:\Windows\ASScrPro.exe [33136 2008-10-12] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)
HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [104936 2008-07-18] (CyberLink)
HKLM\...\Run: [P2Go_Menu] - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5078504 2013-03-21] (ESET)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\eliska\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-06-09] (Hewlett-Packard Company)
HKU\eliska\...\Run: [Seznam Postak] - C:\Users\eliska\AppData\Local\Seznam.cz\postak.exe [ 2009-11-02] ()
HKU\eliska\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)
HKU\eliska\...\Run: [Badoo Desktop] - C:\ProgramData\Badoo\Badoo Desktop\1.6.55.1183\Badoo.Desktop.exe
HKU\eliska\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-21] (Microsoft Corporation)
HKU\eliska\...\Winlogon: [Shell] explorer.exe <==== ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
Winsock: Catalog5 02 %SystemRoot%\system32\napinsp.dll [50176] (Společnost Microsoft)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Extension: (Chrome In-App Payments service) - C:\Users\PETROR~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

========================== Services (Whitelisted) =================

R2 ASBroker; c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll [74240 2007-02-07] (Cognizance Corporation)
R2 ASChannel; c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsChnl.dll [131584 2006-06-22] (Cognizance Corporation)
R2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-10-03] ()
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1341664 2013-03-21] (ESET)
R2 IFXSpMgtSrv; C:\Windows\system32\ifxspmgt.exe [677144 2008-01-26] (Infineon Technologies AG)
R2 IFXTCS; C:\Windows\System32\IFXTCS.exe [886040 2008-01-26] (Infineon Technologies AG)
R2 PersonalSecureDriveService; C:\Windows\system32\IfxPsdSv.exe [140568 2007-07-24] (Infineon Technologies AG)
R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()

==================== Drivers (Whitelisted) ====================

R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146824 2007-06-17] (AuthenTec, Inc.)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2010-06-22] (Avanquest Software)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [171680 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [122240 2013-01-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [105760 2013-01-10] (ESET)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [190424 2009-04-11] (Společnost Microsoft)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
S3 Huawei; C:\Windows\System32\DRIVERS\ewdcsc.sys [23424 2009-12-15] (Huawei Tech. Co., Ltd.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [5632 2007-01-25] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2007-09-27] (Windows (R) Codename Longhorn DDK provider)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-15] (ATK0100)
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1082232 2013-03-03] (Společnost Microsoft)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [38816 2007-07-24] (Infineon Technologies AG)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1769984 2007-10-02] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [112640 2009-12-15] (Huawei Technologies Co., Ltd.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S1 MpKslc94990f9; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{17C80047-0A16-4560-BE95-858FC8BBBB0F}\MpKslc94990f9.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 WZCSVC;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-25 21:29 - 2013-09-25 21:29 - 00000000 ____D C:\FRST
2013-09-24 21:20 - 2013-09-24 21:22 - 00000000 ____D C:\AdwCleaner
2013-09-24 21:20 - 2013-09-24 21:20 - 01042066 _____ C:\Users\petrorlet\Desktop\adwcleaner.exe
2013-09-24 21:09 - 2013-09-24 21:09 - 00003158 _____ C:\Users\petrorlet\Desktop\JRT.txt
2013-09-24 20:54 - 2013-09-24 20:54 - 01030038 _____ (Thisisu) C:\Users\petrorlet\Desktop\JRT.exe
2013-09-24 20:54 - 2013-09-24 20:54 - 00000000 ____D C:\Windows\ERUNT
2013-09-24 17:52 - 2013-09-24 17:52 - 00000000 ____D C:\ProgramData\ESET
2013-09-24 17:52 - 2013-09-24 17:52 - 00000000 ____D C:\Program Files\ESET
2013-09-24 17:26 - 2013-09-24 17:26 - 00000000 ____D C:\Windows\Temp51237310-DE76-E3D3-9363-0B8DFC61244F-Signatures
2013-09-23 22:32 - 2013-09-23 22:32 - 00012806 _____ C:\ComboFix.txt
2013-09-23 21:41 - 2013-09-23 22:40 - 00000000 ____D C:\ComboFix
2013-09-23 21:41 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-23 21:41 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-23 21:41 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-23 21:41 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-23 21:41 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-23 21:41 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-23 21:41 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-23 21:41 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-23 21:32 - 2013-09-23 22:40 - 00000000 ____D C:\Qoobox
2013-09-23 21:32 - 2013-09-23 22:29 - 00000000 ____D C:\Windows\erdnt
2013-09-23 21:30 - 2013-09-23 21:31 - 05129279 ____R (Swearware) C:\Users\petrorlet\Desktop\ComboFix.exe
2013-09-23 20:31 - 2013-09-23 20:31 - 00002673 _____ C:\Users\petrorlet\Desktop\Microsoft Office Word 2003 (2).lnk
2013-09-23 20:18 - 2013-09-23 20:18 - 00001978 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-23 20:16 - 2013-09-23 20:16 - 00000811 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 20:16 - 2013-09-23 20:16 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 20:14 - 2013-09-23 20:14 - 00000000 ____D C:\ProgramData\Google
2013-09-23 20:13 - 2013-09-25 21:24 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-23 20:13 - 2013-09-25 20:56 - 00000942 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-23 20:12 - 2013-09-23 21:34 - 00000000 ____D C:\Users\petrorlet\AppData\Local\Google
2013-09-23 20:12 - 2013-09-23 20:17 - 00000000 ____D C:\Program Files\Google
2013-09-23 19:27 - 2013-09-23 19:27 - 00001804 _____ C:\Users\petrorlet\Desktop\Adobe Reader 8.lnk
2013-09-22 10:57 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-16 03:09 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 03:09 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 03:09 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 03:09 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 03:09 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-16 03:09 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 03:09 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-16 03:09 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 03:09 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 03:09 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-16 03:09 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-16 03:09 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 03:09 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 03:09 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 03:09 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-16 03:09 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-15 17:50 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-03 16:23 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

==================== One Month Modified Files and Folders =======

2013-09-25 21:29 - 2013-09-25 21:29 - 00000000 ____D C:\FRST
2013-09-25 21:24 - 2013-09-23 20:13 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-25 21:03 - 2008-10-12 01:18 - 01178934 _____ C:\Windows\WindowsUpdate.log
2013-09-25 20:56 - 2013-09-23 20:13 - 00000942 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-25 20:56 - 2011-02-04 20:28 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-09-25 20:56 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-25 20:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-25 20:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-25 20:53 - 2008-10-12 01:19 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-09-25 20:53 - 2006-11-02 15:01 - 00032612 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-25 20:26 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\tracing
2013-09-25 19:57 - 2012-10-18 17:13 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-24 21:22 - 2013-09-24 21:20 - 00000000 ____D C:\AdwCleaner
2013-09-24 21:20 - 2013-09-24 21:20 - 01042066 _____ C:\Users\petrorlet\Desktop\adwcleaner.exe
2013-09-24 21:09 - 2013-09-24 21:09 - 00003158 _____ C:\Users\petrorlet\Desktop\JRT.txt
2013-09-24 20:54 - 2013-09-24 20:54 - 01030038 _____ (Thisisu) C:\Users\petrorlet\Desktop\JRT.exe
2013-09-24 20:54 - 2013-09-24 20:54 - 00000000 ____D C:\Windows\ERUNT
2013-09-24 17:55 - 2009-06-06 13:31 - 00000000 ____D C:\Users\petrorlet
2013-09-24 17:52 - 2013-09-24 17:52 - 00000000 ____D C:\ProgramData\ESET
2013-09-24 17:52 - 2013-09-24 17:52 - 00000000 ____D C:\Program Files\ESET
2013-09-24 17:34 - 2012-10-13 13:57 - 00002106 _____ C:\Windows\epplauncher.mif
2013-09-24 17:32 - 2012-10-13 13:53 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-24 17:26 - 2013-09-24 17:26 - 00000000 ____D C:\Windows\Temp51237310-DE76-E3D3-9363-0B8DFC61244F-Signatures
2013-09-24 17:19 - 2008-10-12 03:18 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-09-23 22:40 - 2013-09-23 21:41 - 00000000 ____D C:\ComboFix
2013-09-23 22:40 - 2013-09-23 21:32 - 00000000 ____D C:\Qoobox
2013-09-23 22:32 - 2013-09-23 22:32 - 00012806 _____ C:\ComboFix.txt
2013-09-23 22:32 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-09-23 22:29 - 2013-09-23 21:32 - 00000000 ____D C:\Windows\erdnt
2013-09-23 22:25 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-09-23 22:23 - 2006-11-02 12:22 - 46661632 _____ C:\Windows\system32\config\COMPON~1.bak
2013-09-23 22:23 - 2006-11-02 12:22 - 42205184 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-09-23 22:23 - 2006-11-02 12:22 - 28573696 _____ C:\Windows\system32\config\SYSTEM.bak
2013-09-23 22:23 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-09-23 22:23 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-23 22:23 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\DEFAULT.bak
2013-09-23 21:34 - 2013-09-23 20:12 - 00000000 ____D C:\Users\petrorlet\AppData\Local\Google
2013-09-23 21:31 - 2013-09-23 21:30 - 05129279 ____R (Swearware) C:\Users\petrorlet\Desktop\ComboFix.exe
2013-09-23 20:31 - 2013-09-23 20:31 - 00002673 _____ C:\Users\petrorlet\Desktop\Microsoft Office Word 2003 (2).lnk
2013-09-23 20:18 - 2013-09-23 20:18 - 00001978 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-23 20:18 - 2010-02-26 23:19 - 00000000 ____D C:\Windows\Minidump
2013-09-23 20:18 - 2008-04-17 12:45 - 00000000 ____D C:\Windows\Panther
2013-09-23 20:17 - 2013-09-23 20:12 - 00000000 ____D C:\Program Files\Google
2013-09-23 20:16 - 2013-09-23 20:16 - 00000811 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 20:16 - 2013-09-23 20:16 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 20:14 - 2013-09-23 20:14 - 00000000 ____D C:\ProgramData\Google
2013-09-23 19:27 - 2013-09-23 19:27 - 00001804 _____ C:\Users\petrorlet\Desktop\Adobe Reader 8.lnk
2013-09-23 19:14 - 2006-11-02 14:47 - 00371712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-22 10:38 - 2012-10-18 17:13 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-22 10:38 - 2011-07-17 11:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 03:14 - 2006-11-02 12:23 - 00000240 _____ C:\Windows\win.ini
2013-09-16 03:05 - 2013-08-15 17:03 - 00000000 ____D C:\Windows\system32\MRT
2013-09-16 03:02 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-09-15 18:17 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-15 17:58 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\petrorlet\AppData\Local\temp\InstHelper.exe
C:\Users\petrorlet\AppData\Local\temp\jre-7u40-windows-i586-iftw.exe
C:\Users\petrorlet\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-25 21:03

==================== End Of Log ============================

Proc tam cpete ESET misto MSE

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)
  HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [104936 2008-07-18] (CyberLink)
  HKLM\...\Run: [P2Go_Menu] - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
  HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
  HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
  HKU\eliska\...\Run: [Seznam Postak] - C:\Users\eliska\AppData\Local\Seznam.cz\postak.exe [ 2009-11-02] ()
  HKU\eliska\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-21] (Microsoft Corporation)
  HKU\eliska\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
  
  HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  SearchScopes: HKLM - DefaultScope value is missing.
  
  S3 catchme; \??\C:\ComboFix\catchme.sys [x]
  S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
  S1 MpKslc94990f9; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{17C80047-0A16-4560-BE95-858FC8BBBB0F}\MpKslc94990f9.sys [x]
  S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
  S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
  U2 WZCSVC; 
  
  C:\Users\petrorlet\AppData\Local\temp\InstHelper.exe
  C:\Users\petrorlet\AppData\Local\temp\jre-7u40-windows-i586-iftw.exe
  C:\Users\petrorlet\AppData\Local\temp\Quarantine.exe
  
  Hosts:
  CMD: shutdown /r /f /t 2
  End

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

MSE mi zmizel a nešel už instalovat... prosím, jak mám přesunout fixlist k frst? děkuji

už to mááááám

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-09-2013
Ran by petrorlet at 2013-09-25 23:33:29 Run:1
Running from C:\Users\petrorlet\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)
HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [104936 2008-07-18] (CyberLink)
HKLM\...\Run: [P2Go_Menu] - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\eliska\...\Run: [Seznam Postak] - C:\Users\eliska\AppData\Local\Seznam.cz\postak.exe [ 2009-11-02] ()
HKU\eliska\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-21] (Microsoft Corporation)
HKU\eliska\...\Winlogon: [Shell] explorer.exe <==== ATTENTION

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKLM - DefaultScope value is missing.

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S1 MpKslc94990f9; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{17C80047-0A16-4560-BE95-858FC8BBBB0F}\MpKslc94990f9.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 WZCSVC;

C:\Users\petrorlet\AppData\Local\temp\InstHelper.exe
C:\Users\petrorlet\AppData\Local\temp\jre-7u40-windows-i586-iftw.exe
C:\Users\petrorlet\AppData\Local\temp\Quarantine.exe

Hosts:
CMD: shutdown /r /f /t 2
End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CLMLServer => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\P2Go_Menu => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\WMPNSCFG => Value deleted successfully.
HKU\eliska\Software\Microsoft\Windows\CurrentVersion\Run\\Seznam Postak => Value deleted successfully.
HKU\eliska\Software\Microsoft\Windows\CurrentVersion\Run\\WMPNSCFG => Value deleted successfully.
HKU\eliska\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
catchme => Service deleted successfully.
IpInIp => Service deleted successfully.
MpKslc94990f9 => Service deleted successfully.
NwlnkFlt => Service deleted successfully.
NwlnkFwd => Service deleted successfully.
WZCSVC => Service deleted successfully.
C:\Users\petrorlet\AppData\Local\temp\InstHelper.exe => Moved successfully.
C:\Users\petrorlet\AppData\Local\temp\jre-7u40-windows-i586-iftw.exe => Moved successfully.
C:\Users\petrorlet\AppData\Local\temp\Quarantine.exe => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========


========= End of CMD: =========


==== End of Fixlog ====

Stahnete SecurityCheck http://screen317.spywareinfoforum.org/SecurityCheck.exe

• Ulozte nejlepe na Plochu
• Spustte tradicne dvouklikem a postupujte dle pokynu utility
• Po dokonceni skenu se vytvori a otevre log, ten mi sem vlozte

Results of screen317's Security Check version 0.99.73
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
ESET NOD32 Antivirus 6.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java(TM) 6 Update 35
Java version out of Date!
Adobe Reader 8 Adobe Reader out of Date!
Google Chrome 29.0.1547.76
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````