VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

malware... složka iswizard05

https://forum.viry.cz:443/viewtopic.php?t=136019

Stránka 1 z 1

malware... složka iswizard05

Napsal: 06 úno 2014 22:04
od enia
Zdravím :),
Avast mi ve chvilce nečinnosti detekuje a odvrací útoky malware (klidně za pár minut desítky a více). Stále se vrací složka iswizard05. Po pročištění je to stále stejné (avast, Malwarebytes Anti-Malware...)
budu moc ráda za pomoc

Logfile of random's system information tool 1.09 (written by random/random)
Run by ENIA at 2014-02-06 21:51:20
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 8 GB (11%) free of 70 GB
Total RAM: 3327 MB (40% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:51:31, on 6.2.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
C:\windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
C:\Program Files\Okidata\OKI LPR Utility\okilpr.exe
C:\Program Files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\ENIA\AppData\Local\Mozilla Firefox\firefox.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\taskmgr.exe
C:\Users\ENIA\Downloads\RSIT.exe
C:\Program Files\trend micro\ENIA.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.mini20.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [AdobeCEPServiceManager] "C:\Program Files\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Creative Cloud] "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Driver Updater] "C:\Program Files\Carambis\Driver Updater\dupdater.exe" /minimized
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [tsiVideo] rundll32.exe C:\Users\ENIA\AppData\Local\Temp\\mdi164.dll,runme
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: OKI LPR Utility.lnk = C:\Program Files\Okidata\OKI LPR Utility\okilpr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - (no file)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - (no file)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Windows Live Family Safety Service (fsssvc) - Unknown owner - C:\Program Files\Windows Live\Family Safety\fsssvc.exe (file missing)
O23 - Service: FsUsbExService - Teruten - C:\windows\system32\FsUsbExService.Exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KME Remote Server - Panasonic Communications Co.,Ltd. - C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\windows\system32\lxcecoms.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\windows\system32\nvvsvc.exe
O23 - Service: OKI OKHC DCS Loader - Oki Data Corporation - C:\windows\system32\spool\DRIVERS\W32X86\3\OKHCLDCS.EXE
O23 - Service: OKI Local Port Manager (OpLclSrv) - Oki Data Corporation - C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
O23 - Service: PC Speed Up Service (PCSUService) - Unknown owner - C:\Program Files\Zrychleni Pocitace\PCSUService.exe
O23 - Service: WMI_Hook_Service - MICRO-STAR INT'L,.LTD. - C:\Program Files\msi\WMIHookBtnFn\WMI_Hook_Service.exe

--
End of file - 9674 bytes

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\dsmonitor.job
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003Core.job
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003UA.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\PC SpeedUp Service Deactivator.job

=========Mozilla firefox=========

ProfilePath - C:\Users\ENIA\AppData\Roaming\Mozilla\Firefox\Profiles\20yd2kva.default

prefs.js - "browser.startup.homepage" - "http://500px.com/popular"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}:6.0.18, illimitux@illimitux.net:4.0, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145, wrc@avast.com:7.0.1426, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.10"

"smartwebprinting@hp.com"=C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
"wrc@avast.com"=C:\Program Files\Alwil Software\Avast5\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 12.0.0.44 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@mcafee.com/McAfeeMssPlugin]
"Description"=McAfee Mss Plugin
"Path"=C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll


C:\Users\ENIA\AppData\Local\Mozilla Firefox\plugins\
nppdf32.dll

C:\Users\ENIA\AppData\Roaming\Mozilla\Firefox\Profiles\20yd2kva.default\extensions\
illimitux@illimitux.net

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-27 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-14 194128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-27 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22 517688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-14 194128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-09-30 7744032]
"NPSStartup"= []
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]
"AvastUI.exe"=C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2014-02-06 3767096]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-12-10 472984]
"AdobeCEPServiceManager"=C:\Program Files\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [2013-03-13 1039248]
"Adobe Creative Cloud"=C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2013-12-19 2239376]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Driver Updater"=C:\Program Files\Carambis\Driver Updater\dupdater.exe [2011-09-27 4871264]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184]
"Facebook Update"=C:\Users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11 138096]
"tsiVideo"=C:\Users\ENIA\AppData\Local\Temp\\mdi164.dll [2013-12-25 3458560]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
OKI LPR Utility.lnk - C:\Program Files\Okidata\OKI LPR Utility\okilpr.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.VP60"=C:\windows\system32\vp6vfw.dll
"vidc.VP61"=C:\windows\system32\vp6vfw.dll
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.FFDS"=C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS4\dreamweaver.exe","%1"
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-02-06 21:45:30 ----D---- C:\rsit
2014-02-06 21:45:30 ----D---- C:\Program Files\trend micro
2014-02-06 21:39:20 ----A---- C:\windows\system32\drivers\mbamswissarmy.sys
2014-02-06 17:42:42 ----D---- C:\Users\ENIA\AppData\Roaming\Malwarebytes
2014-02-06 17:42:34 ----D---- C:\ProgramData\Malwarebytes
2014-02-06 17:42:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2014-02-06 17:42:32 ----A---- C:\windows\system32\drivers\mbam.sys
2014-02-06 17:35:04 ----A---- C:\windows\system32\drivers\aswNdisFlt.sys
2014-01-16 08:12:46 ----A---- C:\windows\system32\win32k.sys
2014-01-16 08:12:45 ----A---- C:\windows\system32\drivers\netio.sys
2014-01-16 08:12:36 ----A---- C:\windows\system32\drivers\usbehci.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbuhci.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbport.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbohci.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbhub.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbd.sys
2014-01-16 08:12:35 ----A---- C:\windows\system32\drivers\usbccgp.sys
2014-01-07 00:47:30 ----A---- C:\windows\system32\oklprmon.dll
2014-01-07 00:47:30 ----A---- C:\windows\system32\oklchapp.dll
2014-01-07 00:47:29 ----A---- C:\windows\system32\oklprrsc.dll
2014-01-07 00:47:29 ----A---- C:\windows\system32\oklpinst.dll

======List of files/folders modified in the last 1 month======

2014-02-06 21:50:24 ----D---- C:\windows\Temp
2014-02-06 21:45:30 ----RD---- C:\Program Files
2014-02-06 21:39:20 ----D---- C:\windows\system32\drivers
2014-02-06 21:37:51 ----D---- C:\windows\system32\config
2014-02-06 21:37:39 ----D---- C:\Program Files\Common Files\Akamai
2014-02-06 21:37:20 ----D---- C:\Program Files\Zrychleni Pocitace
2014-02-06 21:37:08 ----D---- C:\windows\registration
2014-02-06 19:43:40 ----D---- C:\Program Files\Mozilla Thunderbird
2014-02-06 19:28:09 ----D---- C:\Users\ENIA\AppData\Roaming\Ximagic
2014-02-06 18:05:56 ----D---- C:\windows\system32\Tasks
2014-02-06 18:05:48 ----D---- C:\Windows
2014-02-06 18:05:16 ----SHD---- C:\System Volume Information
2014-02-06 18:00:18 ----D---- C:\windows\Logs
2014-02-06 17:42:34 ----HD---- C:\ProgramData
2014-02-06 17:36:26 ----D---- C:\windows\inf
2014-02-06 17:36:24 ----D---- C:\windows\system32\catroot
2014-02-06 17:36:23 ----D---- C:\windows\system32\DriverStore
2014-02-06 17:35:35 ----A---- C:\windows\system32\aswBoot.exe
2014-02-06 17:01:13 ----D---- C:\windows\System32
2014-02-06 17:01:13 ----A---- C:\windows\system32\PerfStringBackup.INI
2014-02-06 08:32:55 ----D---- C:\windows\Prefetch
2014-02-05 13:22:35 ----A---- C:\windows\system32\FlashPlayerApp.exe
2014-02-03 20:11:26 ----D---- C:\Users\ENIA\AppData\Roaming\uTorrent
2014-01-24 22:54:41 ----SHD---- C:\windows\Installer
2014-01-17 03:27:15 ----D---- C:\windows\winsxs
2014-01-17 03:06:50 ----D---- C:\ProgramData\Microsoft Help
2014-01-17 03:05:46 ----D---- C:\windows\system32\MRT
2014-01-17 03:02:39 ----D---- C:\windows\debug
2014-01-17 03:02:33 ----A---- C:\windows\system32\MRT.exe
2014-01-16 08:10:32 ----D---- C:\windows\system32\catroot2
2014-01-07 01:41:28 ----D---- C:\windows\twain_32
2014-01-07 00:47:31 ----D---- C:\Program Files\Okidata
2014-01-07 00:47:28 ----HD---- C:\Program Files\InstallShield Installation Information
2014-01-07 00:22:18 ----RSD---- C:\windows\assembly
2014-01-07 00:22:01 ----D---- C:\Program Files\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2013-12-27 49944]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2013-12-27 180248]
R0 nvamacpi;NVIDIA Away Mode System; C:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-17 24608]
R0 nvstor32;nvstor32; C:\windows\system32\DRIVERS\nvstor32.sys [2009-08-05 213024]
R0 PxHelp20;PxHelp20; C:\windows\System32\Drivers\PxHelp20.sys [2009-04-17 44944]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswNdisFlt;Avast! Firewall Driver; C:\windows\system32\DRIVERS\aswNdisFlt.sys [2014-02-06 265072]
R1 aswRdr;aswRdr; \??\C:\windows\system32\drivers\aswRdr2.sys [2013-12-27 79720]
R1 aswSnx;aswSnx; \??\C:\windows\system32\drivers\aswSnx.sys [2014-02-06 775952]
R1 aswSP;aswSP; \??\C:\windows\system32\drivers\aswSP.sys [2014-02-06 410784]
R1 aswTdi;avast! Network Shield Support; C:\windows\system32\drivers\aswTdi.sys [2013-12-19 56080]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswMonFlt;aswMonFlt; \??\C:\windows\system32\drivers\aswMonFlt.sys [2014-02-06 67824]
R2 atksgt;atksgt; C:\windows\system32\DRIVERS\atksgt.sys [2010-07-28 281760]
R2 lirsgt;lirsgt; C:\windows\system32\DRIVERS\lirsgt.sys [2010-07-28 25888]
R3 Afc;PPdus ASPI Shell; C:\windows\system32\drivers\Afc.sys [2006-11-10 18688]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect; C:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-25 17920]
R3 aswStm;aswStm; \??\C:\windows\system32\drivers\aswStm.sys [2014-02-06 64168]
R3 enecir;ENE CIR Receiver; C:\windows\system32\DRIVERS\enecir.sys [2009-06-29 59904]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\windows\system32\FsUsbExDisk.SYS [2009-01-08 36608]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2009-09-30 2776672]
R3 MarvinBus;Pinnacle Marvin Bus; C:\windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 MBAMProtector;MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\windows\system32\drivers\mbamswissarmy.sys [2014-02-06 40776]
R3 nvsmu;nvsmu; C:\windows\system32\DRIVERS\nvsmu.sys [2009-06-29 17920]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-21 189440]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver; C:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S1 aswKbd;aswKbd; \??\C:\windows\system32\drivers\aswKbd.sys []
S2 BulkUsb;Genesys Logic USB Controller NT 5.0; C:\windows\System32\Drivers\usbprn.sys [2001-09-24 8350]
S2 Parvdm;Parvdm; C:\windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 androidusb;ADB Interface Driver; C:\windows\System32\Drivers\androidusb.sys [2010-04-29 26112]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 Dot4;MS IEEE-1284.4 Driver; C:\windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
S3 enecirhid;ENE CIR HID Receiver; C:\windows\system32\DRIVERS\enecirhid.sys [2009-05-20 11776]
S3 enecirhidma;ENE CIR HIDmini Filter; C:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-25 5632]
S3 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr.sys [2010-09-22 39272]
S3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista; C:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUStor.sys [2009-06-24 167424]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver; C:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2009-07-13 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver; C:\windows\system32\drivers\RTL2832UBDA.sys [2009-10-26 93344]
S3 RTL2832UUSB;REALTEK 2832U USB Driver; C:\windows\System32\Drivers\RTL2832UUSB.sys [2009-10-26 32800]
S3 RtsUIR;Realtek IR Driver; C:\windows\system32\DRIVERS\Rts516xIR.sys []
S3 sisagp;Filtr SIS sběrnice AGP; C:\windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\windows\system32\DRIVERS\sscdbus.sys [2008-02-22 87936]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\windows\system32\DRIVERS\sscdmdfl.sys [2008-02-22 14976]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\windows\system32\DRIVERS\sscdmdm.sys [2008-02-22 114304]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 USBCCID;Realtek Smartcard Reader Driver; C:\windows\system32\DRIVERS\RtsUCcid.sys []
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 viaagp;Filtr VIA sběrnice AGP; C:\windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;Paper Jamz Pro Firmware; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 Akamai;Akamai NetSession Interface; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2014-02-06 50344]
R2 avast! Firewall;avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [2014-02-06 113704]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 FsUsbExService;FsUsbExService; C:\windows\system32\FsUsbExService.Exe [2009-01-08 233472]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\windows\system32\svchost.exe [2009-07-14 20992]
R2 HPSLPSVC;HP Network Devices Support; C:\windows\system32\svchost.exe [2009-07-14 20992]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 nvsvc;NVIDIA Display Driver Service; C:\windows\system32\nvvsvc.exe [2009-07-18 211488]
R2 OpLclSrv;OKI Local Port Manager; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [2011-04-11 139264]
R2 PCSUService;PC Speed Up Service; C:\Program Files\Zrychleni Pocitace\PCSUService.exe [2013-12-10 423728]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 20992]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R3 hpqcxs08;hpqcxs08; C:\windows\system32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 135664]
S2 KME Remote Server;KME Remote Server; C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe [2003-02-09 57344]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05 257928]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-01-08 655624]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe []
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 135664]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-12 194032]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
S3 lxce_device;lxce_device; C:\windows\system32\lxcecoms.exe [2005-07-06 471040]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 235216]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-11 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 OKI OKHC DCS Loader;OKI OKHC DCS Loader; C:\windows\system32\spool\DRIVERS\W32X86\3\OKHCLDCS.EXE [2009-03-05 24576]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]

-----------------EOF-----------------

Re: malware... složka iswizard05

Napsal: 06 úno 2014 22:08
od Rudy
Zdravím!
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

Re: malware... složka iswizard05

Napsal: 06 úno 2014 22:46
od enia
hotovo..

ComboFix 14-02-05.02 - ENIA 06.02.2014 22:25:34.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3327.1449 [GMT 1:00]
Spuštěný z: c:\users\ENIA\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\pt
c:\windows\system32\pt\Lagoon.resources.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_PCSUService
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-06 do 2014-02-06 )))))))))))))))))))))))))))))))
.
.
2014-02-06 21:36 . 2014-02-06 21:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-06 21:36 . 2014-02-06 21:36 -------- d-----w- c:\users\BARON\AppData\Local\temp
2014-02-06 20:45 . 2014-02-06 20:51 -------- d-----w- c:\program files\trend micro
2014-02-06 20:45 . 2014-02-06 20:45 -------- d-----w- C:\rsit
2014-02-06 18:43 . 2014-02-06 20:55 -------- d-----w- c:\program files\Mozilla Thunderbird
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\users\ENIA\AppData\Roaming\Malwarebytes
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\programdata\Malwarebytes
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-02-06 16:42 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\users\ENIA\AppData\Local\Programs
2014-02-06 16:35 . 2014-02-06 16:35 265072 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
2014-02-04 12:05 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{723D34CB-11C2-4141-BE33-86FC932040BF}\mpengine.dll
2014-01-16 07:12 . 2013-11-26 10:10 2349056 ----a-w- c:\windows\system32\win32k.sys
2014-01-16 07:12 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-16 07:12 . 2013-11-27 01:13 43520 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-16 07:12 . 2013-11-27 01:14 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-16 07:12 . 2013-11-27 01:13 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-16 07:12 . 2013-11-27 01:13 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-16 07:12 . 2013-11-27 01:13 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-16 07:12 . 2013-11-27 01:13 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-16 07:12 . 2013-11-27 01:13 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 16:35 . 2013-12-27 16:41 64168 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-02-06 16:35 . 2011-05-24 17:54 775952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-02-06 16:35 . 2010-04-23 10:17 410784 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-02-06 16:35 . 2010-04-23 10:16 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-02-06 16:35 . 2010-07-18 07:52 43152 ----a-w- c:\windows\avastSS.scr
2014-02-06 16:35 . 2010-04-23 10:16 270240 ----a-w- c:\windows\system32\aswBoot.exe
2014-02-05 12:22 . 2012-06-15 06:05 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-05 12:22 . 2011-12-01 22:14 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-27 18:40 . 2013-12-27 18:40 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-12-27 16:41 . 2013-04-04 00:44 180248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-27 16:41 . 2013-04-04 00:44 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-27 16:41 . 2012-02-24 23:30 79720 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-19 13:11 . 2010-04-23 10:17 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-18 05:13 . 2010-04-23 10:13 231584 ------w- c:\windows\system32\MpSigStub.exe
2013-11-26 09:23 . 2013-12-12 02:18 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 09:22 . 2013-12-12 02:18 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 08:53 . 2013-12-12 02:18 61952 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 08:52 . 2013-12-12 02:18 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 08:29 . 2013-12-12 02:18 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 08:29 . 2013-12-12 02:18 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 08:28 . 2013-12-12 02:18 553472 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:17 4243968 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 07:32 . 2013-12-12 02:18 1928192 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 06:33 . 2013-12-12 02:18 1820160 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 02:03 . 2013-11-26 02:03 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-26 02:03 . 2013-11-26 02:03 194048 ----a-w- c:\windows\system32\elshyph.dll
2013-11-26 02:03 . 2013-11-26 02:03 86016 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-26 02:03 . 2013-11-26 02:03 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-26 02:03 . 2013-11-26 02:03 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-26 02:03 . 2013-11-26 02:03 645120 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-26 02:03 . 2013-11-26 02:03 62464 ----a-w- c:\windows\system32\tdc.ocx
2013-11-26 02:03 . 2013-11-26 02:03 61952 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-26 02:03 . 2013-11-26 02:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-26 02:03 . 2013-11-26 02:03 454656 ----a-w- c:\windows\system32\vbscript.dll
2013-11-26 02:03 . 2013-11-26 02:03 36352 ----a-w- c:\windows\system32\imgutil.dll
2013-11-26 02:03 . 2013-11-26 02:03 34816 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 02:03 . 2013-11-26 02:03 337408 ----a-w- c:\windows\system32\html.iec
2013-11-26 02:03 . 2013-11-26 02:03 24576 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-26 02:03 . 2013-11-26 02:03 182272 ----a-w- c:\windows\system32\msls31.dll
2013-11-26 02:03 . 2013-11-26 02:03 151552 ----a-w- c:\windows\system32\iexpress.exe
2013-11-26 02:03 . 2013-11-26 02:03 139264 ----a-w- c:\windows\system32\wextract.exe
2013-11-26 02:03 . 2013-11-26 02:03 13312 ----a-w- c:\windows\system32\mshta.exe
2013-11-26 02:03 . 2013-11-26 02:03 111616 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-26 02:03 . 2013-11-26 02:03 1051136 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-23 18:26 . 2013-12-11 08:23 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-12 02:07 . 2013-12-11 08:23 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-02-06 16:35 259464 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Driver Updater"="c:\program files\Carambis\Driver Updater\dupdater.exe" [2011-09-27 4871264]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-30 7744032]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2014-02-06 3767096]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-12-10 472984]
"AdobeCEPServiceManager"="c:\program files\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" [2013-03-13 1039248]
"Adobe Creative Cloud"="c:\program files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2013-12-19 2239376]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
OKI LPR Utility.lnk - c:\program files\Okidata\OKI LPR Utility\okilpr.exe [2014-1-7 187440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [x]
R2 BulkUsb;Genesys Logic USB Controller NT 5.0;c:\windows\system32\Drivers\usbprn.sys [2001-09-24 8350]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-20 11776]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-25 5632]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 235216]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
R3 OKI OKHC DCS Loader;OKI OKHC DCS Loader;c:\windows\system32\spool\DRIVERS\W32X86\3\OKHCLDCS.EXE [2009-03-05 24576]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 167424]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2009-07-13 37280]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2009-10-26 93344]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [2009-10-26 32800]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-17 24608]
S1 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys [2014-02-06 265072]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-02-06 775952]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-02-06 410784]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-02-06 67824]
S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [2014-02-06 113704]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-01-08 233472]
S2 KME Remote Server;KME Remote Server;c:\progra~1\PANASO~1\REMOTE~1\kmentsrv.exe [2003-02-09 57344]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 OpLclSrv;OKI Local Port Manager;c:\program files\Okidata\Common\Extend3\portmgrsrv.exe [2011-04-11 139264]
S2 WMI_Hook_Service;WMI_Hook_Service;c:\program files\msi\WMIHookBtnFn\WMI_Hook_Service.exe [2009-09-25 101376]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-25 17920]
S3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-02-06 64168]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-06-29 59904]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-01-08 36608]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-21 189440]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-04 18:35 1211720 ----a-w- c:\program files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-15 12:22]
.
2014-02-06 c:\windows\Tasks\dsmonitor.job
- c:\program files\Uniblue\DriverScanner\dsmonitor.exe [2013-12-27 13:47]
.
2014-02-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003Core.job
- c:\users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-08 21:10]
.
2014-02-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003UA.job
- c:\users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-08 21:10]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-15 07:04]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-15 07:04]
.
2014-01-17 c:\windows\Tasks\PC SpeedUp Service Deactivator.job
- c:\program files\Zrychleni Pocitace\PCSUSD.exe [2013-12-29 09:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.mini20.com/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.111.1
FF - ProfilePath - c:\users\ENIA\AppData\Roaming\Mozilla\Firefox\Profiles\20yd2kva.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://500px.com/popular
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-NPSStartup - (no file)
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
AddRemove-Adobe Photoshop 6.0 - c:\program files\Adobe\Photoshop 6.0\Uninst.isu
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_8fa3539.dll"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(4560)
c:\program files\SoftStylus\sstlstsrv.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\windows\system32\taskhost.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Celkový čas: 2014-02-06 22:43:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-02-06 21:43
.
Před spuštěním: 8 082 513 920
Po spuštění: 9 276 039 168
.
- - End Of File - - 002B6512BC818B1662006B5C9C79E952
A36C5E4F47E84449FF07ED3517B43A31

Re: malware... složka iswizard05

Napsal: 06 úno 2014 22:56
od Rudy
Ještě dočistíme. Přesuňte ComboFix na plochu. otevřte poznámkový blok a zkopírujte do něj:
KillAll::

File::
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003Core.job
c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003UA.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Driver::
Akamai

Firefox::
FF - ProfilePath - c:\users\ENIA\AppData\Roaming\Mozilla\Firefox\Profiles\20yd2kva.default\
FF - prefs.js: browser.startup.homepage - hxxp://500px.com/popular

RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: malware... složka iswizard05

Napsal: 06 úno 2014 23:21
od enia
hotovo..
ComboFix 14-02-05.02 - ENIA 06.02.2014 23:02:50.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3327.1947 [GMT 1:00]
Spuštěný z: c:\users\ENIA\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\ENIA\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003UA.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Akamai
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-06 do 2014-02-06 )))))))))))))))))))))))))))))))
.
.
2014-02-06 22:12 . 2014-02-06 22:12 -------- d-----w- c:\users\matka cz\AppData\Local\temp
2014-02-06 22:12 . 2014-02-06 22:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-06 22:12 . 2014-02-06 22:12 -------- d-----w- c:\users\BARON\AppData\Local\temp
2014-02-06 21:25 . 2014-02-06 21:25 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{723D34CB-11C2-4141-BE33-86FC932040BF}\offreg.dll
2014-02-06 20:45 . 2014-02-06 20:51 -------- d-----w- c:\program files\trend micro
2014-02-06 20:45 . 2014-02-06 20:45 -------- d-----w- C:\rsit
2014-02-06 18:43 . 2014-02-06 20:55 -------- d-----w- c:\program files\Mozilla Thunderbird
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\users\ENIA\AppData\Roaming\Malwarebytes
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\programdata\Malwarebytes
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-02-06 16:42 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-02-06 16:42 . 2014-02-06 16:42 -------- d-----w- c:\users\ENIA\AppData\Local\Programs
2014-02-06 16:35 . 2014-02-06 16:35 265072 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
2014-02-04 12:05 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{723D34CB-11C2-4141-BE33-86FC932040BF}\mpengine.dll
2014-01-16 07:12 . 2013-11-26 10:10 2349056 ----a-w- c:\windows\system32\win32k.sys
2014-01-16 07:12 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-16 07:12 . 2013-11-27 01:13 43520 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-16 07:12 . 2013-11-27 01:14 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-16 07:12 . 2013-11-27 01:13 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-16 07:12 . 2013-11-27 01:13 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-16 07:12 . 2013-11-27 01:13 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-16 07:12 . 2013-11-27 01:13 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-16 07:12 . 2013-11-27 01:13 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 16:35 . 2013-12-27 16:41 64168 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-02-06 16:35 . 2011-05-24 17:54 775952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-02-06 16:35 . 2010-04-23 10:17 410784 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-02-06 16:35 . 2010-04-23 10:16 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-02-06 16:35 . 2010-07-18 07:52 43152 ----a-w- c:\windows\avastSS.scr
2014-02-06 16:35 . 2010-04-23 10:16 270240 ----a-w- c:\windows\system32\aswBoot.exe
2014-02-05 12:22 . 2012-06-15 06:05 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-05 12:22 . 2011-12-01 22:14 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-27 18:40 . 2013-12-27 18:40 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-12-27 16:41 . 2013-04-04 00:44 180248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-27 16:41 . 2013-04-04 00:44 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-27 16:41 . 2012-02-24 23:30 79720 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-19 13:11 . 2010-04-23 10:17 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-18 05:13 . 2010-04-23 10:13 231584 ------w- c:\windows\system32\MpSigStub.exe
2013-11-26 09:23 . 2013-12-12 02:18 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 09:22 . 2013-12-12 02:18 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 08:53 . 2013-12-12 02:18 61952 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 08:52 . 2013-12-12 02:18 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 08:29 . 2013-12-12 02:18 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 08:29 . 2013-12-12 02:18 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 08:28 . 2013-12-12 02:18 553472 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:17 4243968 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 07:32 . 2013-12-12 02:18 1928192 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 06:33 . 2013-12-12 02:18 1820160 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 02:03 . 2013-11-26 02:03 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-26 02:03 . 2013-11-26 02:03 194048 ----a-w- c:\windows\system32\elshyph.dll
2013-11-26 02:03 . 2013-11-26 02:03 86016 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-26 02:03 . 2013-11-26 02:03 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-26 02:03 . 2013-11-26 02:03 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-26 02:03 . 2013-11-26 02:03 645120 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-26 02:03 . 2013-11-26 02:03 62464 ----a-w- c:\windows\system32\tdc.ocx
2013-11-26 02:03 . 2013-11-26 02:03 61952 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-26 02:03 . 2013-11-26 02:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-26 02:03 . 2013-11-26 02:03 454656 ----a-w- c:\windows\system32\vbscript.dll
2013-11-26 02:03 . 2013-11-26 02:03 36352 ----a-w- c:\windows\system32\imgutil.dll
2013-11-26 02:03 . 2013-11-26 02:03 34816 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 02:03 . 2013-11-26 02:03 337408 ----a-w- c:\windows\system32\html.iec
2013-11-26 02:03 . 2013-11-26 02:03 24576 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-26 02:03 . 2013-11-26 02:03 182272 ----a-w- c:\windows\system32\msls31.dll
2013-11-26 02:03 . 2013-11-26 02:03 151552 ----a-w- c:\windows\system32\iexpress.exe
2013-11-26 02:03 . 2013-11-26 02:03 139264 ----a-w- c:\windows\system32\wextract.exe
2013-11-26 02:03 . 2013-11-26 02:03 13312 ----a-w- c:\windows\system32\mshta.exe
2013-11-26 02:03 . 2013-11-26 02:03 111616 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-26 02:03 . 2013-11-26 02:03 1051136 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-23 18:26 . 2013-12-11 08:23 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-12 02:07 . 2013-12-11 08:23 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-12-13 11:20 2602864 ----a-w- c:\program files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x86.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-02-06 16:35 259464 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Driver Updater"="c:\program files\Carambis\Driver Updater\dupdater.exe" [2011-09-27 4871264]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-30 7744032]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2014-02-06 3767096]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-12-10 472984]
"AdobeCEPServiceManager"="c:\program files\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" [2013-03-13 1039248]
"Adobe Creative Cloud"="c:\program files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2013-12-19 2239376]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
OKI LPR Utility.lnk - c:\program files\Okidata\OKI LPR Utility\okilpr.exe [2014-1-7 187440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [x]
R2 BulkUsb;Genesys Logic USB Controller NT 5.0;c:\windows\system32\Drivers\usbprn.sys [2001-09-24 8350]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-20 11776]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-25 5632]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 235216]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
R3 OKI OKHC DCS Loader;OKI OKHC DCS Loader;c:\windows\system32\spool\DRIVERS\W32X86\3\OKHCLDCS.EXE [2009-03-05 24576]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 167424]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2009-07-13 37280]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2009-10-26 93344]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [2009-10-26 32800]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-17 24608]
S1 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys [2014-02-06 265072]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-02-06 775952]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-02-06 410784]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-02-06 67824]
S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [2014-02-06 113704]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-01-08 233472]
S2 KME Remote Server;KME Remote Server;c:\progra~1\PANASO~1\REMOTE~1\kmentsrv.exe [2003-02-09 57344]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 OpLclSrv;OKI Local Port Manager;c:\program files\Okidata\Common\Extend3\portmgrsrv.exe [2011-04-11 139264]
S2 WMI_Hook_Service;WMI_Hook_Service;c:\program files\msi\WMIHookBtnFn\WMI_Hook_Service.exe [2009-09-25 101376]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-25 17920]
S3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-02-06 64168]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-06-29 59904]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-01-08 36608]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-21 189440]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-04 18:35 1211720 ----a-w- c:\program files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-15 12:22]
.
2014-02-06 c:\windows\Tasks\dsmonitor.job
- c:\program files\Uniblue\DriverScanner\dsmonitor.exe [2013-12-27 13:47]
.
2014-02-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003Core.job
- c:\users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-08 21:10]
.
2014-02-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3024916981-1028358421-3954725625-1003UA.job
- c:\users\ENIA\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-08 21:10]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-15 07:04]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-15 07:04]
.
2014-01-17 c:\windows\Tasks\PC SpeedUp Service Deactivator.job
- c:\program files\Zrychleni Pocitace\PCSUSD.exe [2013-12-29 09:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.mini20.com/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.111.1
FF - ProfilePath - c:\users\ENIA\AppData\Roaming\Mozilla\Firefox\Profiles\20yd2kva.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
.
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5040)
c:\program files\SoftStylus\sstlstsrv.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\system32\conhost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Celkový čas: 2014-02-06 23:19:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-02-06 22:19
ComboFix2.txt 2014-02-06 21:43
.
Před spuštěním: 9 711 419 392
Po spuštění: 9 656 107 008
.
- - End Of File - - 091DE8B406065FCE7968E6DA0A8A9D0D
A36C5E4F47E84449FF07ED3517B43A31

Re: malware... složka iswizard05

Napsal: 07 úno 2014 18:40
od Rudy
Nastala nějaká změna?

Re: malware... složka iswizard05

Napsal: 07 úno 2014 19:37
od enia
nastala, už to nevyskakuje tak často (cca každé 3 vteřiny nečinnosti), ale dnes už to avast opět několikrát detekoval (cca 3x)...

Re: malware... složka iswizard05

Napsal: 07 úno 2014 19:51
od enia
ale ta složka se už znovu neobjevuje

Re: malware... složka iswizard05

Napsal: 07 úno 2014 19:53
od Rudy
Ještě bychom mohli zkusit toto:

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Pockejte na dokonceni PreScanu
Zvolte moznost Prohledat (scan)
Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
Detailni postup vc. obrazku mate zde viewtopic.php?f=24&t=120452

Re: malware... složka iswizard05

Napsal: 07 úno 2014 20:42
od enia
vysledek:
RogueKiller V8.8.6 [Feb 7 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : ENIA [Práva správce]
Mód : Kontrola -- Datum : 02/07/2014 20:40:51
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 3 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> NALEZENO
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD64 00AAKS-00A7B SCSI Disk Device +++++
--- User ---
[MBR] 73f6851bab4ecd1ec8eaa8f4eb1c8bb1
[BSP] b5f7faeee3c67b35ae8511fb7eb0ed5c : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15000 Mo
1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 30722048 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30926848 | Size: 70000 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 174286848 | Size: 525378 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x1] Nesprávná funkce. )

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE2 @ USB) Generic- Multi-Card USB Device +++++
--- User ---
[MBR] 7e82bde3ddc3d3387dc23a335c42867f
[BSP] 7208b105e661849d4a48c279d3177d8d : Empty MBR Code
Partition table:
0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 179 | Size: 852 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] Po?adavek není podporován. )

Dokončeno : << RKreport[0]_S_02072014_204051.txt >>

Re: malware... složka iswizard05

Napsal: 07 úno 2014 21:02
od Rudy
Spustte znovu RogueKiller

Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Zvolte moznost Prohledat a pote Smazat a nasledne Zprava - otevre se log, ten sem vlozte
Pak kliknete na Oprava Host a Zprava - otevre se log, ten sem vlozte

Re: malware... složka iswizard05

Napsal: 08 úno 2014 09:39
od enia
RogueKiller V8.8.6 [Feb 7 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : ENIA [Práva správce]
Mód : Kontrola -- Datum : 02/07/2014 22:06:18
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD64 00AAKS-00A7B SCSI Disk Device +++++
--- User ---
[MBR] 73f6851bab4ecd1ec8eaa8f4eb1c8bb1
[BSP] b5f7faeee3c67b35ae8511fb7eb0ed5c : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15000 Mo
1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 30722048 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30926848 | Size: 70000 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 174286848 | Size: 525378 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x1] Nesprávná funkce. )

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE2 @ USB) Generic- Multi-Card USB Device +++++
--- User ---
[MBR] 7e82bde3ddc3d3387dc23a335c42867f
[BSP] 7208b105e661849d4a48c279d3177d8d : Empty MBR Code
Partition table:
0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 179 | Size: 852 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] Po?adavek není podporován. )

Dokončeno : << RKreport[0]_S_02072014_220618.txt >>
RKreport[0]_D_02072014_220148.txt;RKreport[0]_H_02072014_220155.txt;RKreport[0]_S_02072014_204051.txt




a po oprave host:
RogueKiller V8.8.6 [Feb 7 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : ENIA [Práva správce]
Mód : Oprava HOSTS -- Datum : 02/08/2014 09:37:43
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost


Dokončeno : << RKreport[0]_H_02082014_093743.txt >>
RKreport[0]_D_02072014_220148.txt;RKreport[0]_H_02072014_220155.txt;RKreport[0]_S_02072014_204051.txt
RKreport[0]_S_02072014_220618.txt

Re: malware... složka iswizard05

Napsal: 08 úno 2014 11:29
od Rudy
Došlo k nějaké změně?

Re: malware... složka iswizard05

Napsal: 08 úno 2014 11:37
od enia
už je klid, ani jedno hlášení, tak je to asi v pořádku.. moc děkuji :)

Re: malware... složka iswizard05

Napsal: 08 úno 2014 11:40
od Rudy
Nemáte zač! :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz