VIRY.CZ

Ahojte experti na viry.
Dneska ráno jsem zapnul PC a při najetí win mi avast nahlásil chybovou hlášku a chtěl po mě scan. Ihned sem musel restartovat PC a potom naběhla černá obrazovka kdy mi avast dělal scan ( přiznám se že jsem to takto nikdy zatím neviděl ) . Při tomto scanu mi naběhlo několik napadených souborů od viru Win32 ... ( tečky píšu záměrně, protože ten název pokračoval dál a byly 3 různé ).

Všechny jsem je poslal do truhly a po naběhnutí win jsem dal další scan od avastu a ten už vůběc nic nenašel tak nevím zda se dá zjistit jestli mám virus stále v pc , co sním a popřípadě jak se ho zbavit ( nebo format disku .-) ).

Děkuji za help

Zdravim

Dejte log dle tohoto http://forum.viry.cz/viewtopic.php?f=13&t=133100

Děkuju, postupoval jsem podle návodu , TADY JE LOG :

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2014 01
Ran by moje (administrator) on MOJE-PC on 23-02-2014 15:35:11
Running from C:\Users\moje\Desktop
Windows 7 Professional (X64) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Windows\SysWOW64\C2MP\UpdateChecker.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
() C:\Program Files (x86)\Opera\18.0.1284.49\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\18.0.1284.49\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-09] (AVAST Software)
HKU\S-1-5-21-3907286517-672894021-1733755433-1001\...\Run: [CrashHandle] - C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe [182784 2014-01-13] () <===== ATTENTION

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 62.240.178.250 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR Extension: (Dokumenty Google) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-09]
CHR Extension: (Disk Google) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-09]
CHR Extension: (YouTube) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-09]
CHR Extension: (Vyhledávání Google) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-09]
CHR Extension: (AdBlock) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-15]
CHR Extension: (avast! Online Security) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-02-09]
CHR Extension: (Peněženka Google) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-09]
CHR Extension: (Gmail) - C:\Users\moje\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-09]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-02-09]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-09] (AVAST Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-02-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-02-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-09] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-02-09] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-12-25] ()
U3 at8an5fy; C:\Windows\System32\Drivers\at8an5fy.sys [0 ] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-23 15:35 - 2014-02-23 15:35 - 00007455 _____ () C:\Users\moje\Desktop\FRST.txt
2014-02-23 15:35 - 2014-02-23 15:35 - 00000000 ____D () C:\FRST
2014-02-23 15:33 - 2014-02-23 15:34 - 02154496 _____ (Farbar) C:\Users\moje\Desktop\FRST64.exe
2014-02-23 13:35 - 2014-02-23 13:35 - 00000168 _____ () C:\Windows\setupact.log
2014-02-23 13:35 - 2014-02-23 13:35 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-23 13:34 - 2014-02-23 13:34 - 00001490 _____ () C:\Windows\PFRO.log
2014-02-23 12:44 - 2014-02-23 12:44 - 00000000 ____D () C:\Windows\system32\log
2014-02-23 12:44 - 2014-02-23 12:44 - 00000000 ____D () C:\Users\moje\AppData\Roaming\eCyber
2014-02-23 12:43 - 2014-02-23 13:54 - 00000000 ____D () C:\Users\moje\AppData\Roaming\iSafe
2014-02-22 19:39 - 2014-02-22 19:39 - 00000782 _____ () C:\Users\moje\Desktop\Medieval II Total War.lnk
2014-02-22 19:37 - 2014-02-22 19:37 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sega
2014-02-22 19:25 - 2014-02-22 19:25 - 00000000 ____D () C:\Users\moje\AppData\Roaming\InstallShield
2014-02-20 22:47 - 2014-02-20 22:47 - 00000000 __RHD () C:\Users\moje\AppData\Roaming\SecuROM
2014-02-18 22:09 - 2014-02-18 22:09 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-18 22:09 - 2014-02-08 17:18 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-02-18 22:03 - 2014-02-08 19:34 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-18 22:03 - 2014-02-08 19:34 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-18 22:03 - 2014-02-08 19:34 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-18 21:23 - 2014-02-20 22:33 - 00012704 _____ () C:\Users\moje\Desktop\zamereni 1Q.xlsx
2014-02-18 19:02 - 2014-02-18 19:03 - 01904234 _____ () C:\Users\moje\Desktop\FSIP_Q1_2014.xlsx
2014-02-16 15:47 - 2014-02-23 02:50 - 00000000 ____D () C:\Users\moje\AppData\Roaming\TS3Client
2014-02-16 15:47 - 2014-02-16 15:47 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-02-16 15:47 - 2014-02-16 15:47 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-02-16 02:46 - 2014-02-16 02:47 - 00000000 ____D () C:\Windows\SysWOW64\C2MP
2014-02-10 23:40 - 2014-02-15 21:07 - 00000000 ____D () C:\Users\moje\Documents\CSM
2014-02-10 23:40 - 2014-02-10 23:40 - 00000716 _____ () C:\Users\Public\Desktop\Czech Soccer Manager.lnk
2014-02-10 09:44 - 2014-02-10 09:44 - 00038744 _____ () C:\Windows\SysWOW64\DiscHandler.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-02-09 03:57 - 2014-02-09 03:57 - 00000000 ____D () C:\Program Files\Java
2014-02-09 03:37 - 2014-02-09 03:37 - 00000000 ____D () C:\Users\moje\AppData\Roaming\AVAST Software
2014-02-09 03:36 - 2014-02-23 12:21 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-09 03:36 - 2014-02-09 03:36 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-09 03:36 - 2014-02-09 03:36 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-09 03:35 - 2014-02-09 03:35 - 00000000 ____D () C:\Program Files\AVAST Software
2014-02-09 03:34 - 2014-02-09 03:34 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-08 20:29 - 2014-02-09 21:09 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Ventrilo
2014-02-08 20:29 - 2014-02-08 20:29 - 00000268 _____ () C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2014-02-08 20:29 - 2014-02-08 20:29 - 00000000 ____D () C:\Program Files (x86)\Ventrilo
2014-02-07 23:44 - 2014-02-07 23:54 - 00000000 ____D () C:\Users\moje\Documents\Baldur's Gate - Enhanced Edition
2014-02-07 23:44 - 2014-02-07 23:44 - 00466456 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00444952 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-02-07 23:40 - 2014-02-09 03:53 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Software Systems
2014-02-02 12:33 - 2014-02-02 13:32 - 00174080 _____ () C:\Users\moje\Desktop\vyuctovani marek-leden.xls
2014-02-01 23:47 - 2014-02-02 03:27 - 00000000 ____D () C:\Windows\Minidump
2014-01-28 23:02 - 2014-02-05 21:36 - 04778496 _____ () C:\Users\moje\Desktop\TOP Marek Kotyk.ppt
2014-01-28 22:51 - 2014-01-28 22:51 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-01-24 21:35 - 2014-02-23 12:31 - 00000000 ____D () C:\Users\moje\AppData\Roaming\BitTorrent

==================== One Month Modified Files and Folders =======

2014-02-23 15:35 - 2014-02-23 15:35 - 00007455 _____ () C:\Users\moje\Desktop\FRST.txt
2014-02-23 15:35 - 2014-02-23 15:35 - 00000000 ____D () C:\FRST
2014-02-23 15:34 - 2014-02-23 15:33 - 02154496 _____ (Farbar) C:\Users\moje\Desktop\FRST64.exe
2014-02-23 15:00 - 2014-01-21 20:44 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-23 13:54 - 2014-02-23 12:43 - 00000000 ____D () C:\Users\moje\AppData\Roaming\iSafe
2014-02-23 13:52 - 2013-12-25 10:54 - 00000000 ____D () C:\Users\moje\AppData\Local\PMB Files
2014-02-23 13:52 - 2013-12-25 10:54 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-23 13:42 - 2009-07-14 05:45 - 00014032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-23 13:42 - 2009-07-14 05:45 - 00014032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-23 13:41 - 2009-07-14 16:18 - 00665706 _____ () C:\Windows\system32\perfh005.dat
2014-02-23 13:41 - 2009-07-14 16:18 - 00139402 _____ () C:\Windows\system32\perfc005.dat
2014-02-23 13:41 - 2009-07-14 06:13 - 01575230 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-23 13:38 - 2013-12-25 01:01 - 01104386 _____ () C:\Windows\WindowsUpdate.log
2014-02-23 13:35 - 2014-02-23 13:35 - 00000168 _____ () C:\Windows\setupact.log
2014-02-23 13:35 - 2014-02-23 13:35 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-23 13:35 - 2014-01-21 20:44 - 00000944 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-23 13:35 - 2013-12-25 01:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-23 13:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-23 13:34 - 2014-02-23 13:34 - 00001490 _____ () C:\Windows\PFRO.log
2014-02-23 12:44 - 2014-02-23 12:44 - 00000000 ____D () C:\Windows\system32\log
2014-02-23 12:44 - 2014-02-23 12:44 - 00000000 ____D () C:\Users\moje\AppData\Roaming\eCyber
2014-02-23 12:31 - 2014-01-24 21:35 - 00000000 ____D () C:\Users\moje\AppData\Roaming\BitTorrent
2014-02-23 12:21 - 2014-02-09 03:36 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-23 11:13 - 2013-12-25 12:20 - 00000000 ____D () C:\Users\moje\AppData\Local\genienext
2014-02-23 11:12 - 2013-12-25 12:14 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-02-23 11:00 - 2013-12-25 12:20 - 00000000 ____D () C:\Users\moje\AppData\Roaming\newnext.me
2014-02-23 02:50 - 2014-02-16 15:47 - 00000000 ____D () C:\Users\moje\AppData\Roaming\TS3Client
2014-02-23 02:50 - 2013-12-25 01:35 - 00000000 ____D () C:\Users\moje\AppData\Roaming\DAEMON Tools Lite
2014-02-22 23:48 - 2013-12-26 00:06 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Mumble
2014-02-22 19:43 - 2013-12-25 10:59 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-22 19:39 - 2014-02-22 19:39 - 00000782 _____ () C:\Users\moje\Desktop\Medieval II Total War.lnk
2014-02-22 19:37 - 2014-02-22 19:37 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sega
2014-02-22 19:25 - 2014-02-22 19:25 - 00000000 ____D () C:\Users\moje\AppData\Roaming\InstallShield
2014-02-20 22:47 - 2014-02-20 22:47 - 00000000 __RHD () C:\Users\moje\AppData\Roaming\SecuROM
2014-02-20 22:33 - 2014-02-18 21:23 - 00012704 _____ () C:\Users\moje\Desktop\zamereni 1Q.xlsx
2014-02-18 22:09 - 2014-02-18 22:09 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-18 22:09 - 2013-12-25 01:24 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-02-18 19:03 - 2014-02-18 19:02 - 01904234 _____ () C:\Users\moje\Desktop\FSIP_Q1_2014.xlsx
2014-02-16 15:47 - 2014-02-16 15:47 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-02-16 15:47 - 2014-02-16 15:47 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-02-16 02:47 - 2014-02-16 02:46 - 00000000 ____D () C:\Windows\SysWOW64\C2MP
2014-02-15 21:07 - 2014-02-10 23:40 - 00000000 ____D () C:\Users\moje\Documents\CSM
2014-02-12 20:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-11 21:55 - 2014-01-21 20:44 - 00003944 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-11 21:55 - 2014-01-21 20:44 - 00003692 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-10 23:40 - 2014-02-10 23:40 - 00000716 _____ () C:\Users\Public\Desktop\Czech Soccer Manager.lnk
2014-02-10 09:44 - 2014-02-10 09:44 - 00038744 _____ () C:\Windows\SysWOW64\DiscHandler.exe
2014-02-09 21:09 - 2014-02-08 20:29 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Ventrilo
2014-02-09 03:57 - 2014-02-09 03:57 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-09 03:57 - 2014-02-09 03:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-02-09 03:57 - 2014-02-09 03:57 - 00000000 ____D () C:\Program Files\Java
2014-02-09 03:54 - 2013-12-28 18:43 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-09 03:54 - 2013-12-28 18:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-09 03:54 - 2013-12-27 12:12 - 00000000 ____D () C:\Users\moje\AppData\Local\Adobe
2014-02-09 03:53 - 2014-02-07 23:40 - 00000000 ____D () C:\Users\moje\AppData\Roaming\Software Systems
2014-02-09 03:37 - 2014-02-09 03:37 - 00000000 ____D () C:\Users\moje\AppData\Roaming\AVAST Software
2014-02-09 03:37 - 2013-12-27 12:13 - 00000000 ____D () C:\Users\moje\AppData\Local\Google
2014-02-09 03:36 - 2014-02-09 03:36 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-09 03:36 - 2014-02-09 03:36 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-02-09 03:36 - 2014-02-09 03:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-09 03:35 - 2014-02-09 03:35 - 00000000 ____D () C:\Program Files\AVAST Software
2014-02-09 03:34 - 2014-02-09 03:34 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-08 20:29 - 2014-02-08 20:29 - 00000268 _____ () C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2014-02-08 20:29 - 2014-02-08 20:29 - 00000000 ____D () C:\Program Files (x86)\Ventrilo
2014-02-08 19:34 - 2014-02-18 22:03 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-08 19:34 - 2014-02-18 22:03 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-08 19:34 - 2014-02-18 22:03 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-08 19:34 - 2013-12-25 01:24 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-02-08 19:34 - 2013-12-25 01:24 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-02-08 19:34 - 2013-12-25 01:16 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-02-08 19:34 - 2013-12-25 01:16 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-02-08 19:34 - 2013-12-25 01:16 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-02-08 19:34 - 2013-12-25 01:16 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-02-08 19:34 - 2013-12-25 01:16 - 00024544 _____ () C:\Windows\system32\nvinfo.pb
2014-02-08 18:42 - 2014-01-08 21:20 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-02-08 18:42 - 2013-12-25 01:24 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-02-08 18:42 - 2013-12-25 01:24 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-02-08 18:42 - 2013-12-25 01:24 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-02-08 18:42 - 2013-12-25 01:24 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-02-08 18:42 - 2013-12-25 01:24 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-02-08 17:18 - 2014-02-18 22:09 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-02-07 23:54 - 2014-02-07 23:44 - 00000000 ____D () C:\Users\moje\Documents\Baldur's Gate - Enhanced Edition
2014-02-07 23:44 - 2014-02-07 23:44 - 00466456 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00444952 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2014-02-07 23:44 - 2014-02-07 23:44 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-02-07 23:44 - 2014-01-03 19:46 - 00000000 ____D () C:\Users\moje\AppData\Roaming\NVIDIA
2014-02-05 21:36 - 2014-01-28 23:02 - 04778496 _____ () C:\Users\moje\Desktop\TOP Marek Kotyk.ppt
2014-02-05 18:52 - 2013-12-25 01:24 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin
2014-02-02 13:32 - 2014-02-02 12:33 - 00174080 _____ () C:\Users\moje\Desktop\vyuctovani marek-leden.xls
2014-02-02 03:27 - 2014-02-01 23:47 - 00000000 ____D () C:\Windows\Minidump
2014-01-28 22:51 - 2014-01-28 22:51 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

Files to move or delete:
====================
C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-02-18 19:27

==================== End Of Log ============================

Tady jsem zapomněl poslat přílohu a ještě pro upřesnění mám WIN7 64bit

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Start
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-3907286517-672894021-1733755433-1001\...\Run: [CrashHandle] - C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe [182784 2014-01-13] () <===== ATTENTION

C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe

Hosts:
CMD: shutdown /r /f /t 2

End

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

Kliknete na Fix
Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-02-2014 01
Ran by moje at 2014-02-23 17:59:19 Run:2
Running from C:\Users\moje\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-3907286517-672894021-1733755433-1001\...\Run: [CrashHandle] - C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe [182784 2014-01-13] () <===== ATTENTION

C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe

Hosts:
CMD: shutdown /r /f /t 2

End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\NvBackend => Unable to delete value
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Unable to delete value
HKU\S-1-5-21-3907286517-672894021-1733755433-1001\Software\Microsoft\Windows\CurrentVersion\Run\\CrashHandle => Unable to delete value
"C:\Users\moje\AppData\Local\Temp\RarSFX1\SystemWhileIdle.exe" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========

========= End of CMD: =========

==== End of Fixlog ====

Stahnete Malwarebytes Anti-Rootkit http://www.bleepingcomputer.com/downloa ... i-rootkit/

Ulozte nejlepe na Plochu a rozbalte
Spustte kliknutim na mbar
Nyni postupne kliknete na Next a Update
Po dokonceni update (aktualizace) databaze kliknete opet na Next
Nechte zaskrtnute vsechny tri moznosti a klinete na Scan cimz spustite prohledavani PC
Po dokonceni skenu (cca 5 minutek) zkontrolujte, zda-li je u vsech nalezu (samozrejme pokud budou) zatrzitko
Tez zkontrolujte, jetsli je zatrzitko u Create Restore point
Nyni kliknete na CleanUp cimz nalezenou infekci odstranime
PC bude restartovan
Slozka mbar by mela obsahovat log (a zrejme se i sam otevre) mbar-log-rok-mesic-den (hodina-minuta-sekunda).txt, ten mi sem dejte

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

Provedte aktualizaci
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Tak první posílám log MBARU :

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.116000 GHz
Memory total: 4294500352, free: 2347962368

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.116000 GHz
Memory total: 4294500352, free: 2348945408

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.116000 GHz
Memory total: 4294500352, free: 2352607232

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.116000 GHz
Memory total: 4294500352, free: 2355515392

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.116000 GHz
Memory total: 4294500352, free: 2995654656

Could not load protection driver
Downloaded database version: v2014.02.23.07
Downloaded database version: v2014.02.20.01
=======================================
Initializing...
------------ Kernel report ------------
02/23/2014 19:01:07
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\spxx.sys
\SystemRoot\System32\Drivers\WMILIB.SYS
\SystemRoot\System32\Drivers\SCSIPORT.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\pciide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\nvstor.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\??\C:\Windows\system32\drivers\aswSnx.sys
\??\C:\Windows\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\??\C:\Windows\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\amdk8.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvm62x64.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\Drivers\auvyf0rv.SYS
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_nvstor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\aswStm.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\kernel32.dll
\Windows\System32\difxapi.dll
\Windows\System32\Wldap32.dll
\Windows\System32\imm32.dll
\Windows\System32\lpk.dll
\Windows\System32\msvcrt.dll
\Windows\System32\clbcatq.dll
\Windows\System32\oleaut32.dll
\Windows\System32\nsi.dll
\Windows\System32\shlwapi.dll
\Windows\System32\normaliz.dll
\Windows\System32\setupapi.dll
\Windows\System32\sechost.dll
\Windows\System32\usp10.dll
\Windows\System32\urlmon.dll
\Windows\System32\ws2_32.dll
\Windows\System32\psapi.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\msctf.dll
\Windows\System32\wininet.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ole32.dll
\Windows\System32\user32.dll
\Windows\System32\shell32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\iertutil.dll
\Windows\System32\advapi32.dll
\Windows\System32\gdi32.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\comctl32.dll
\Windows\System32\devobj.dll
\Windows\System32\crypt32.dll
\Windows\System32\wintrust.dll
\Windows\System32\KernelBase.dll
\Windows\System32\msasn1.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004959060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000005b\
Lower Device Object: 0xfffffa800480d060
Lower Device Driver Name: \Driver\nvstor\
IRP handler 0 of \Driver\nvstor points to an unknown module
Unhooking enabled.
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004959060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000005b\
Lower Device Object: 0xfffffa800480d060
Lower Device Driver Name: \Driver\nvstor\
Driver name found: nvstor
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\storport.sys (0x0)
Load Function returned 0x0
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004959060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004959ab0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004959060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800481de40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800480d060, DeviceName: \Device\0000005b\, DriverName: \Driver\nvstor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a00415d550, 0xfffffa8004959060, 0xfffffa8003d03790
Lower DeviceData: 0xfffff8a003e0c170, 0xfffffa800480d060, 0xfffffa8003d05900
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
File user open failed: C:\WINDOWS\SYSTEM32\drivers\sptd.sys (0x00000020)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: DDA7DDA7

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 74489856

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 74696704 Numsec = 413696000

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 250058268160 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488375055-488395055)...
Done!
Scan finished
=======================================

Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

-------------------------------------------------------------------------------------------------------------

Tady je log z programu MBAM :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.23.07

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
moje :: MOJE-PC [administrátor]

23.2.2014 19:22:09
MBAM-log-2014-02-23 (19-47-35).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 304333
Uplynulý čas: 25 minut, 11 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2977C29A-6723-4436-90BB-F7C5FDEF88A1} (PUP.Optional.BestToolbars) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 7
C:\Users\moje\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\OpenCandy\23743550C5F04CA182D8DF0B42BEB67B (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\OpenCandy\EE3412A49778406DB45A139D8A1D5C25 (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\freegames4357 (PUP.Optional.FreeGames.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\speedtest4354 (PUP.Optional.SpeedTest.A) -> Nebyla provedena žádná instrukce.

Nalezené soubory: 14
C:\Users\moje\AppData\Roaming\OpenCandy\EE3412A49778406DB45A139D8A1D5C25\LatestDLMgr.exe (PUP.Optional.OpenCandy.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\OpenCandy\EE3412A49778406DB45A139D8A1D5C25\Setup507_p1v3.exe (PUP.Optional.NextLive.A) -> Nebyla provedena žádná instrukce.
C:\Windows\Setup\SCRIPTS\Windows7Loader.exe (Trojan.Agent.W) -> Nebyla provedena žádná instrukce.
D:\moje\Programy\NOD32 Fixator v2.1.exe (PUP.RiskWareTool.CK) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\OpenCandy\23743550C5F04CA182D8DF0B42BEB67B\avg_tuht_stf_cs_2014_206_CZ.exe (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\OpenCandy\EE3412A49778406DB45A139D8A1D5C25\6942.ico (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\freegames4357\freegames4357.crx (PUP.Optional.FreeGames.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\freegames4357\freegames4357DeskTopIcon.ico (PUP.Optional.FreeGames.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\freegames4357\install_helper.exe (PUP.Optional.FreeGames.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\speedtest4354\install_helper.exe (PUP.Optional.SpeedTest.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\speedtest4354\speedtest4354.crx (PUP.Optional.SpeedTest.A) -> Nebyla provedena žádná instrukce.
C:\Users\moje\AppData\Roaming\speedtest4354\speedtest4354DeskTopIcon.ico (PUP.Optional.SpeedTest.A) -> Nebyla provedena žádná instrukce.

(konec)

Legalni windows nepouzivate co

mám legální visty a bylo mě nabídnuto zdarma si upgradovat je na win7 ale když jsem před časem dělal reinstal win tak už mě to nepřijmulo cd klíč takže mi kamarád pak pc reinstaloval a zda použil origo cd key který jsem měl a nebo ne to nevím . aktualizace ale nemám zapnuté.

V PC je jednoznacne pouzit crack, takze kamarad je supr kamarad, kdyz Vas vedomne vystavuje riziku trestniho stihani

Obratil bychs e na tehcnickou podporu, ktera by mela problem s tim klicem vyresit, jelikoz jste jej mel zakoupen, tak proc jej nevyuzivat...

A proc nemate ty aktualizace zapnute?

Ani nevím proč, tak jsem to již od něj dostal asi si chtěl usnadnit práci tak to vyřešil tak ... mám sem napsal cd key co mám na ty visty ? tak to by bylo asi rychlejší kdybych si to formatoval a dal z5 visty nebo se obrátil na tu podporu ?

děkuju

Sem ten CD key nepiste, Visty nedavejte (to nebyl zrovna povedeny system)

Obratte se na technickou podporu, at Vam poradi jak postupovat

Nalezy MBAMu smazte

díky moc za ochotu a za upozornění, jdu na to !

Pak napiste a budem pokracovat

VIRY.CZ

viry Win32 ....

viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....

Re: viry Win32 ....