VIRY.CZ

Zdravím, moje mamka otevřela zavirovaný email a teď se jí zobrazuje výzva na OTP.

RSTI LOG

Logfile of random's system information tool 1.10 (written by random/random)
Run by ja at 2015-02-14 12:10:01
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 91 GB (80%) free of 114 GB
Total RAM: 3326 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:12, on 14.2.2015
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\WINDOWS\system32\ctfmon.exe
G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE
G:\PROGRAM FILES\SCANER\ScannerFinder.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ja\Plocha\RSIT.exe
C:\Program Files\trend micro\ja.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Browser Extensions - {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe" -b
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE
O4 - HKCU\..\Run: [UewoXguzi] regsvr32.exe "C:\Documents and Settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = G:\PROGRAM FILES\SCANER\ScannerFinder.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://onlinedesigner.happyfoto.cz/ips- ... jordan.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\WINDOWS\System32\ssins.exe

--
End of file - 6893 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\avast! Emergency Update.job - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\tb91d7mn.default

prefs.js - "keyword.URL" - "https://search.yahoo.com/search?fr=gree ... =201117&p="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.9.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\WINDOWS\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\tb91d7mn.default\searchplugins\
yahoo_ff.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2014-04-17 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-11-21 586968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-04-17 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-12-05 20065384]
"Six Engine"=C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03 5756544]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-07-27 98304]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-01-23 5227112]
"Wondershare Helper Compact.exe"=C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2013-08-26 1989920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Zoner Photo Studio Autoupdate"=G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE [2013-02-18 774168]
"UewoXguzi"=regsvr32.exe C:\Documents and Settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE
Microtek Scanner Finder.lnk - G:\PROGRAM FILES\SCANER\ScannerFinder.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2012-07-28 192512]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LMIRescue_9a27933e-64c6-448b-a2f2-675b7c4180de]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox (C:\Program Files\Mozilla Firefox)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=ctwdm32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======List of files/folders created in the last 1 month======

2015-02-14 12:10:01 ----D---- C:\rsit
2015-02-14 12:10:01 ----D---- C:\Program Files\trend micro
2015-02-13 22:03:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
2015-01-31 16:52:56 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-02-14 12:10:07 ----D---- C:\WINDOWS\Prefetch
2015-02-14 12:10:01 ----D---- C:\Program Files
2015-02-14 10:26:02 ----SHD---- C:\WINDOWS\Installer
2015-02-14 10:26:02 ----D---- C:\Config.Msi
2015-02-14 10:25:51 ----D---- C:\Program Files\Common Files\Adobe
2015-02-14 10:25:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2015-02-14 10:25:36 ----D---- C:\WINDOWS\system32
2015-02-14 10:15:18 ----D---- C:\WINDOWS\system32\CatRoot2
2015-02-14 10:15:15 ----D---- C:\WINDOWS\Temp
2015-02-14 00:14:47 ----A---- C:\WINDOWS\SchedLgU.Txt
2015-02-11 23:57:13 ----D---- C:\WINDOWS\system32\MRT
2015-02-11 23:54:23 ----A---- C:\WINDOWS\system32\MRT.exe
2015-02-11 08:22:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-08 09:00:35 ----A---- C:\WINDOWS\WDICT32.INI
2015-02-07 10:16:20 ----D---- C:\AJUWIN
2015-02-05 12:52:04 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2015-01-31 16:54:41 ----D---- C:\Program Files\Mozilla Maintenance Service
2015-01-27 13:06:14 ----D---- C:\Documents and Settings\ja\Data aplikací\vlc
2015-01-21 08:08:16 ----D---- C:\WINDOWS\Microsoft.NET
2015-01-20 12:50:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\tmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswNdis;avast! Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\aswNdis.sys [2014-01-01 12112]
R0 aswNdis2;avast! Firewall NDIS Driver; C:\WINDOWS\system32\drivers\aswNdis2.sys [2014-11-21 253640]
R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2014-11-21 49944]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2014-11-21 206248]
R0 iteraid;ITERAID_Service_Install; C:\WINDOWS\system32\DRIVERS\iteraid.sys [2005-08-04 26112]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2014-11-21 26136]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2014-11-21 55240]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2014-11-22 787800]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2014-11-21 423784]
R1 aswTdi;aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [2014-11-21 57928]
R1 BANTExt;Belarc SMBios Access; C:\WINDOWS\System32\Drivers\BANTExt.sys [2011-08-09 3840]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2014-11-21 24184]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2014-11-21 70384]
R3 asmthub3;ASMedia USB3 Hub Service; C:\WINDOWS\system32\DRIVERS\asmthub3.sys [2011-11-03 102888]
R3 asmtxhci;ASMEDIA XHCI Service; C:\WINDOWS\system32\DRIVERS\asmtxhci.sys [2011-11-03 313832]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2012-07-28 6646784]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdXP3.sys [2012-05-14 103040]
R3 ctljystk;Game port pro zařízení Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-12-13 7069288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2011-12-08 327400]
R3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-14 12160]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2012-07-28 643072]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-21 50344]
R2 avast! Firewall;avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [2014-11-21 104416]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [2013-01-29 39936]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2014-04-17 182696]
S2 ssinstall;SInstalátor; C:\WINDOWS\System32\ssins.exe [2013-11-01 2324216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05 267440]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2015-01-31 114800]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravim

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Adobe ARM"=-
  "NeroFilterCheck"=-
  "Wondershare Helper Compact.exe"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "Zoner Photo Studio Autoupdate"=-
  "UewoXguzi"=-
  
  :files
  C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
  C:\WINDOWS\tasks\*.job
  C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\tb91d7mn.default\searchplugins\yahoo_ff.xml
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]
  [EMPTYJAVA]

• Nasledne kliknete na Opravit
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Program spustím ale nemám tak popisky a vidím toto http://i.imgur.com/FWse1mk.png

Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Adobe ARM"=-
  "NeroFilterCheck"=-
  "Wondershare Helper Compact.exe"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "Zoner Photo Studio Autoupdate"=-
  "UewoXguzi"=-
  
  :files
  C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
  C:\WINDOWS\tasks\*.job
  C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\tb91d7mn.default\searchplugins\yahoo_ff.xml
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]
  [EMPTYJAVA]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

Tak bohužel OTM to samé http://imgur.com/UUdgres

Jedná se o počítač Windows XP Service Pack 3

Dejte tedy log z FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-02-2015
Ran by ja (administrator) on JA-87B8CA26DB6C on 14-02-2015 14:33:26
Running from C:\Documents and Settings\ja\Plocha
Loaded Profiles: ja (Available profiles: ja)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Čeština
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(C-Dilla Ltd) C:\WINDOWS\system32\drivers\CDAC11BA.EXE
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
(Creative Technology Ltd.) C:\WINDOWS\system32\devldr32.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(ZONER software) G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTray.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() G:\PROGRAM FILES\SCANER\ScannerFinder.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(forum.viry.cz) C:\Documents and Settings\ja\Plocha\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [20065384 2011-12-05] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Six Engine] => C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [5756544 2010-02-03] (ASUSTeK Computer Inc.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2012-07-27] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [NeroFilterCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-23] (AVAST Software)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1989920 2013-08-26] (Wondershare)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [Zoner Photo Studio Autoupdate] => G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [UewoXguzi] => regsvr32.exe "C:\Documents and Settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb"
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microtek Scanner Finder.lnk
ShortcutTarget: Microtek Scanner Finder.lnk -> G:\PROGRAM FILES\SCANER\ScannerFinder.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> DefaultScope {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
BHO: No Name -> {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> &Adresa - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
Toolbar: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} http://onlinedesigner.happyfoto.cz/ips- ... jordan.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
Tcpip\Parameters: [DhcpNameServer] 213.46.172.36 213.46.172.37

FireFox:
========
FF ProfilePath: C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\yc230oss.default
FF DefaultSearchEngine: Seznam
FF DefaultSearchUrl: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF SearchEngineOrder.1: Seznam
FF SelectedSearchEngine: Seznam
FF Homepage: https://www.seznam.cz/?clid=22668
FF Keyword.URL: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Documents and Settings\ja\Data aplikací\Mozilla\Firefox\Profiles\yc230oss.default\searchplugins\seznam-avast.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-01-21]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-01-19]

Chrome:
=======
CHR Profile: C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-15]
CHR Extension: (Disk Google) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-15]
CHR Extension: (YouTube) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-15]
CHR Extension: (Vyhledávání Google) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-15]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-07-15]
CHR Extension: (Peněženka Google) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-15]
CHR Extension: (Gmail) - C:\Documents and Settings\ja\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-15]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-21] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-21] (AVAST Software)
R2 C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [39936 2013-01-29] (C-Dilla Ltd) [File not signed]
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-04-17] (Oracle Corporation)
S2 ssinstall; C:\WINDOWS\System32\ssins.exe [2324216 2013-11-01] (PS Media s.r.o.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R1 AmdPPM; C:\WINDOWS\System32\DRIVERS\AmdPPM.sys [33792 2007-04-16] (Advanced Micro Devices)
R1 AsIO; C:\WINDOWS\System32\drivers\AsIO.sys [11296 2009-08-04] ()
R3 asmthub3; C:\WINDOWS\System32\DRIVERS\asmthub3.sys [102888 2011-11-03] (ASMedia Technology Inc)
R3 asmtxhci; C:\WINDOWS\System32\DRIVERS\asmtxhci.sys [313832 2011-11-03] (ASMedia Technology Inc)
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24184 2014-11-21] ()
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [26136 2014-11-21] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [70384 2014-11-21] (AVAST Software)
R0 aswNdis; C:\WINDOWS\System32\DRIVERS\aswNdis.sys [12112 2014-01-01] (ALWIL Software)
R0 aswNdis2; C:\WINDOWS\system32\Drivers\aswNdis2.sys [253640 2014-11-21] (AVAST Software)
R1 AswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [55240 2014-11-21] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944 2014-11-21] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [787800 2014-11-22] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [423784 2014-11-21] (AVAST Software)
R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57928 2014-11-21] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [206248 2014-11-21] ()
R3 AtiHDAudioService; C:\WINDOWS\System32\drivers\AtihdXP3.sys [103040 2012-05-14] (Advanced Micro Devices)
R1 BANTExt; C:\WINDOWS\System32\Drivers\BANTExt.sys [3840 2011-08-09] () [File not signed]
R3 ctljystk; C:\WINDOWS\System32\DRIVERS\ctljystk.sys [3712 2001-08-17] (Creative Technology Ltd.)
R3 emu10k; C:\WINDOWS\System32\drivers\emu10k1m.sys [283904 2001-08-17] (Creative Technology Ltd.)
R3 emu10k1; C:\WINDOWS\System32\drivers\ctlfacem.sys [6912 2001-08-17] (Creative Technology Ltd.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-14] (Microsoft Corporation)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R3 sfman; C:\WINDOWS\System32\drivers\sfmanm.sys [36480 2001-08-17] (Creative Technology Ltd.)
S4 IntelIde; No ImagePath
U1 WS2IFSL; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 14:33 - 2015-02-14 14:33 - 00013908 _____ () C:\Documents and Settings\ja\Plocha\FRST.txt
2015-02-14 14:33 - 2015-02-14 14:33 - 00000000 ____D () C:\FRST
2015-02-14 14:29 - 2015-02-14 14:20 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\ja\Plocha\FRSTLauncher.exe
2015-02-14 14:28 - 2015-02-14 14:20 - 01125888 _____ (Farbar) C:\Documents and Settings\ja\Plocha\FRST.exe
2015-02-14 14:27 - 2015-02-14 14:20 - 01125888 _____ (Farbar) C:\Documents and Settings\ja\FRST.exe
2015-02-14 13:57 - 2015-02-14 13:57 - 00000000 ____D () C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory
2015-02-14 13:45 - 2015-02-14 13:46 - 00000000 ____D () C:\Documents and Settings\Administrator\Data aplikací\Mozilla
2015-02-14 13:45 - 2015-02-14 13:45 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Mozilla
2015-02-14 13:37 - 2015-02-14 13:57 - 00000000 ____D () C:\Documents and Settings\Administrator\Dokumenty
2015-02-14 13:37 - 2015-02-14 13:46 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Temp
2015-02-14 13:37 - 2015-02-14 13:45 - 00000000 __RHD () C:\Documents and Settings\Administrator\Data aplikací
2015-02-14 13:37 - 2015-02-14 13:37 - 00000020 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2015-02-14 13:37 - 2015-02-14 13:37 - 00000000 __SHD () C:\Documents and Settings\Administrator\IETldCache
2015-02-14 13:37 - 2015-02-14 13:37 - 00000000 ____D () C:\Documents and Settings\Administrator
2015-02-14 13:37 - 2013-01-19 13:14 - 00001605 _____ () C:\Documents and Settings\Administrator\Nabídka Start\Programy\Vzdálená pomoc.lnk
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ___RD () C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ___RD () C:\Documents and Settings\Administrator\Nabídka Start
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ___HD () C:\Documents and Settings\Administrator\Okolní tiskárny
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ___HD () C:\Documents and Settings\Administrator\Okolní síť
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ____D () C:\Documents and Settings\Administrator\Plocha
2015-02-14 13:37 - 2013-01-19 08:07 - 00000000 ____D () C:\Documents and Settings\Administrator\Oblíbené položky
2015-02-14 13:37 - 2013-01-19 07:20 - 00000792 _____ () C:\Documents and Settings\Administrator\Nabídka Start\Programy\Windows Media Player.lnk
2015-02-14 13:37 - 2013-01-19 07:20 - 00000000 ___RD () C:\Documents and Settings\Administrator\Nabídka Start\Programy\Příslušenství
2015-02-14 13:37 - 2013-01-19 07:20 - 00000000 ___RD () C:\Documents and Settings\Administrator\Nabídka Start\Programy
2015-02-14 13:37 - 2013-01-19 07:20 - 00000000 ___HD () C:\Documents and Settings\Administrator\Local Settings\Data aplikací
2015-02-14 13:37 - 2013-01-19 07:17 - 00000000 ___HD () C:\Documents and Settings\Administrator\Šablony
2015-02-14 13:28 - 2015-02-14 13:28 - 00000000 ____D () C:\Documents and Settings\ja\Data aplikací\TeamViewer
2015-02-14 13:20 - 2015-02-13 15:12 - 00522240 _____ (OldTimer Tools) C:\Documents and Settings\ja\Plocha\OTM.exe
2015-02-14 13:05 - 2015-02-14 13:05 - 00000000 ____D () C:\Program Files\Common Files\ParetoLogic
2015-02-14 13:05 - 2015-02-14 13:05 - 00000000 ____D () C:\Documents and Settings\ja\Data aplikací\ParetoLogic
2015-02-14 13:05 - 2015-02-14 13:05 - 00000000 ____D () C:\Documents and Settings\ja\Data aplikací\DriverCure
2015-02-14 13:05 - 2015-02-14 13:05 - 00000000 ____D () C:\Documents and Settings\ja\Data aplikací\BrowserExtensions
2015-02-14 13:05 - 2015-02-14 13:05 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\ParetoLogic
2015-02-14 12:11 - 2015-02-14 12:15 - 00000000 ____D () C:\AdwCleaner
2015-02-14 12:10 - 2015-02-14 13:05 - 00000000 ____D () C:\Program Files\trend micro
2015-02-14 12:10 - 2015-02-14 12:10 - 00000000 ____D () C:\rsit
2015-02-13 22:03 - 2015-02-13 22:03 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
2015-01-31 16:52 - 2015-02-04 23:16 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 14:33 - 2013-01-19 08:02 - 00000000 ____D () C:\Documents and Settings\ja\Plocha
2015-02-14 14:33 - 2013-01-19 08:02 - 00000000 ____D () C:\Documents and Settings\ja\Local Settings\Temp
2015-02-14 14:31 - 2013-01-19 08:02 - 00000000 ___HD () C:\Documents and Settings\ja\Local Settings\Data aplikací
2015-02-14 14:27 - 2013-01-19 10:36 - 00000364 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job
2015-02-14 14:27 - 2013-01-19 08:02 - 00000000 ____D () C:\Documents and Settings\ja
2015-02-14 14:23 - 2013-01-19 07:19 - 01904821 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-14 14:22 - 2014-03-28 07:35 - 00000216 _____ () C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
2015-02-14 14:22 - 2013-11-01 12:30 - 00000000 _____ () C:\WINDOWS\system32\sinstall.log
2015-02-14 14:22 - 2013-01-19 08:08 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-02-14 14:22 - 2013-01-19 08:08 - 00000049 _____ () C:\WINDOWS\wiaservc.log
2015-02-14 14:22 - 2013-01-19 07:24 - 00032472 _____ () C:\WINDOWS\SchedLgU.Txt
2015-02-14 14:22 - 2013-01-19 07:24 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-14 14:05 - 2013-01-19 10:10 - 00524288 _____ () C:\WINDOWS\system32\config\ACEEvent.evt
2015-02-14 14:05 - 2013-01-19 08:02 - 00000272 ___SH () C:\Documents and Settings\ja\ntuser.ini
2015-02-14 13:40 - 2013-01-19 08:08 - 00004702 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-14 13:28 - 2013-01-19 08:02 - 00000000 __RHD () C:\Documents and Settings\ja\Data aplikací
2015-02-14 13:05 - 2013-01-19 10:25 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-02-14 13:05 - 2013-01-19 10:24 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\Adobe
2015-02-14 13:05 - 2013-01-19 08:07 - 00000000 ___RD () C:\Documents and Settings\All Users\Nabídka Start\Programy
2015-02-14 13:05 - 2013-01-19 08:07 - 00000000 ____D () C:\Documents and Settings\All Users\Plocha
2015-02-14 13:05 - 2013-01-19 07:24 - 00000000 __SHD () C:\Documents and Settings\LocalService
2015-02-14 13:05 - 2013-01-19 07:21 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2015-02-14 13:05 - 2013-01-19 07:18 - 00000000 ____D () C:\WINDOWS\Registration
2015-02-14 12:15 - 2013-01-19 08:07 - 00000000 __RHD () C:\Documents and Settings\All Users\Data aplikací
2015-02-14 11:52 - 2013-01-19 10:24 - 00000914 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-02-14 08:32 - 2008-04-14 13:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2015-02-11 23:57 - 2013-08-15 06:51 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-11 23:54 - 2013-01-19 10:17 - 113756392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-11 20:46 - 2013-01-19 08:02 - 00000000 ___RD () C:\Documents and Settings\ja\Dokumenty\Obrázky
2015-02-08 15:00 - 2014-03-28 07:35 - 00000210 _____ () C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
2015-02-08 09:00 - 2013-01-19 17:11 - 00002321 _____ () C:\WINDOWS\WDICT32.INI
2015-02-07 10:16 - 2013-01-19 15:17 - 00000000 ____D () C:\AJUWIN
2015-02-05 12:52 - 2013-01-19 10:24 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-02-05 12:52 - 2013-01-19 10:24 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-02-04 18:36 - 2013-01-19 08:02 - 00000000 ___RD () C:\Documents and Settings\ja\Oblíbené položky
2015-01-31 16:54 - 2013-11-01 15:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-01-27 13:06 - 2013-01-19 10:22 - 00000000 ____D () C:\Documents and Settings\ja\Data aplikací\vlc
2015-01-23 22:12 - 2013-01-19 08:07 - 00925118 _____ () C:\WINDOWS\setupapi.log
2015-01-21 08:08 - 2013-01-19 10:06 - 00000000 ____D () C:\WINDOWS\Microsoft.NET
2015-01-20 12:50 - 2014-10-28 11:08 - 00000000 ____D () C:\Documents and Settings\All Users\Data aplikací\tmp

==================== Files in the root of some directories =======

2013-01-19 10:47 - 2013-12-23 14:30 - 0005632 _____ () C:\Documents and Settings\ja\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Files to move or delete:
====================
C:\Documents and Settings\ja\FRST.exe


Some content of TEMP:
====================
C:\Documents and Settings\ja\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\ja\Local Settings\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed




===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: (Systém) (Fixed) (Total:111.78 GB) (Free:88.52 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive g: (Prg a data) (Fixed) (Total:149.04 GB) (Free:138.52 GB) NTFS
Drive h: (ZÁLOHA) (Fixed) (Total:111.79 GB) (Free:65.78 GB) NTFS

Available physical RAM: 2698.52 MB
Total physical RAM: 3326.04 MB
Percentage of memory in use: 18%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows XP) (Size: 111.8 GB) (Disk ID: 2558B64F)
Partition 1: (Not Active) - (Size=111.8 GB) - (Type=07 NTFS)
Disk: 1 (Size: 111.8 GB) (Disk ID: 282A2829)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
Disk: 3 (Size: 149 GB) (Disk ID: FAC3FAC3)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: avast! Antivirus (Disabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Antivirus (Disabled) {7591DB91-41F0-48A3-B128-1A293FD8233D}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Documents and Settings\ja\Plocha" je 13 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox (C:\\Program Files\\Mozilla Firefox)"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000


==================== End Of Log ==============================

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  
  HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
  HKLM\...\Run: [NeroFilterCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
  HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1989920 2013-08-26] (Wondershare)
  HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [Zoner Photo Studio Autoupdate] => G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
  HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [UewoXguzi] => regsvr32.exe "C:\Documents and Settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb"
  Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
  Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microtek Scanner Finder.lnk
  
  HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> DefaultScope {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
  SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
  BHO: No Name -> {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> No File
  Toolbar: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
  
  FF DefaultSearchUrl: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
  FF Homepage: https://www.seznam.cz/?clid=22668
  FF Keyword.URL: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
  
  C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
  2015-02-14 14:33 - 2015-02-14 14:33 - 00013908 _____ () C:\Documents and Settings\ja\Plocha\FRST.txt
  2015-02-14 14:29 - 2015-02-14 14:20 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\ja\Plocha\FRSTLauncher.exe
  2013-01-19 10:47 - 2013-12-23 14:30 - 0005632 _____ () C:\Documents and Settings\ja\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  
  Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
  Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
  Task: C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe
  Task: C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe
  
  Hosts:
  EmptyTemp:
  Reboot:
  End
  

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-02-2015
Ran by ja at 2015-02-14 17:15:04 Run:1
Running from C:\Documents and Settings\ja\Plocha
Loaded Profiles: ja (Available profiles: ja)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [NeroFilterCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1989920 2013-08-26] (Wondershare)
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [Zoner Photo Studio Autoupdate] => G:\PROGRAM FILES\ZONER10\Photo Studio 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\...\Run: [UewoXguzi] => regsvr32.exe "C:\Documents and Settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb"
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microtek Scanner Finder.lnk

HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> DefaultScope {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> {153517BF-676A-4E37-BF2E-D81D02FA3760} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
BHO: No Name -> {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> No File
Toolbar: HKU\S-1-5-21-1409082233-1580818891-1801674531-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

FF DefaultSearchUrl: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF Homepage: https://www.seznam.cz/?clid=22668
FF Keyword.URL: hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&

C:\Documents and Settings\All Users\Data aplikací\UewoXguzi
2015-02-14 14:33 - 2015-02-14 14:33 - 00013908 _____ () C:\Documents and Settings\ja\Plocha\FRST.txt
2015-02-14 14:29 - 2015-02-14 14:20 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\ja\Plocha\FRSTLauncher.exe
2013-01-19 10:47 - 2013-12-23 14:30 - 0005632 _____ () C:\Documents and Settings\ja\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Wondershare Helper Compact.exe => value deleted successfully.
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Run\\Zoner Photo Studio Autoupdate => value deleted successfully.
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Run\\UewoXguzi => value deleted successfully.
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk => Moved successfully.
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microtek Scanner Finder.lnk => Moved successfully.
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{153517BF-676A-4E37-BF2E-D81D02FA3760}" => Key deleted successfully.
HKCR\CLSID\{153517BF-676A-4E37-BF2E-D81D02FA3760} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}" => Key deleted successfully.
HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} => Key not found.
HKU\S-1-5-21-1409082233-1580818891-1801674531-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
Firefox DefaultSearchUrl deleted successfully.
Firefox homepage deleted successfully.
Firefox Keyword.URL deleted successfully.
C:\Documents and Settings\All Users\Data aplikací\UewoXguzi => Moved successfully.
C:\Documents and Settings\ja\Plocha\FRST.txt => Moved successfully.
C:\Documents and Settings\ja\Plocha\FRSTLauncher.exe => Moved successfully.
C:\Documents and Settings\ja\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => Moved successfully.
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\WINDOWS\Tasks\avast! Emergency Update.job => Moved successfully.
C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job => Moved successfully.
C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 767.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog 17:15:30 ====

Jak se chova PC??

Zkoušel jsem to v IE i Firefox a žádná změna. Pořád mi tam vyskočí OTP

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Rkill LOG

Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/14/2015 05:59:02 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\WINDOWS\system32\drivers\CDAC11BA.EXE (PID: 528) [WD-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 02/14/2015 05:59:25 PM
Execution time: 0 hours(s), 0 minute(s), and 23 seconds(s)

ComboFix log

ComboFix 15-02-13.02 - ja 14.02.2015 18:11:58.1.6 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3326.2754 [GMT 1:00]
Spuštěný z: c:\documents and settings\ja\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ja\FRST.exe
c:\documents and settings\ja\Local Settings\Data aplikací\MSGBOX.EXE
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-01-14 do 2015-02-14 )))))))))))))))))))))))))))))))
.
.
2015-02-14 16:15 . 2015-02-14 16:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\UewoXguzi
2015-02-14 13:33 . 2015-02-14 16:15 -------- d-----w- C:\FRST
2015-02-14 12:37 . 2015-02-14 12:37 -------- d-----w- c:\documents and settings\Administrator
2015-02-14 12:28 . 2015-02-14 12:28 -------- d-----w- c:\documents and settings\ja\Data aplikací\TeamViewer
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\windows\system32\wbem\Repository
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\program files\Common Files\ParetoLogic
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\ParetoLogic
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\DriverCure
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\BrowserExtensions
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ParetoLogic
2015-02-14 11:11 . 2015-02-14 11:15 -------- d-----w- C:\AdwCleaner
2015-02-14 11:10 . 2015-02-14 12:05 -------- d-----w- c:\program files\trend micro
2015-02-14 11:10 . 2015-02-14 11:10 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-05 11:52 . 2013-01-19 09:24 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-05 11:52 . 2013-01-19 09:24 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-11-22 06:54 . 2013-01-19 09:36 787800 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-21 21:01 . 2013-01-19 09:36 423784 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-11-21 21:01 . 2014-11-21 21:01 291352 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-21 21:01 . 2014-11-21 21:01 43152 ----a-w- c:\windows\avastSS.scr
2014-11-21 21:01 . 2014-05-03 07:08 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-21 21:01 . 2013-07-27 06:31 70384 ----a-w- c:\windows\system32\drivers\aswmonflt.sys
2014-11-21 21:01 . 2013-07-27 06:31 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-21 21:01 . 2013-07-27 06:31 206248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-21 21:01 . 2013-01-19 09:36 57928 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2014-11-21 21:01 . 2013-01-19 09:36 55240 ----a-w- c:\windows\system32\drivers\aswrdr.sys
2014-11-21 21:01 . 2014-01-01 13:23 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-11-21 21:01 . 2014-01-01 13:23 253640 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2008-04-14 12:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 12:00 50688 --sh--w- c:\windows\twain_32.dll
2011-02-08 13:33 978944 --sh--w- c:\windows\system32\mfc42.dll
2008-04-14 12:00 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 12:00 413696 --sh--w- c:\windows\system32\msvcp60.dll
2008-04-14 12:00 343040 --sh--w- c:\windows\system32\msvcrt.dll
2013-01-26 03:55 552448 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 12:00 84992 --sh--w- c:\windows\system32\olepro32.dll
2008-04-14 12:00 12288 --sh--w- c:\windows\system32\regsvr32.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-21 21:01 723976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UewoXguzi"="c:\documents and settings\All Users\Data aplikací\UewoXguzi\KuhwAlxug.dmb" [2015-02-14 310784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2011-12-05 20065384]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2010-02-03 5756544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-27 98304]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-01-23 5227112]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SoftwareSASGeneration"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [1.1.2014 14:23 12112]
R0 aswNdis2;avast! Firewall NDIS Driver;c:\windows\system32\drivers\aswNdis2.sys [1.1.2014 14:23 253640]
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [27.7.2013 7:31 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [27.7.2013 7:31 206248]
R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [17.1.2013 17:17 26112]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [1.1.2014 14:23 26136]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [19.1.2013 10:36 787800]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [19.1.2013 10:36 423784]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [3.5.2014 8:08 24184]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswmonflt.sys [27.7.2013 7:31 70384]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [1.1.2014 14:23 104416]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [19.1.2013 9:24 102888]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [19.1.2013 9:24 313832]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [19.1.2013 10:08 103040]
S2 ssinstall;SInstalátor;c:\windows\system32\ssins.exe [1.11.2013 15:40 2324216]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19.1.2013 9:22 1691480]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://onlinedesigner.happyfoto.cz/ips-opdata/uploadClients/iplabs/jordan.cab
FF - ProfilePath - c:\documents and settings\ja\Data aplikací\Mozilla\Firefox\Profiles\yc230oss.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
AddRemove-{3A787631-66A2-4634-B928-A37E73B58FB6} - c:\documents and settings\ja\Data aplikací\BrowserExtensions\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-02-14 18:19
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
C:\avast! sandbox
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugFin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1096)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2015-02-14 18:22:27
ComboFix-quarantined-files.txt 2015-02-14 17:22
.
Před spuštěním: Volných bajtů: 95 661 539 328
Po spuštění: Volných bajtů: 95 618 424 832
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 2CB8E305E289A8F9E07C4F10EB9F93F1
413FC2A0C716421B3158746D63736515

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\documents and settings\All Users\Data aplikací\UewoXguzi
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "UewoXguzi"=-
  
  RegLock::
  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
  [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
  [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
  [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugFin.*1*\CLSID]
  [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
  [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Poslední log ComboFixu po přetažení CFScriptu

ComboFix 15-02-13.02 - ja 14.02.2015 18:54:46.2.6 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3326.2824 [GMT 1:00]
Spuštěný z: c:\documents and settings\ja\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\ja\Plocha\CFScript.txt.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-01-14 do 2015-02-14 )))))))))))))))))))))))))))))))
.
.
2015-02-14 16:15 . 2015-02-14 16:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\UewoXguzi
2015-02-14 13:33 . 2015-02-14 16:15 -------- d-----w- C:\FRST
2015-02-14 12:37 . 2015-02-14 12:37 -------- d-----w- c:\documents and settings\Administrator
2015-02-14 12:28 . 2015-02-14 12:28 -------- d-----w- c:\documents and settings\ja\Data aplikací\TeamViewer
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\windows\system32\wbem\Repository
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\program files\Common Files\ParetoLogic
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\ParetoLogic
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\DriverCure
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\ja\Data aplikací\BrowserExtensions
2015-02-14 12:05 . 2015-02-14 12:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ParetoLogic
2015-02-14 11:11 . 2015-02-14 11:15 -------- d-----w- C:\AdwCleaner
2015-02-14 11:10 . 2015-02-14 12:05 -------- d-----w- c:\program files\trend micro
2015-02-14 11:10 . 2015-02-14 11:10 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-05 11:52 . 2013-01-19 09:24 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-05 11:52 . 2013-01-19 09:24 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-11-22 06:54 . 2013-01-19 09:36 787800 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-21 21:01 . 2013-01-19 09:36 423784 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-11-21 21:01 . 2014-11-21 21:01 291352 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-21 21:01 . 2014-11-21 21:01 43152 ----a-w- c:\windows\avastSS.scr
2014-11-21 21:01 . 2014-05-03 07:08 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-21 21:01 . 2013-07-27 06:31 70384 ----a-w- c:\windows\system32\drivers\aswmonflt.sys
2014-11-21 21:01 . 2013-07-27 06:31 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-21 21:01 . 2013-07-27 06:31 206248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-21 21:01 . 2013-01-19 09:36 57928 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2014-11-21 21:01 . 2013-01-19 09:36 55240 ----a-w- c:\windows\system32\drivers\aswrdr.sys
2014-11-21 21:01 . 2014-01-01 13:23 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-11-21 21:01 . 2014-01-01 13:23 253640 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2008-04-14 12:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 12:00 50688 --sh--w- c:\windows\twain_32.dll
2011-02-08 13:33 978944 --sh--w- c:\windows\system32\mfc42.dll
2008-04-14 12:00 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 12:00 413696 --sh--w- c:\windows\system32\msvcp60.dll
2013-01-26 03:55 552448 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 12:00 12288 --sh--w- c:\windows\system32\regsvr32.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-21 21:01 723976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2011-12-05 20065384]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2010-02-03 5756544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-27 98304]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-01-23 5227112]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SoftwareSASGeneration"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [1.1.2014 14:23 12112]
R0 aswNdis2;avast! Firewall NDIS Driver;c:\windows\system32\drivers\aswNdis2.sys [1.1.2014 14:23 253640]
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [27.7.2013 7:31 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [27.7.2013 7:31 206248]
R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [17.1.2013 17:17 26112]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [1.1.2014 14:23 26136]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [19.1.2013 10:36 787800]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [19.1.2013 10:36 423784]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [3.5.2014 8:08 24184]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswmonflt.sys [27.7.2013 7:31 70384]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [1.1.2014 14:23 104416]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [19.1.2013 9:24 102888]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [19.1.2013 9:24 313832]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [19.1.2013 10:08 103040]
S2 ssinstall;SInstalátor;c:\windows\system32\ssins.exe [1.11.2013 15:40 2324216]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19.1.2013 9:22 1691480]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://onlinedesigner.happyfoto.cz/ips-opdata/uploadClients/iplabs/jordan.cab
FF - ProfilePath - c:\documents and settings\ja\Data aplikací\Mozilla\Firefox\Profiles\yc230oss.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-02-14 19:06
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1104)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2772)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\devldr32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2015-02-14 19:07:01 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-02-14 18:06
ComboFix2.txt 2015-02-14 17:22
.
Před spuštěním: Volných bajtů: 95 615 881 216
Po spuštění: Volných bajtů: 95 605 878 784
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 1DDC15F510EDD099092F657919C2CA50
413FC2A0C716421B3158746D63736515