Prosím o kontrolu logů a pomoc s odstraněním "DNS changer"

[Ladis4]

Zdravím Vás,
chtěl bych Vás poprosit o pomoc s NB. Kámošce se povedlo dostat do svého NB nějakým způsobem DNSchanger. Neustále dochází k přesměrování na nechtěné stránky adultyum.info, reklamy atd.. I když má nainstalovaný ESET stejně to tam má. Až když jsem na něm pustil mbam objevil ho. Jenže nevím jak se ho zbavit. NB se přeinstaloval a má to tam znovu. Úplně stejně se to chová na druhém PC, ale zatím sem dávám jen logy z notebooku. FRST log jsem zabalil nevešel se mi sem.

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 26.3.2015
Čas skenování: 21:27:55
Protokol: mbam_log_26032015.txt
Správce: Ano

Verze: 2.01.4.1018
Databáze malwaru: v2015.03.26.07
Databáze rootkitů: v2015.02.25.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Leonka

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 338458
Uplynulý čas: 4 min, 25 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 2
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|DhcpNameServer, 91.194.254.105 8.8.8.8, Dobré: (), Špatné: (91.194.254.105),,[0f1090ba9eec67cf95d79169f510f808]
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{8F213A18-5AD6-46AF-A308-456D6665D379}|DhcpNameServer, 91.194.254.105 8.8.8.8, Dobré: (), Špatné: (91.194.254.105),,[e13e301a602ad2649bd1ab4fae574cb4]

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)
-------------------
Díky za každou radu

[JaRon]

ahoj
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim


akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)

[Ladis4]

Ahoj,

přikládám log:
ComboFix 15-03-25.01 - Leonka 27.03.2015 20:13:51.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8050.2903 [GMT 1:00]
Spuštěný z: c:\users\Leonka\Desktop\ComboFix.exe
AV: ESET Smart Security 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-02-27 do 2015-03-27 )))))))))))))))))))))))))))))))
.
.
2015-03-27 19:18 . 2015-03-27 19:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-03-27 19:08 . 2015-03-14 10:02 12002392 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{74AB378C-44D9-4BA3-BE38-01398DAE68AC}\mpengine.dll
2015-03-26 19:55 . 2015-03-26 19:57 -------- d-----w- C:\FRST
2015-03-25 20:32 . 2015-03-27 19:06 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-25 20:32 . 2015-03-25 20:32 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2015-03-25 20:32 . 2015-03-25 20:32 -------- d-----w- c:\programdata\Malwarebytes
2015-03-25 20:32 . 2015-03-17 05:15 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-03-25 20:32 . 2015-03-17 05:15 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-03-25 20:32 . 2015-03-17 05:15 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-03-25 20:20 . 2015-03-25 20:20 -------- d-----w- c:\program files\CCleaner
2015-03-25 08:11 . 2015-03-11 04:06 677888 ----a-w- c:\windows\system32\generaltel.dll
2015-03-25 08:11 . 2015-03-11 04:06 760832 ----a-w- c:\windows\system32\invagent.dll
2015-03-25 08:11 . 2015-03-11 04:06 414720 ----a-w- c:\windows\system32\devinv.dll
2015-03-25 08:11 . 2015-03-11 04:05 30720 ----a-w- c:\windows\system32\acmigration.dll
2015-03-25 08:11 . 2015-03-11 04:05 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-03-25 08:11 . 2015-03-11 04:05 192000 ----a-w- c:\windows\system32\aepic.dll
2015-03-25 08:11 . 2015-03-11 04:02 1107456 ----a-w- c:\windows\system32\aeinv.dll
2015-03-24 15:58 . 2015-03-24 16:00 -------- d-----w- c:\program files (x86)\Google
2015-03-23 09:37 . 2015-03-23 09:37 -------- d-----w- c:\program files\PostSignumToolPlus
2015-03-23 08:51 . 2015-03-23 08:51 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2015-03-23 05:21 . 2015-03-23 05:22 -------- d--h--w- c:\program files\Zero G Registry
2015-03-22 19:58 . 2008-05-07 18:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2015-03-22 09:33 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2015-03-22 09:33 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2015-03-22 09:27 . 2015-03-22 09:29 -------- d-----w- C:\Posudky a Odhady
2015-03-22 06:44 . 2012-11-21 13:32 2811904 ----a-w- c:\windows\SysWow64\wPDFView03.dll
2015-03-22 06:44 . 2015-03-22 06:44 -------- d-----w- c:\program files (x86)\NEMExpress AC
2015-03-22 06:38 . 2015-03-25 09:37 -------- d-----w- c:\program files (x86)\NemExpress
2015-03-22 05:32 . 2011-02-25 06:19 2871808 ----a-w- c:\windows\explorer.exe
2015-03-22 05:32 . 2011-02-25 05:30 2616320 ----a-w- c:\windows\SysWow64\explorer.exe
2015-03-22 05:24 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2015-03-22 05:24 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2015-03-22 05:23 . 2015-02-20 02:26 968704 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2015-03-22 00:41 . 2015-03-25 20:20 -------- d-----w- c:\windows\Panther
2015-03-22 00:41 . 2015-03-22 00:41 -------- d-----w- C:\Hotfix
2015-03-22 00:41 . 2015-03-21 15:55 -------- d-----w- c:\windows\system32\OEM
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\SysWow64\cs
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\SysWow64\XPSViewer
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\SysWow64\drivers\cs-CZ
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\system32\cs
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\cs-CZ
2015-03-22 00:40 . 2015-03-21 20:37 -------- d-----w- c:\windows\SysWow64\wbem\cs-CZ
2015-03-22 00:40 . 2015-03-22 00:40 -------- d-----w- c:\windows\system32\drivers\UMDF\cs-CZ
2015-03-22 00:40 . 2015-03-21 20:37 -------- d-----w- c:\windows\system32\wbem\cs-CZ
2015-03-22 00:40 . 2015-03-21 20:37 -------- d-----w- c:\windows\system32\drivers\cs-CZ
2015-03-22 00:38 . 2009-07-14 03:04 3584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\cs-CZ\LXKPTPRC.DLL.mui
2015-03-22 00:27 . 2015-03-22 00:27 -------- d-----w- C:\Windows.old
2015-03-22 00:24 . 2012-02-02 00:16 568600 ----a-w- c:\windows\system32\drivers\iaStor.sys
2015-03-21 20:51 . 2015-03-21 20:51 144 ----a-w- c:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-03-21 20:49 . 2015-02-03 03:31 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-03-21 20:49 . 2015-02-03 03:12 1230848 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-03-21 20:49 . 2015-02-04 03:16 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-21 20:49 . 2015-02-04 02:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-03-21 20:47 . 2015-03-21 20:47 -------- d-----w- c:\windows\SysWow64\Wat
2015-03-21 20:47 . 2015-03-21 20:47 -------- d-----w- c:\windows\system32\Wat
2015-03-21 20:46 . 2005-02-24 07:59 365056 ----a-w- c:\windows\SysWow64\wPDF200A.dll
2015-03-21 20:46 . 2015-03-22 06:44 -------- d-----w- c:\program files (x86)\Common Files\PLUTO-OLT
2015-03-21 20:46 . 2015-03-22 06:44 -------- d-----w- c:\programdata\Pluto-Olt
2015-03-21 20:46 . 2015-03-21 20:46 -------- d-----w- c:\program files (x86)\Pluto-Olt software
2015-03-21 20:43 . 2015-03-21 20:43 451 ----a-w- c:\windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-03-21 20:37 . 2015-03-25 09:03 -------- d-s---w- c:\windows\system32\CompatTel
2015-03-21 20:37 . 2015-03-25 09:03 -------- d-----w- c:\windows\system32\appraiser
2015-03-21 20:19 . 2015-03-21 20:19 -------- d-----w- c:\programdata\HappyFoto-Designer
2015-03-21 20:19 . 2015-03-21 20:26 -------- d-----w- c:\program files (x86)\HappyFoto-Designer
2015-03-21 20:14 . 2015-03-26 19:08 -------- d-----w- c:\programdata\Spyware Terminator
2015-03-21 20:14 . 2015-03-21 20:14 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2015-03-21 20:12 . 2015-03-21 20:14 -------- d-----w- c:\program files (x86)\Spyware Terminator
2015-03-21 20:09 . 2015-03-21 20:09 778928 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-03-21 20:09 . 2015-03-21 20:09 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-21 20:09 . 2015-03-21 20:09 -------- d-----w- c:\windows\SysWow64\Macromed
2015-03-21 20:09 . 2015-03-21 20:09 -------- d-----w- c:\windows\system32\Macromed
2015-03-21 19:53 . 2015-03-21 19:53 -------- d-----w- c:\program files\Canon
2015-03-21 19:52 . 2012-08-30 10:18 152064 ----a-w- c:\windows\system32\CNMN6UI.DLL
2015-03-21 19:52 . 2012-08-30 10:18 252416 ----a-w- c:\windows\system32\CNMN6PPM.DLL
2015-03-21 19:52 . 2012-08-30 10:15 366080 ----a-w- c:\windows\SysWow64\CNMNPPM.DLL
2015-03-21 19:52 . 2015-03-21 20:02 -------- d-----w- c:\program files (x86)\Canon
2015-03-21 19:44 . 2015-03-21 19:44 -------- d--h--w- c:\programdata\CanonBJ
2015-03-21 19:44 . 2009-12-22 04:00 82944 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9B.DLL
2015-03-21 19:44 . 2009-12-22 04:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9B.DLL
2015-03-21 19:44 . 2015-03-21 19:44 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2015-03-21 19:44 . 2009-12-22 04:00 279040 ----a-w- c:\windows\system32\CNMLM9B.DLL
2015-03-21 19:44 . 2009-12-11 12:19 1354240 ----a-w- c:\windows\system32\CNC980C.DLL
2015-03-21 19:44 . 2009-12-11 12:19 92672 ----a-w- c:\windows\system32\CNC980I.DLL
2015-03-21 19:44 . 2009-11-30 15:40 293888 ----a-w- c:\windows\system32\CNC980L.DLL
2015-03-21 19:44 . 2007-03-15 13:13 229888 ----a-w- c:\windows\system32\CNC980O.DLL
2015-03-21 19:43 . 2015-03-21 19:43 -------- d-----w- c:\program files\7-Zip
2015-03-21 19:39 . 2015-03-21 20:38 -------- d-----w- c:\program files (x86)\TeamViewer
2015-03-21 19:10 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2015-03-21 18:57 . 2015-03-21 18:57 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-03-21 18:22 . 2014-10-01 18:54 64000 ----a-w- c:\windows\system32\OpenCL.DLL
2015-03-21 18:22 . 2014-10-01 18:54 60416 ----a-w- c:\windows\SysWow64\OpenCL.DLL
2015-03-21 18:21 . 2015-03-21 18:21 -------- d-----w- c:\program files (x86)\Common Files\Intel
2015-03-21 18:11 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2015-03-21 18:11 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2015-03-21 18:11 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2015-03-21 18:11 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2015-03-21 18:11 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2015-03-21 18:11 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2015-03-21 18:11 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2015-03-21 18:08 . 2015-03-21 18:09 -------- d-----w- c:\windows\system32\MRT
2015-03-21 18:01 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-03-21 18:01 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2015-03-21 18:01 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2015-03-21 17:57 . 2015-03-21 17:57 -------- d-----w- c:\programdata\NVIDIA Corporation
2015-03-21 17:57 . 2015-03-21 17:57 -------- d-----w- c:\program files\NVIDIA Corporation
2015-03-21 17:57 . 2015-03-21 17:57 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2015-03-21 17:55 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-03-21 17:55 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-03-21 17:55 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-03-21 17:55 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
2015-03-21 17:54 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
2015-03-21 17:54 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2015-03-21 17:54 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
2015-03-21 17:54 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
2015-03-21 17:54 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2015-03-21 17:54 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
2015-03-21 17:54 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2015-03-21 17:54 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-03-21 17:53 . 2013-10-04 02:28 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2015-03-21 17:53 . 2013-10-04 02:25 197120 ----a-w- c:\windows\system32\credui.dll
2015-03-21 17:53 . 2013-10-04 01:58 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
2015-03-21 17:53 . 2013-10-04 01:56 168960 ----a-w- c:\windows\SysWow64\credui.dll
2015-03-21 17:51 . 2015-02-03 03:30 1202176 ----a-w- c:\windows\system32\drmv2clt.dll
2015-03-21 17:50 . 2015-03-06 05:42 341504 ----a-w- c:\windows\system32\schannel.dll
2015-03-21 17:49 . 2012-10-03 17:44 216576 ----a-w- c:\windows\system32\ncsi.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-21 19:02 . 2015-03-21 19:02 208384 ----a-w- c:\windows\SysWow64\webcheck.dll
2015-03-21 19:02 . 2015-03-21 19:02 243200 ----a-w- c:\windows\system32\webcheck.dll
2015-02-24 03:20 . 2015-02-24 03:20 829264 ----a-w- c:\windows\system32\msvcr100.dll
2015-02-24 03:20 . 2015-02-24 03:20 608080 ----a-w- c:\windows\system32\msvcp100.dll
2015-02-24 03:17 . 2010-11-21 03:27 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-24 02:11 . 2015-02-24 02:11 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2015-02-24 02:11 . 2015-02-24 02:11 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2015-03-21 17:09 233128 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2015-03-21 17:09 233128 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2015-03-21 17:09 233128 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCLEANER\CCleaner64.exe" [2015-02-19 7416088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
c:\users\Leonka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Odeslat do OneNote.lnk - c:\program files\Microsoft Office 15\root\office15\ONENOTEM.EXE /tsr [2015-3-21 195240]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 AMPPALP;Protokol Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 ClickToRunSvc;Služba Microsoft Office ClickToRun;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 AMPPAL;Virtuální adaptér Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-03-24 16:00 1061704 ----a-w- c:\program files (x86)\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-21 20:09]
.
2015-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-03-24 15:58]
.
2015-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-03-24 15:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2015-03-21 17:09 260776 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2015-03-21 17:09 260776 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2015-03-21 17:09 260776 ----a-w- c:\users\Leonka\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-03-21 16:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-03-21 16:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-03-21 16:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"="c:\program files (x86)\Intel\Bluetooth\BleServicesCtrl.exe" [2012-01-10 120592]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2012-01-12 11406608]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-10-01 5595336]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2014-11-04 2774904]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2014-11-04 3681656]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 91.194.254.105 8.8.8.8
FF - ProfilePath - c:\users\Leonka\AppData\Roaming\Mozilla\Firefox\Profiles\fwgho0x0.default\
FF - prefs.js: network.proxy.type - 4
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_134_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_134_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_134_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_134_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2015-03-27 20:20:04
ComboFix-quarantined-files.txt 2015-03-27 19:20
.
Před spuštěním: Volných bajtů: 654 636 597 248
Po spuštění: Volných bajtů: 653 781 061 632
.
- - End Of File - - 2DDBC1BE35E899265A7DD4129EFC7223

[JaRon]

v logu nevidim nic podozrive, az na tu DHCP IP, ktora patri do Rakuska
kedze to robi aj druhy pocitac, bude asi napadnuty router
precitaj toto http://www.digitaltrends.com/computing/ ... ur-router/
ak bude v routri nastavena tato IP 91.194.254.105 , odstran ju a potom aj zmen heslo na router a zapis si ho niekde

[Ladis4]

Ahoj,

dík za radu. Heslo na routeru jsem jim změnil hned jenže jsem si nevšiml změny IP adresy pro DNS server. Nebyla tam sice IP adresa z registru, ale jiná(146.185.239.240). Nastavil jsem jim tam adresu co tam měla být a pro jistotu ještě přenastavil heslo. Jakmile jsem to udělal je na NB naprostý klid. Žádná otěžující reklama a přesměrování na nevhodné stránky. To samé jim přestalo i na tabletu a klasickém PC (i když to je další kapitola, ale to bych rád pořešil v novém vláknu).
Děkuju za radu.

[JaRon]

ahoj
citat:
Odinstalujte Combofix
• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

rad som pomohol