VIRY.CZ

Dobrý den, asi od prosince minulého roku mi při zavíraní GomPLAYERU začalo vyskakovat okno od Reimage. Jediný program, který jsem v listopadu stáhla byla Recuva.
Na toto upozornění nereaguju, ale ráda bych se ho zbavila.
Díky.
Hannah3

Zdravím, dej mi sem prosím aktuální log z Rsit, vypadá to že tam máš breberky

Ahoj, zasílám log

Logfile of random's system information tool 1.10 (written by random/random)
Run by uživatel at 2016-02-26 13:44:15
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 54 GB (45%) free of 119 GB
Total RAM: 4061 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:44:19, on 26.2.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18205)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\uživatel\Downloads\RSIT.exe
C:\Program Files (x86)\trend micro\uživatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7097 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-08 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-08 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-01-29 594992]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"msacm.divxa32"=msaud32_divx.acm
"msacm.ac3filter"=ac3filter.acm
"vidc.mpeg"=bdmpegv.dll
"msacm.bdmpeg"=bdmpega.acm

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-02-26 13:31:50 ----D---- C:\Program Files (x86)\trend micro
2016-02-26 13:31:49 ----D---- C:\rsit
2016-02-10 13:07:01 ----A---- C:\Windows\SysWOW64\wuwebv.dll
2016-02-10 13:07:01 ----A---- C:\Windows\SysWOW64\wuapi.dll
2016-02-10 13:07:00 ----A---- C:\Windows\SysWOW64\wups.dll
2016-02-10 13:07:00 ----A---- C:\Windows\SysWOW64\wudriver.dll
2016-02-10 13:07:00 ----A---- C:\Windows\SysWOW64\wuapp.exe
2016-02-10 13:06:55 ----A---- C:\Windows\SysWOW64\InkEd.dll
2016-02-10 13:06:47 ----A---- C:\Windows\SysWOW64\iertutil.dll
2016-02-10 13:06:46 ----A---- C:\Windows\SysWOW64\mshtml.dll
2016-02-10 13:06:44 ----A---- C:\Windows\SysWOW64\urlmon.dll
2016-02-10 13:06:44 ----A---- C:\Windows\SysWOW64\ieui.dll
2016-02-10 13:06:43 ----A---- C:\Windows\SysWOW64\ieframe.dll
2016-02-10 13:06:42 ----A---- C:\Windows\SysWOW64\ieUnatt.exe
2016-02-10 13:06:28 ----A---- C:\Windows\SysWOW64\mshtmled.dll
2016-02-10 13:06:28 ----A---- C:\Windows\SysWOW64\inseng.dll
2016-02-10 13:06:28 ----A---- C:\Windows\SysWOW64\iernonce.dll
2016-02-10 13:06:28 ----A---- C:\Windows\SysWOW64\ieetwproxystub.dll
2016-02-10 13:06:27 ----A---- C:\Windows\SysWOW64\vbscript.dll
2016-02-10 13:06:27 ----A---- C:\Windows\SysWOW64\occache.dll
2016-02-10 13:06:27 ----A---- C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-02-10 13:06:27 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2016-02-10 13:06:26 ----A---- C:\Windows\SysWOW64\msfeeds.dll
2016-02-10 13:06:26 ----A---- C:\Windows\SysWOW64\dxtrans.dll
2016-02-10 13:06:23 ----A---- C:\Windows\SysWOW64\iesetup.dll
2016-02-10 13:06:23 ----A---- C:\Windows\SysWOW64\ieapfltr.dll
2016-02-10 13:06:22 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2016-02-10 13:06:22 ----A---- C:\Windows\SysWOW64\jscript9diag.dll
2016-02-10 13:06:22 ----A---- C:\Windows\SysWOW64\jscript.dll
2016-02-10 13:06:22 ----A---- C:\Windows\SysWOW64\dxtmsft.dll
2016-02-10 13:06:18 ----A---- C:\Windows\SysWOW64\webcheck.dll
2016-02-10 13:06:18 ----A---- C:\Windows\SysWOW64\mshtmlmedia.dll
2016-02-10 13:06:16 ----A---- C:\Windows\SysWOW64\wininet.dll
2016-02-10 13:06:16 ----A---- C:\Windows\SysWOW64\msrating.dll
2016-02-10 13:06:16 ----A---- C:\Windows\SysWOW64\MshtmlDac.dll
2016-02-10 13:06:16 ----A---- C:\Windows\SysWOW64\jscript9.dll
2016-02-10 13:05:36 ----A---- C:\Windows\SysWOW64\ole32.dll
2016-02-10 13:04:13 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2016-02-10 13:04:12 ----A---- C:\Windows\SysWOW64\EncDec.dll
2016-02-10 13:04:09 ----A---- C:\Windows\SysWOW64\ntdll.dll
2016-02-10 13:04:08 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2016-02-10 13:04:07 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2016-02-10 13:04:06 ----A---- C:\Windows\SysWOW64\mtxoci.dll
2016-02-10 13:04:06 ----A---- C:\Windows\SysWOW64\msorcl32.dll
2016-02-10 13:04:06 ----A---- C:\Windows\SysWOW64\advapi32.dll
2016-02-10 13:04:05 ----A---- C:\Windows\SysWOW64\kerberos.dll
2016-02-10 13:04:03 ----A---- C:\Windows\SysWOW64\KernelBase.dll
2016-02-10 13:04:00 ----A---- C:\Windows\SysWOW64\rpcrt4.dll
2016-02-10 13:03:59 ----A---- C:\Windows\SysWOW64\sspicli.dll
2016-02-10 13:03:59 ----A---- C:\Windows\SysWOW64\schannel.dll
2016-02-10 13:03:59 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\wdigest.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\TSpkg.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\secur32.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\ncrypt.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\kernel32.dll
2016-02-10 13:03:58 ----A---- C:\Windows\SysWOW64\cryptbase.dll
2016-02-10 13:03:57 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-02-10 13:03:57 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-02-10 13:03:57 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-02-10 13:03:57 ----A---- C:\Windows\SysWOW64\wow32.dll
2016-02-10 13:03:57 ----A---- C:\Windows\SysWOW64\srclient.dll
2016-02-10 13:03:57 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2016-02-10 13:03:57 ----A---- C:\Windows\SysWOW64\credssp.dll
2016-02-10 13:03:57 ----A---- C:\Windows\SysWOW64\auditpol.exe
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-02-10 13:03:56 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-02-10 13:03:55 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-02-10 13:03:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-02-10 13:03:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-02-10 13:03:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-02-10 13:03:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-02-10 13:03:54 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-02-10 13:03:54 ----A---- C:\Windows\SysWOW64\setup16.exe
2016-02-10 13:03:54 ----A---- C:\Windows\SysWOW64\instnm.exe
2016-02-10 13:03:53 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-02-10 13:03:53 ----A---- C:\Windows\SysWOW64\user.exe
2016-02-10 13:03:53 ----A---- C:\Windows\SysWOW64\msobjs.dll
2016-02-10 13:03:53 ----A---- C:\Windows\SysWOW64\msaudite.dll
2016-02-10 13:03:53 ----A---- C:\Windows\SysWOW64\apisetschema.dll
2016-02-10 13:03:53 ----A---- C:\Windows\SysWOW64\adtschema.dll
2016-02-10 13:02:34 ----A---- C:\Windows\explorer.exe
2016-02-10 13:02:33 ----A---- C:\Windows\SysWOW64\shell32.dll
2016-02-10 13:02:31 ----A---- C:\Windows\SysWOW64\explorer.exe
2016-02-10 13:02:29 ----A---- C:\Windows\SysWOW64\ExplorerFrame.dll
2016-02-10 13:02:29 ----A---- C:\Windows\SysWOW64\authui.dll
2016-02-08 09:47:19 ----D---- C:\Program Files (x86)\Common Files\Java

======List of files/folders modified in the last 1 month======

2016-02-26 13:44:17 ----D---- C:\Windows\Temp
2016-02-26 13:38:28 ----D---- C:\Users\uživatel\AppData\Roaming\SoftGrid Client
2016-02-26 13:31:50 ----RD---- C:\Program Files (x86)
2016-02-26 13:29:35 ----D---- C:\Users\uživatel\AppData\Roaming\Skype
2016-02-26 12:33:28 ----D---- C:\Windows\Prefetch
2016-02-26 12:33:26 ----RD---- C:\Program Files
2016-02-26 08:40:53 ----D---- C:\Windows\winsxs
2016-02-23 08:58:34 ----SHD---- C:\System Volume Information
2016-02-19 09:08:44 ----SD---- C:\Users\uživatel\AppData\Roaming\Microsoft
2016-02-18 14:19:22 ----SHD---- C:\Windows\Installer
2016-02-18 14:18:59 ----D---- C:\Windows\SysWOW64
2016-02-16 13:52:45 ----D---- C:\Windows\System32
2016-02-16 13:52:44 ----D---- C:\Windows\inf
2016-02-14 11:04:41 ----D---- C:\Windows
2016-02-14 10:46:56 ----D---- C:\Program Files (x86)\Common Files
2016-02-14 10:42:12 ----D---- C:\Program Files (x86)\Google
2016-02-14 10:42:10 ----D---- C:\Windows\Tasks
2016-02-14 10:39:42 ----D---- C:\Users\uživatel\AppData\Roaming\Media Player Classic
2016-02-14 09:53:03 ----D---- C:\Windows\debug
2016-02-11 12:01:33 ----D---- C:\Windows\rescache
2016-02-11 11:33:55 ----D---- C:\Windows\Microsoft.NET
2016-02-11 11:31:17 ----RSD---- C:\Windows\assembly
2016-02-11 09:45:56 ----D---- C:\Windows\AppPatch
2016-02-11 09:45:56 ----D---- C:\Program Files (x86)\Internet Explorer
2016-02-11 09:45:55 ----D---- C:\Windows\SysWOW64\en-US
2016-02-11 09:45:55 ----D---- C:\Windows\SysWOW64\cs-CZ
2016-02-11 09:45:27 ----D---- C:\Windows\cs-CZ
2016-02-10 09:37:10 ----A---- C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-08 09:48:00 ----D---- C:\ProgramData\Oracle
2016-02-08 09:47:52 ----D---- C:\Program Files (x86)\Java
2016-02-08 09:45:23 ----A---- C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AsDsm;AsDsm; C:\Windows\SysWOW64\drivers\AsDsm.sys []
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys []
R0 lullaby;lullaby; C:\Windows\system32\DRIVERS\lullaby.sys []
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys []
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys []
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys []
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys []
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys []
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys []
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys []
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E62x64.sys []
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys []
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys []
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys []
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys []
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys []
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys []
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys []
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys []
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys []
S3 IT9135BDA;IT9135 BDA Devices; C:\Windows\System32\Drivers\IT9135BDA.sys []
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys []
S3 nmwcdx64;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmbx64.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys []
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSG664.sys []
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys []
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys []
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys []
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\drivers\WinUsb.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-13 82128]
R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe []
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [2009-06-16 84536]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2015-03-18 822496]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2010-11-18 810144]
R2 Fabs;FABS - Helping agent for MAGIX media database; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2014-10-08 534184]
R3 ADSMService;ADSM Service; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [2008-03-31 225280]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2014-10-08 211104]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-10 269504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-11-18 42360]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]
S3 fsssvc;Windows Live Zabezpečení rodiny; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe /V []
S3 IJPLMSVC;Inkjet Printer/Scanner Extended Survey Program; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [2008-01-22 103808]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

Stáhni a ulož na plochu AdwCleaner,

ukonči všechny programy včetně prohlížeče a dvojklikem jej spusť,

objeví se okno kde vlevo nahoře klikni na Scan.

Po dokončení skenu klikni na Clean,

proběhne restart PC kdy dojde ke smazání nepořádku.

Po té mi sem zkopíruj Report.


Použij Mbam z mého podpisu a dejm i sem z něj log po smazání.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

Ahoj, posílám Report
# AdwCleaner v5.036 - Logfile created 28/02/2016 at 09:50:14
# Updated 22/02/2016 by Xplode
# Database : 2016-02-28.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : uživatel - USERPVC
# Running from : C:\Users\uživatel\Desktop\adwcleaner_5.036.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [718 bytes] - [28/02/2016 09:50:14]
C:\AdwCleaner\AdwCleaner[S1].txt - [776 bytes] - [28/02/2016 09:48:27]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [862 bytes] ##########

Ahoj, z tvého podpisu jsem stáhla MBAM, instalovala, byla to zkušební verze MBAM Home (2.2.0.1024), která neodpovídala popisu, na kt. odkazuješ, provedla aktualizaci a scan, který trval cca 20 minut, žádný log nevydal, jen vyrozumění, že nic není infikováno a škodlivá webová stránka blokována (C://windows/SYST.32/svchost.exe.

Kontrola vyskakujícího okna v Gomplayeru, je tam stále.

Mám provést Combofix, trochu mám obavy, co mě čeká, i tento mbam mě překvapil tím, že to nebylo to, o čem jsi psal.
Jaké můžu čekat nástrahy? Nejsem v tom nic moc dobrá.

Dík. Hanka

Ahoj Roli, udělala jsem ještě jeden sken MBAM a uložila to jinam, než bylo nastaveno (C://ProgramData) mám je asi skryté, jelikož jsem je neobjevila, tak zasílám onen požadovaný sken, který neobsahoval žádnou hrozbu, aspoň to tam bylo napsané, ale ty posoudíš.
Co s tím Combofixem? Mám z něj vítr
Jenže to okno stále v Gomu straší, nemám udělat update?
Díky.
H,


<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


+<header>


-<engine>

<version>2.2.0.1024</version>

<malware-database>v2016.02.28.04</malware-database>

<rootkit-database>v2016.02.27.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<hostname>USERPVC</hostname>

<ip>89.177.92.119</ip>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>uživatel</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>337885</objects>

<time>932</time>

<processes>0</processes>

<modules>0</modules>

<keys>0</keys>

<values>0</values>

<datas>0</datas>

<folders>0</folders>

<files>0</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>

<items> </items>

</mbam-log>

Ahoj Roli, dnes jsem měla pěknou polízanici, chtěla jsem udělat update Gomplayeru kvůli tomu vyskakujícímu oknu a můj Eset mi zahlásil potenc. nechtěnou aplikaci ve WIN 32 FusionCore D NA c://Users/App Data/Local/Temp, kterou vyléčil.
Potom jsem ale se už přes Google nedostala nikam, Eset pořád hlásil zachyceni hrozby JS/ScrInjet B.trojský kůň, tato hrozba byla zachycena aplikací C:// Program Files (x86) Internet Explorer/iexplorer.exe. Objet byl tpc.googlesyndication.com a google.cz
Google je na mé domovské stránce, kterou jsem přepsala na Seznam.cz a Eset už neotravuje. Mně to ale neupokojilo, co bych měla udělat, dělám hloubkovou kontrolu od Esetu. Neměla bych znovu provést MBAM?
PLS, porad´.
Hanka

Ahoj Hani,

zbytek víkendu jsem byl pryč

Pokud budeš u ComboFix postupovat podle toho co píšu nemusíš se bát

hannah3 píše:...
Potom jsem ale se už přes Google nedostala nikam, Eset pořád hlásil zachyceni hrozby JS/ScrInjet B.trojský kůň, tato hrozba byla zachycena aplikací C:// Program Files (x86) Internet Explorer/iexplorer.exe. Objet byl tpc.googlesyndication.com a google.cz
Google je na mé domovské stránce, kterou jsem přepsala na Seznam.cz a Eset už neotravuje. Mně to ale neupokojilo, co bych měla udělat, dělám hloubkovou kontrolu od Esetu. Neměla bych znovu provést MBAM?
PLS, porad´.
Hanka

Jen malou vsuvku - ESET měl jakýsi problém s Googlem
ale podle jednoho threadu se zdá, že už to stačili opravit

zkontroluj prosím

Ahoj Roli, so sorry, že odpovídám až dnes, byla jsem mimo.
Roli, bylo to tak, jak jsi napsal, Eset vydával falešné hlášky o hrozbách a na několik hodin blokoval Google, že takový problém Eset neměl poprvé, jsem se dočetla, až když chybu napravil. Mezitím jsem si raději zavolala IT ambulanci, kontroly byly ok.
Reklamovala jsem to Esetu, stálo mě to 490,- kč, chybu uznali a nabídli kompenzaci, vybrala jsem si prodloužení licence gratis. Docela mě překvapili....
Díky ti moc za tvůj čas a měj se fajn.
Ahoj.
Hanka

hannah3 píše:Mezitím jsem si raději zavolala IT ambulanci, kontroly byly ok.

No ale stejně bych rád viděl ten log z ComboFix, co Ty na to ?