Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Zavirované PC

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Zavirované PC

#1 Příspěvek od Indy13 »

Dobrý den,

MWAV mi objevil mnoho zavirovaných souborů, opakovaně jsem je nechal odstranit, ale vždy se mi tam objevilo něco znovu, někdy až po několika restartech. Můžete, prosím, pomoci zbavit se havěti trvaleji?

Děkuji a přeji příjemný den.

Jiří Dalešický

Logfile of random's system information tool 1.09 (written by random/random)
Run by Jenda at 2013-11-06 21:17:10
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 895 GB (94%) free of 954 GB
Total RAM: 2047 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:18:45, on 6.11.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16720)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Jenda.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll
O2 - BHO: Web Assistant Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [SafeCopy] C:\Program Files\SafeCopy\SafeCopy.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: SafeCopy Crawler - Unknown owner - C:\Program Files\SafeCopy\SafeCopyCrawler.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Soluto Launcher Service (SolutoLauncherService) - Soluto - C:\Program Files\Soluto\SolutoLauncherService.exe
O23 - Service: Soluto Remote Service (SolutoRemoteService) - GlavSoft LLC. - C:\Program Files\Soluto\SolutoRemoteService.exe
O23 - Service: Soluto PCGenome Core Service (SolutoService) - Soluto - C:\Program Files\Soluto\SolutoService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8804 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files\SafeCopy\SafeCopyCrawler.exe"
"C:\Program Files\Soluto\SolutoLauncherService.exe"
"C:\Program Files\Soluto\SolutoService.exe"
"C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
taskeng.exe {55B3A859-B4BF-4D86-875C-5E9E71650CFA}
"taskhost.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"c:\program files\soluto\soluto.exe" /userinit
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
"C:\Program Files\SafeCopy\SafeCopy.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe"
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="4784.0.1332401094\1498209330" --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,9,18,21,24,26 --gpu-vendor-id=0x10de --gpu-device-id=0x0391 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.783 --ignored=" --type=renderer " /prefetch:822062411
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --extension-process --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4784.1.1265650458\1321426065" /prefetch:673131151
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --instant-process --enable-threaded-compositing --disable-html-notifications --channel="4784.2.777935483\56726999" /prefetch:673131151
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4784.3.904045682\2103202472" /prefetch:673131151
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --extension-process --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4784.4.459586130\491079364" /prefetch:673131151
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --extension-process --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4784.6.2077025027\617380452" /prefetch:673131151
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Jenda\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.572_0\npbrowserext.dll" --lang=cs --channel="4784.7.1105268475\211955105" /prefetch:-390060480
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Jenda\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\Plugins/PerionNewTabChrome-32.dll" --lang=cs --channel="4784.8.1234391340\1783937398" /prefetch:-390060480
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=service
"C:\Users\Jenda\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group6 pct:10e stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/ManualResetProfile/Enable/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderDisabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_55/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_03/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4784.19.1288485392\627033961" /prefetch:673131151
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
"C:\Users\Jenda\Downloads\RSITx64.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
Web Assistant - C:\Program Files\Web Assistant\Extension64.dll [2013-01-29 215896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]
MSS+ Identifier - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll [2013-09-06 95648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
Web Assistant - C:\Program Files\Web Assistant\Extension32.dll [2013-01-29 170840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2013-03-09 4171464]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-11-05 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-11-05 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-08-12 1356240]
"LogMeIn GUI"=C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [2012-04-02 57928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SafeCopy"=C:\Program Files\SafeCopy\SafeCopy.exe [2011-05-10 1642856]
"Google Update"=C:\Users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 116648]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-06-03 19604072]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2012-11-05 89184]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2013-03-09 4171464]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-11-06 21:17:12 ----D---- C:\Program Files\trend micro
2013-11-06 21:17:10 ----D---- C:\rsit
2013-11-05 23:37:55 ----D---- C:\ProgramData\Oracle
2013-11-05 23:35:29 ----A---- C:\Windows\SYSWOW64\javaws.exe
2013-11-05 23:35:16 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2013-11-05 23:35:16 ----A---- C:\Windows\SYSWOW64\javaw.exe
2013-11-05 23:35:16 ----A---- C:\Windows\SYSWOW64\java.exe
2013-11-05 23:35:00 ----D---- C:\Program Files (x86)\Java
2013-10-25 08:40:40 ----D---- C:\Users\Jenda\AppData\Roaming\Malwarebytes
2013-10-20 15:49:41 ----D---- C:\Program Files\McAfee Security Scan
2013-10-16 16:00:12 ----D---- C:\Users\Jenda\AppData\Roaming\Unity
2013-10-16 07:01:17 ----D---- C:\ProgramData\Malwarebytes
2013-10-16 07:01:15 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-16 07:01:15 ----A---- C:\Windows\system32\drivers\mbam.sys
2013-10-16 02:39:44 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-10-16 02:39:44 ----A---- C:\Windows\system32\ieui.dll
2013-10-16 02:39:42 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-10-16 02:39:42 ----A---- C:\Windows\system32\iesetup.dll
2013-10-16 02:39:42 ----A---- C:\Windows\system32\iernonce.dll
2013-10-16 02:39:41 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-10-16 02:39:41 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-10-16 02:39:41 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-10-16 02:39:41 ----A---- C:\Windows\system32\ie4uinit.exe
2013-10-16 02:39:40 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-10-16 02:39:40 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-16 02:39:40 ----A---- C:\Windows\system32\iesysprep.dll
2013-10-16 02:39:39 ----A---- C:\Windows\system32\iertutil.dll
2013-10-16 02:39:36 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-10-16 02:39:35 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-10-16 02:39:35 ----A---- C:\Windows\system32\msfeeds.dll
2013-10-16 02:39:35 ----A---- C:\Windows\system32\jscript.dll
2013-10-16 02:39:33 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-10-16 02:39:33 ----A---- C:\Windows\system32\jscript9.dll
2013-10-16 02:39:32 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-10-16 02:39:31 ----A---- C:\Windows\system32\urlmon.dll
2013-10-16 02:39:30 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-10-16 02:39:30 ----A---- C:\Windows\system32\jsproxy.dll
2013-10-16 02:39:29 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-10-16 02:39:29 ----A---- C:\Windows\system32\wininet.dll
2013-10-16 02:39:28 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-10-16 02:39:27 ----A---- C:\Windows\system32\ieframe.dll
2013-10-16 02:39:25 ----A---- C:\Windows\system32\mshtml.dll
2013-10-16 02:39:22 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-10-16 02:12:34 ----D---- C:\Windows\system32\MRT
2013-10-15 23:26:24 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2013-10-15 22:24:01 ----D---- C:\ProgramData\BitGuard
2013-10-15 22:19:22 ----A---- C:\Windows\system32\comctl32.dll
2013-10-15 22:19:21 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2013-10-15 22:19:17 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-10-15 22:19:17 ----A---- C:\Windows\system32\crypt32.dll
2013-10-15 22:19:16 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2013-10-15 22:19:16 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2013-10-15 22:19:16 ----A---- C:\Windows\system32\wintrust.dll
2013-10-15 22:19:15 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2013-10-15 22:19:15 ----A---- C:\Windows\system32\cryptsvc.dll
2013-10-15 22:19:15 ----A---- C:\Windows\system32\cryptnet.dll
2013-10-15 22:18:13 ----A---- C:\Windows\SYSWOW64\tzres.dll
2013-10-15 22:18:13 ----A---- C:\Windows\system32\tzres.dll
2013-10-15 22:17:53 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2013-10-15 22:17:53 ----A---- C:\Windows\system32\atmfd.dll
2013-10-15 22:17:52 ----A---- C:\Windows\SYSWOW64\lpk.dll
2013-10-15 22:17:52 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2013-10-15 22:17:52 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2013-10-15 22:17:52 ----A---- C:\Windows\system32\lpk.dll
2013-10-15 22:17:52 ----A---- C:\Windows\system32\fontsub.dll
2013-10-15 22:17:52 ----A---- C:\Windows\system32\dciman32.dll
2013-10-15 22:17:51 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2013-10-15 22:17:51 ----A---- C:\Windows\system32\atmlib.dll
2013-10-15 22:17:45 ----A---- C:\Windows\system32\drivers\ataport.sys
2013-10-15 22:17:39 ----A---- C:\Windows\system32\KernelBase.dll
2013-10-15 22:17:38 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2013-10-15 22:17:38 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2013-10-15 22:17:38 ----A---- C:\Windows\system32\winsrv.dll
2013-10-15 22:17:38 ----A---- C:\Windows\system32\smss.exe
2013-10-15 22:17:38 ----A---- C:\Windows\system32\kernel32.dll
2013-10-15 22:17:38 ----A---- C:\Windows\system32\csrsrv.dll
2013-10-15 22:17:38 ----A---- C:\Windows\system32\conhost.exe
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-10-15 22:17:37 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-10-15 22:17:36 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-10-15 22:17:35 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-10-15 22:17:34 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-10-15 22:17:34 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2013-10-15 22:17:34 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-10-15 22:17:34 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-10-15 22:17:34 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-10-15 22:17:34 ----A---- C:\Windows\system32\apisetschema.dll
2013-10-15 22:17:17 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2013-10-15 22:17:17 ----A---- C:\Windows\system32\WMVDECOD.DLL
2013-10-15 22:17:13 ----A---- C:\Windows\system32\drivers\Wdf01000.sys
2013-10-15 22:17:11 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2013-10-15 22:17:11 ----A---- C:\Windows\system32\rpcrt4.dll
2013-10-15 22:17:06 ----A---- C:\Windows\system32\drivers\usbcir.sys
2013-10-15 22:17:04 ----A---- C:\Windows\system32\drivers\hidparse.sys
2013-10-15 22:17:04 ----A---- C:\Windows\system32\drivers\hidclass.sys
2013-10-15 22:17:01 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2013-10-15 22:17:01 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2013-10-15 22:17:01 ----A---- C:\Windows\system32\WebClnt.dll
2013-10-15 22:17:01 ----A---- C:\Windows\system32\davclnt.dll
2013-10-15 22:17:00 ----A---- C:\Windows\system32\drivers\mrxdav.sys
2013-10-15 22:16:58 ----A---- C:\Windows\system32\qedit.dll
2013-10-15 22:16:57 ----A---- C:\Windows\SYSWOW64\qedit.dll
2013-10-15 22:16:56 ----A---- C:\Windows\system32\drivers\tssecsrv.sys
2013-10-15 22:16:53 ----A---- C:\Windows\system32\mswsock.dll
2013-10-15 22:16:53 ----A---- C:\Windows\system32\drivers\tcpip.sys
2013-10-15 22:16:52 ----A---- C:\Windows\SYSWOW64\mswsock.dll
2013-10-15 22:16:52 ----A---- C:\Windows\system32\drivers\afd.sys
2013-10-15 22:16:48 ----A---- C:\Windows\system32\win32k.sys
2013-10-15 22:16:45 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-10-15 22:16:44 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-10-15 22:16:44 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-10-15 22:16:43 ----A---- C:\Windows\SYSWOW64\tdh.dll
2013-10-15 22:16:43 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2013-10-15 22:16:43 ----A---- C:\Windows\system32\tdh.dll
2013-10-15 22:16:43 ----A---- C:\Windows\system32\ntdll.dll
2013-10-15 22:16:43 ----A---- C:\Windows\system32\advapi32.dll
2013-10-15 22:16:42 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2013-10-15 22:16:42 ----A---- C:\Windows\system32\wow64.dll
2013-10-15 22:16:41 ----A---- C:\Windows\SYSWOW64\setup16.exe
2013-10-15 22:16:41 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2013-10-15 22:16:40 ----A---- C:\Windows\SYSWOW64\wow32.dll
2013-10-15 22:16:40 ----A---- C:\Windows\SYSWOW64\user.exe
2013-10-15 22:16:40 ----A---- C:\Windows\SYSWOW64\instnm.exe
2013-10-15 22:16:02 ----A---- C:\Windows\system32\shell32.dll
2013-10-15 22:16:01 ----A---- C:\Windows\SYSWOW64\shell32.dll
2013-10-15 22:16:01 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2013-10-15 22:16:01 ----A---- C:\Windows\system32\shdocvw.dll
2013-10-15 22:15:28 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 22:15:28 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 22:15:11 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-10-15 22:15:05 ----A---- C:\Windows\system32\DWrite.dll
2013-10-15 22:15:04 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2013-10-15 21:55:31 ----A---- C:\Windows\system32\scavengeui.dll

======List of files/folders modified in the last 1 month======

2013-11-06 21:18:15 ----D---- C:\Windows\Temp
2013-11-06 21:17:26 ----D---- C:\Windows\Prefetch
2013-11-06 21:17:12 ----RD---- C:\Program Files
2013-11-06 21:09:21 ----D---- C:\Windows\Microsoft.NET
2013-11-06 21:08:51 ----RSD---- C:\Windows\assembly
2013-11-06 20:59:29 ----D---- C:\Windows\system32\config
2013-11-06 20:52:07 ----D---- C:\Windows\System32
2013-11-06 20:52:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-11-06 00:32:54 ----D---- C:\ProgramData\LogMeIn
2013-11-06 00:32:44 ----SHD---- C:\Windows\Installer
2013-11-06 00:32:35 ----D---- C:\ProgramData\Microsoft Help
2013-11-06 00:29:24 ----D---- C:\Windows\SysWOW64
2013-11-06 00:26:15 ----D---- C:\Windows\system32\catroot2
2013-11-06 00:26:11 ----SHD---- C:\System Volume Information
2013-11-05 23:37:55 ----HD---- C:\ProgramData
2013-11-05 23:36:05 ----D---- C:\Program Files (x86)\Common Files
2013-11-05 23:35:00 ----RD---- C:\Program Files (x86)
2013-11-05 23:29:25 ----D---- C:\Windows\inf
2013-11-05 23:24:10 ----D---- C:\Program Files (x86)\LogMeIn
2013-11-05 23:23:09 ----A---- C:\Windows\system32\LMIRfsClientNP.dll
2013-11-05 23:23:09 ----A---- C:\Windows\system32\LMIport.dll
2013-11-05 23:23:09 ----A---- C:\Windows\system32\LMIinit.dll
2013-10-25 12:15:43 ----D---- C:\Users\Jenda\AppData\Roaming\Skype
2013-10-25 08:39:47 ----D---- C:\Users\Jenda\AppData\Roaming\SafeCopy
2013-10-19 13:33:51 ----D---- C:\Windows\winsxs
2013-10-19 13:31:39 ----D---- C:\Windows\system32\catroot
2013-10-19 13:28:11 ----D---- C:\Windows
2013-10-16 19:26:22 ----D---- C:\Windows\Minidump
2013-10-16 07:15:53 ----D---- C:\Program Files\Web Assistant
2013-10-16 07:14:58 ----D---- C:\Windows\system32\Tasks
2013-10-16 07:13:59 ----D---- C:\Windows\SYSWOW64\WNLT
2013-10-16 07:13:55 ----D---- C:\ProgramData\Codec
2013-10-16 07:01:15 ----D---- C:\Windows\system32\drivers
2013-10-16 07:00:47 ----D---- C:\Downloads
2013-10-16 04:00:32 ----D---- C:\Windows\rescache
2013-10-16 03:10:38 ----D---- C:\Program Files\Microsoft Silverlight
2013-10-16 03:10:37 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 03:08:06 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-10-16 03:08:06 ----D---- C:\Windows\system32\cs-CZ
2013-10-16 03:08:06 ----D---- C:\Program Files\Windows Defender
2013-10-16 03:08:06 ----D---- C:\Program Files (x86)\Windows Defender
2013-10-16 03:08:05 ----D---- C:\Program Files\Internet Explorer
2013-10-16 03:08:05 ----D---- C:\Program Files (x86)\Internet Explorer
2013-10-16 03:08:02 ----D---- C:\Windows\AppPatch
2013-10-16 03:08:00 ----D---- C:\Program Files\Windows Journal
2013-10-16 03:07:21 ----D---- C:\Windows\system32\DriverStore
2013-10-16 02:27:40 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-10-16 02:03:04 ----D---- C:\Program Files\Microsoft Security Client
2013-10-16 02:03:04 ----D---- C:\Program Files (x86)\Microsoft Security Client
2013-10-15 23:26:43 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-10-15 21:23:50 ----SHD---- C:\$Recycle.Bin
2013-10-15 21:17:55 ----RD---- C:\Users
2013-10-15 21:11:38 ----A---- C:\Windows\ntbtlog.txt

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-06-18 247216]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 Soluto;Soluto; C:\Windows\system32\DRIVERS\Soluto.sys [2013-06-04 54728]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [2013-05-28 16056]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2012-04-02 72216]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-06-18 139616]
R3 3xHybr64;WinFast DTV1000 S; C:\Windows\system32\DRIVERS\3xHybr64.sys [2010-10-13 1345664]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x64.sys [2009-10-13 61440]
R3 cpuz136;cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys []
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2012-04-02 11552]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2013-04-04 25928]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2005-03-29 8192]
S3 cpuz135;cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2013-11-05 376144]
R2 LogMeIn;LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [2012-04-02 407424]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-08-12 23808]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-31 878368]
R2 SafeCopy Crawler;SafeCopy Crawler; C:\Program Files\SafeCopy\SafeCopyCrawler.exe [2011-05-10 2763112]
R2 SolutoLauncherService;Soluto Launcher Service; C:\Program Files\Soluto\SolutoLauncherService.exe [2013-06-04 182848]
R2 SolutoService;Soluto PCGenome Core Service; C:\Program Files\Soluto\SolutoService.exe [2013-06-04 746048]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-08-12 366600]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-02-19 1259296]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-06-03 162408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-15 257416]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 288776]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-03-09 30798512]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SolutoRemoteService;Soluto Remote Service; C:\Program Files\Soluto\SolutoRemoteService.exe [2013-06-04 1671680]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-05-20 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#2 Příspěvek od Rudy »

Zdravím!
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#3 Příspěvek od Indy13 »

Posílám log z ComboFix:

ComboFix 13-11-04.01 - Jenda 06.11.2013 22:55:57.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2047.1031 [GMT 1:00]
Spuštěný z: c:\users\Jenda\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\smartdl
c:\program files (x86)\smartdl\dler.exe
c:\program files (x86)\smartdl\gunzip.exe
c:\program files (x86)\smartdl\header.bmp
c:\program files (x86)\smartdl\header2.bmp
c:\program files (x86)\smartdl\header3.bmp
c:\program files (x86)\smartdl\next.bmp
c:\program files (x86)\smartdl\skip.bmp
c:\program files (x86)\smartdl\status-o
c:\users\Jenda\AppData\Local\TempDIR
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-06 do 2013-11-06 )))))))))))))))))))))))))))))))
.
.
2013-11-06 22:01 . 2013-11-06 22:01 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-06 22:01 . 2013-11-06 22:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-06 20:17 . 2013-11-06 20:18 -------- d-----w- c:\program files\trend micro
2013-11-06 20:17 . 2013-11-06 20:18 -------- d-----w- C:\rsit
2013-11-05 22:37 . 2013-11-05 22:37 -------- d-----w- c:\programdata\Oracle
2013-11-05 22:36 . 2013-11-05 22:36 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-11-05 22:35 . 2013-11-05 22:35 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-11-05 22:35 . 2013-11-05 22:35 -------- d-----w- c:\program files (x86)\Java
2013-11-05 22:28 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BDCAD5FF-6FA5-40E6-8F02-1C43CA658375}\mpengine.dll
2013-10-25 07:40 . 2013-10-25 07:40 -------- d-----w- c:\users\Jenda\AppData\Roaming\Malwarebytes
2013-10-25 07:27 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-10-20 14:49 . 2013-10-20 14:49 -------- d-----w- c:\program files\McAfee Security Scan
2013-10-19 12:41 . 2013-10-19 12:39 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{453DE0CF-8920-4F46-AEB0-E05E6D900B43}\gapaengine.dll
2013-10-16 15:00 . 2013-10-16 15:00 -------- d-----w- c:\users\Jenda\AppData\Roaming\Unity
2013-10-16 06:01 . 2013-10-16 06:01 -------- d-----w- c:\programdata\Malwarebytes
2013-10-16 06:01 . 2013-10-16 06:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-10-16 06:01 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-16 01:12 . 2013-10-16 01:14 -------- d-----w- c:\windows\system32\MRT
2013-10-15 22:26 . 2013-10-15 22:26 17813896 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-10-15 21:24 . 2013-10-16 06:19 -------- d-----w- c:\programdata\BitGuard
2013-10-15 21:19 . 2013-07-04 12:50 633856 ----a-w- c:\windows\system32\comctl32.dll
2013-10-15 21:19 . 2013-07-04 11:50 530432 ----a-w- c:\windows\SysWow64\comctl32.dll
2013-10-15 21:19 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-10-15 21:19 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-10-15 21:19 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-10-15 21:19 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-10-15 21:19 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-10-15 21:19 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-10-15 21:19 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-10-15 21:19 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-10-15 21:18 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-10-15 21:18 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-10-15 21:16 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll
2013-10-15 21:15 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-10-15 21:15 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-10-15 21:15 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-10-15 21:15 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-10-15 21:15 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-10-15 21:15 . 2013-07-20 10:33 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 21:15 . 2013-07-20 10:33 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 21:15 . 2013-08-01 12:09 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-10-15 21:15 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-10-15 21:15 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-10-15 20:55 . 2013-08-28 01:12 461312 ----a-w- c:\windows\system32\scavengeui.dll
2013-10-15 20:17 . 2013-10-15 20:24 -------- d-----w- c:\users\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-05 22:23 . 2012-05-20 20:24 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-11-05 22:23 . 2012-05-20 20:24 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-11-05 22:23 . 2012-05-20 20:24 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-10-15 22:26 . 2012-05-20 08:32 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-15 22:26 . 2012-05-20 08:32 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-15 20:47 . 2012-06-13 07:42 965008 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-25 23:46 . 2012-05-20 12:56 80541720 ----a-w- c:\windows\system32\MRT.exe
2013-09-03 12:35 . 2012-05-19 21:30 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-29 01:48 . 2013-10-15 21:16 44032 ----a-w- c:\windows\apppatch\acwow64.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
2013-01-29 13:28 170840 ----a-w- c:\program files\Web Assistant\Extension32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SafeCopy"="c:\program files\SafeCopy\SafeCopy.exe" [2011-05-10 1642856]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-03 19604072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe [2013-9-6 324320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SolutoRemoteService;Soluto Remote Service;c:\program files\Soluto\SolutoRemoteService.exe;c:\program files\Soluto\SolutoRemoteService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 Soluto;Soluto;c:\windows\system32\DRIVERS\Soluto.sys;c:\windows\SYSNATIVE\DRIVERS\Soluto.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 SafeCopy Crawler;SafeCopy Crawler;c:\program files\SafeCopy\SafeCopyCrawler.exe;c:\program files\SafeCopy\SafeCopyCrawler.exe [x]
S2 SolutoLauncherService;Soluto Launcher Service;c:\program files\Soluto\SolutoLauncherService.exe;c:\program files\Soluto\SolutoLauncherService.exe [x]
S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe;c:\program files\Soluto\SolutoService.exe [x]
S3 3xHybr64;WinFast DTV1000 S;c:\windows\system32\DRIVERS\3xHybr64.sys;c:\windows\SYSNATIVE\DRIVERS\3xHybr64.sys [x]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys;c:\windows\SYSNATIVE\DRIVERS\l160x64.sys [x]
S3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-11-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 22:26]
.
2013-10-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000Core.job
- c:\users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 13:14]
.
2013-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000UA.job
- c:\users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 13:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-08-12 1356240]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2012-04-02 57928]
"Soluto"="c:\program files\soluto\soluto.exe" [2013-06-04 1230400]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.1.1.100
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item1]
@Denied: (2) (Administrator)
@Denied: (2) (S-1-5-21-2668028546-86241823-3386800611-1000)
"Flag"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item2]
@Denied: (2) (Administrator)
@Denied: (2) (S-1-5-21-2668028546-86241823-3386800611-1000)
"Flag"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item3]
@Denied: (2) (Administrator)
@Denied: (2) (S-1-5-21-2668028546-86241823-3386800611-1000)
"Flag"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-11-06 23:05:01
ComboFix-quarantined-files.txt 2013-11-06 22:05
.
Před spuštěním: Volných bajtů: 938 264 973 312
Po spuštění: Volných bajtů: 939 303 604 224
.
- - End Of File - - 656797DA0ED2339718E2EBCE631AD192
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#4 Příspěvek od Rudy »

Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Folder::
c:\program files\McAfee Security Scan

File::
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000UA.job

Driver::
McComponentHostService

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item2]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DataMngr\List\Item3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#5 Příspěvek od Indy13 »

Zde je výsledek:

ComboFix 13-11-04.01 - Jenda 06.11.2013 23:28:13.2.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.2047.794 [GMT 1:00]
Spuštěný z: c:\users\Jenda\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jenda\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\McAfee Security Scan
c:\program files\McAfee Security Scan\3.8.130\AVScanComponent.dll
c:\program files\McAfee Security Scan\3.8.130\AVScanner.ini
c:\program files\McAfee Security Scan\3.8.130\avvclean.dat
c:\program files\McAfee Security Scan\3.8.130\avvnames.dat
c:\program files\McAfee Security Scan\3.8.130\avvscan.dat
c:\program files\McAfee Security Scan\3.8.130\config.dat
c:\program files\McAfee Security Scan\3.8.130\ftconfig.ini
c:\program files\McAfee Security Scan\3.8.130\McAfee.ico
c:\program files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll
c:\program files\McAfee Security Scan\3.8.130\mcbrwsr2.dll
c:\program files\McAfee Security Scan\3.8.130\MCCompHostConfig.ini
c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe
c:\program files\McAfee Security Scan\3.8.130\McInstallerRes.dll
c:\program files\McAfee Security Scan\3.8.130\McInstallerRes_LD.dll
c:\program files\McAfee Security Scan\3.8.130\McInstallerStartup.dll
c:\program files\McAfee Security Scan\3.8.130\McUICnt.exe
c:\program files\McAfee Security Scan\3.8.130\McUpdater.dll
c:\program files\McAfee Security Scan\3.8.130\mscan64a.dll
c:\program files\McAfee Security Scan\3.8.130\npMcAfeeMSS.dll
c:\program files\McAfee Security Scan\3.8.130\sa_cache_sqlite.dll
c:\program files\McAfee Security Scan\3.8.130\sa_http_win32.dll
c:\program files\McAfee Security Scan\3.8.130\sa_mbl.dll
c:\program files\McAfee Security Scan\3.8.130\sa_store_sqlite.dll
c:\program files\McAfee Security Scan\3.8.130\sacore.db
c:\program files\McAfee Security Scan\3.8.130\sacore.dll
c:\program files\McAfee Security Scan\3.8.130\sacoredata\uds_filetypes.txt
c:\program files\McAfee Security Scan\3.8.130\sacoredata\uds_hosting.txt
c:\program files\McAfee Security Scan\3.8.130\sacoredata\uds_tlds.txt
c:\program files\McAfee Security Scan\3.8.130\SecurityScanner.dll
c:\program files\McAfee Security Scan\3.8.130\SecurityScanner_LD.dll
c:\program files\McAfee Security Scan\3.8.130\signlic.txt
c:\program files\McAfee Security Scan\3.8.130\sqlite3.dll
c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe
c:\program files\McAfee Security Scan\3.8.130\uninstaller.ini
c:\program files\McAfee Security Scan\3.8.130\WebInfoScanner.dll
c:\program files\McAfee Security Scan\3.8.130\WMIScanner.dll
c:\program files\McAfee Security Scan\uninstall.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_McComponentHostService
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-06 do 2013-11-06 )))))))))))))))))))))))))))))))
.
.
2013-11-06 22:33 . 2013-11-06 22:33 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-06 20:17 . 2013-11-06 20:18 -------- d-----w- c:\program files\trend micro
2013-11-06 20:17 . 2013-11-06 20:18 -------- d-----w- C:\rsit
2013-11-05 22:37 . 2013-11-05 22:37 -------- d-----w- c:\programdata\Oracle
2013-11-05 22:36 . 2013-11-05 22:36 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-11-05 22:35 . 2013-11-05 22:35 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-11-05 22:35 . 2013-11-05 22:35 -------- d-----w- c:\program files (x86)\Java
2013-11-05 22:28 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BDCAD5FF-6FA5-40E6-8F02-1C43CA658375}\mpengine.dll
2013-10-25 07:40 . 2013-10-25 07:40 -------- d-----w- c:\users\Jenda\AppData\Roaming\Malwarebytes
2013-10-25 07:27 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-10-19 12:41 . 2013-10-19 12:39 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{453DE0CF-8920-4F46-AEB0-E05E6D900B43}\gapaengine.dll
2013-10-16 15:00 . 2013-10-16 15:00 -------- d-----w- c:\users\Jenda\AppData\Roaming\Unity
2013-10-16 06:01 . 2013-10-16 06:01 -------- d-----w- c:\programdata\Malwarebytes
2013-10-16 06:01 . 2013-10-16 06:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-10-16 06:01 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-16 01:12 . 2013-10-16 01:14 -------- d-----w- c:\windows\system32\MRT
2013-10-15 22:26 . 2013-10-15 22:26 17813896 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-10-15 21:24 . 2013-10-16 06:19 -------- d-----w- c:\programdata\BitGuard
2013-10-15 21:19 . 2013-07-04 12:50 633856 ----a-w- c:\windows\system32\comctl32.dll
2013-10-15 21:19 . 2013-07-04 11:50 530432 ----a-w- c:\windows\SysWow64\comctl32.dll
2013-10-15 21:19 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-10-15 21:19 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-10-15 21:19 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-10-15 21:19 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-10-15 21:19 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-10-15 21:19 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-10-15 21:19 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-10-15 21:19 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-10-15 21:18 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-10-15 21:18 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-10-15 21:16 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll
2013-10-15 21:15 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-10-15 21:15 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-10-15 21:15 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-10-15 21:15 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-10-15 21:15 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-10-15 21:15 . 2013-07-20 10:33 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 21:15 . 2013-07-20 10:33 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 21:15 . 2013-08-01 12:09 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-10-15 21:15 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-10-15 21:15 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-10-15 20:55 . 2013-08-28 01:12 461312 ----a-w- c:\windows\system32\scavengeui.dll
2013-10-15 20:17 . 2013-10-15 20:24 -------- d-----w- c:\users\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-05 22:23 . 2012-05-20 20:24 35656 ----a-w- c:\windows\system32\LMIport.dll
2013-11-05 22:23 . 2012-05-20 20:24 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-11-05 22:23 . 2012-05-20 20:24 92488 ----a-w- c:\windows\system32\LMIinit.dll
2013-10-15 22:26 . 2012-05-20 08:32 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-15 22:26 . 2012-05-20 08:32 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-15 20:47 . 2012-06-13 07:42 965008 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-25 23:46 . 2012-05-20 12:56 80541720 ----a-w- c:\windows\system32\MRT.exe
2013-09-03 12:35 . 2012-05-19 21:30 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-29 01:48 . 2013-10-15 21:16 44032 ----a-w- c:\windows\apppatch\acwow64.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
2013-01-29 13:28 170840 ----a-w- c:\program files\Web Assistant\Extension32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2011-05-10 18:02 758784 ----a-w- c:\program files\SafeCopy\ShellExtension\ShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SafeCopy"="c:\program files\SafeCopy\SafeCopy.exe" [2011-05-10 1642856]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-03 19604072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SolutoRemoteService;Soluto Remote Service;c:\program files\Soluto\SolutoRemoteService.exe;c:\program files\Soluto\SolutoRemoteService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 Soluto;Soluto;c:\windows\system32\DRIVERS\Soluto.sys;c:\windows\SYSNATIVE\DRIVERS\Soluto.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 SafeCopy Crawler;SafeCopy Crawler;c:\program files\SafeCopy\SafeCopyCrawler.exe;c:\program files\SafeCopy\SafeCopyCrawler.exe [x]
S2 SolutoLauncherService;Soluto Launcher Service;c:\program files\Soluto\SolutoLauncherService.exe;c:\program files\Soluto\SolutoLauncherService.exe [x]
S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe;c:\program files\Soluto\SolutoService.exe [x]
S3 3xHybr64;WinFast DTV1000 S;c:\windows\system32\DRIVERS\3xHybr64.sys;c:\windows\SYSNATIVE\DRIVERS\3xHybr64.sys [x]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys;c:\windows\SYSNATIVE\DRIVERS\l160x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2013-11-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 22:26]
.
2013-10-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000Core.job
- c:\users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 13:14]
.
2013-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2668028546-86241823-3386800611-1000UA.job
- c:\users\Jenda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 13:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2011-05-10 18:02 941568 ----a-w- c:\program files\SafeCopy\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-08-12 1356240]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2012-04-02 57928]
"Soluto"="c:\program files\soluto\soluto.exe" [2013-06-04 1230400]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.1.1.100
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Celkový čas: 2013-11-06 23:39:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-06 22:39
ComboFix2.txt 2013-11-06 22:05
.
Před spuštěním: Volných bajtů: 939 336 396 800
Po spuštění: Volných bajtů: 938 756 128 768
.
- - End Of File - - 0FE29AB4076262D1AD163F4158D1871A
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#6 Příspěvek od Rudy »

Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#7 Příspěvek od Indy13 »

Zatím se nic špatného nenachází, takže snad dobré. :-) Je z těch logů poznat, zda tam bylo něco zahryznutého, co MWAV nezvládal?
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#8 Příspěvek od Rudy »

Byl tam SmartDl, což je vyhledávač torrentů, ktarého, jako potenciální nebezpečí CF maže. Dočišťovali jsme pak již pouze zbytečnosti a Adwary. MWAV už dávno není tím, čím býval dříve. Tady, na fóru jsme ho přestali používat.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#9 Příspěvek od Indy13 »

Díky za info. Nevěděl jsem, že kvalita NWAV šla tak dolů. Mohu tedy poprosit o doporučení nějakého AV pro domácí použití, se kterým máte dobré zkušenosti?

Děkuji.
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#10 Příspěvek od Rudy »

Kaspersky MWAV prodal a od té doby to není žádný zvláště dobrý skener. My tu jako skener požíváme buď MBAM: http://www.malwarebytes.org/mbam.php , nebo AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 . Základem bezpečnosti je ovšem vždy rezidentní antivirus.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#11 Příspěvek od Indy13 »

Děkuji za info. A jaký rezidentní AV byste s klidným svědomím doporučil?
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#12 Příspěvek od Rudy »

Máte v PC MSSE, což pro home usera poavžuji za dostatečné. Alternativou by mohl být Avast, nebo Avira. ComboFix odinstalujte pomocí T-Cleaneru: http://vyosek.ic.cz/pro_usery/T-Cleaner.exe .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Indy13
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 12 kvě 2009 22:32

Re: Zavirované PC

#13 Příspěvek od Indy13 »

Príma, děkuji za pomoc i rady. Přeji příjemný den.

S pozdravem,

Jiří Dalešický
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119532
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Zavirované PC

#14 Příspěvek od Rudy »

Hezký zbytek dne i vám a nemáte zač! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“