prosím o kontrolu logu

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

ivik123
nováček
Příspěvky: 24
Registrován: květen 17
Pohlaví: Žena
Stav:
Offline

Re: prosím o kontrolu logu

Příspěvekod ivik123 » 16 lis 2017 13:01

RogueKiller V12.11.24.0 [Nov 13 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Webová stránka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno : Normální režim
Uživatel : Iv?a [Práva správce]
Started from : C:\Users\Iv?a\Downloads\RogueKiller_portable32.exe
Mód : Smazat -- Datum : 11/16/2017 12:24:03 (Duration : 00:27:11)

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 5 ¤¤¤
[PUP.Conduit|PUP.Gen1] HKEY_USERS\S-1-5-21-1935359104-4094134921-1001328300-1000\Software\Conduit -> Smazáno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 172.16.10.1 ([]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 172.16.10.1 ([]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5BACC0E3-511C-4A89-A4A0-4754FE1E4B13} | DhcpNameServer : 172.16.10.1 ([]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{5BACC0E3-511C-4A89-A4A0-4754FE1E4B13} | DhcpNameServer : 172.16.10.1 ([]) -> Nahrazeno ()

¤¤¤ Úlohy : 1 ¤¤¤
[Hj.Shortcut] \{8F0D6EEB-1A2C-46FD-A239-72FC3E7C5924} -- "c:\program files\opera\opera.exe" (http://ui.skype.com/ui/0/4.1.0.141/cs/a ... ltbrowser2) -> Smazáno

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST9500325AS ATA Device +++++
--- User ---
[MBR] 7277234bba87c440d407b7517242bc61
[BSP] 102a61b6d82184655e983cabfa21319d : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 40962 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 83891430 | Size: 435967 MB
User = LL1 ... OK
User = LL2 ... OK

Reklama
ivik123
nováček
Příspěvky: 24
Registrován: květen 17
Pohlaví: Žena
Stav:
Offline

Re: prosím o kontrolu logu

Příspěvekod ivik123 » 16 lis 2017 13:51

Zoek.exe v5.0.0.1 Updated 24-October-2017
Tool run by Ivźa on źt 16.11.2017 at 13:03:56,62.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\IVA~1\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

16.11.2017 13:04:44 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\IVA~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\IVA~1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\IVA~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\IVA~1\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\IVA~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\IVA~1\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=9 folders=10 6682336 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\IVA~1\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\IVA~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\IVA~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on źt 16.11.2017 at 13:10:23,35 ======================

ivik123
nováček
Příspěvky: 24
Registrován: květen 17
Pohlaví: Žena
Stav:
Offline

Re: prosím o kontrolu logu

Příspěvekod ivik123 » 16 lis 2017 14:34

ComboFix 17-11-14.01 - Ivča 16.11.2017 13:54:10.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.3037.1577 [GMT 1:00]
Spuštěný z: c:\users\IvŔa\Downloads\ComboFix.exe
AV: Avast Antivirus *Disabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Avast Antivirus *Disabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_ctypes.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_elementtree.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_hashlib.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_multiprocessing.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_psutil_windows.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_socket.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_ssl.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\_yappi.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\common.time34.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\hashobjs_ext.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\pyexpat.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\pysqlite2._sqlite.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\python27.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\pythoncom27.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\PyWinTypes27.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\select.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\thumbnails_ext.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\unicodedata.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\usb_ext.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32api.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32com.shell.shell.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32crypt.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32event.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32file.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32gui.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32inet.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32pdh.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32pipe.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32process.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32profile.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32security.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\win32ts.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\windows._lib_cacheinvalidation.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._animate.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._controls_.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._core_.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._gdi_.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._html2.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._misc_.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._windows_.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wx._wizard.pyd
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxbase30u_net_vc90.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxbase30u_vc90.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxmsw30u_adv_vc90.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxmsw30u_core_vc90.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxmsw30u_html_vc90.dll
c:\users\IVA~1\AppData\Local\Temp\_MEI37362\wxmsw30u_webview_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_ctypes.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_elementtree.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_hashlib.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_multiprocessing.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_psutil_windows.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_socket.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_ssl.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\_yappi.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\common.time34.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\hashobjs_ext.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\pyexpat.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\pysqlite2._sqlite.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\python27.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\pythoncom27.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\PyWinTypes27.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\select.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\thumbnails_ext.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\unicodedata.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\usb_ext.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32api.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32com.shell.shell.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32crypt.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32event.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32file.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32gui.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32inet.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32pdh.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32pipe.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32process.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32profile.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32security.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\win32ts.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\windows._lib_cacheinvalidation.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._animate.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._controls_.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._core_.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._gdi_.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._html2.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._misc_.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._windows_.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wx._wizard.pyd
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxbase30u_net_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxbase30u_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxmsw30u_adv_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxmsw30u_core_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxmsw30u_html_vc90.dll
c:\users\Ivča\AppData\Local\Temp\_MEI37362\wxmsw30u_webview_vc90.dll
c:\windows\PFRO.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2017-10-16 do 2017-11-16 )))))))))))))))))))))))))))))))
.
.
2017-11-16 12:12 . 2017-11-16 12:12 -------- d-----w- c:\programdata\SWCUTemp
2017-11-16 12:11 . 2017-11-16 12:09 157176 ----a-w- c:\windows\system32\drivers\aswArPot.sys
2017-11-16 12:10 . 2017-11-16 12:09 305328 ----a-w- c:\windows\system32\aswBoot.exe
2017-11-16 12:05 . 2017-11-16 12:03 24064 ----a-w- c:\windows\zoek-delete.exe
2017-11-14 10:59 . 2017-11-14 10:59 -------- d-----w- c:\users\Ivča\AppData\Local\Adobe
2017-11-14 08:08 . 2017-11-14 08:08 -------- d-----w- c:\programdata\Sophos
2017-11-14 08:06 . 2017-11-14 08:06 -------- d-----w- c:\program files\Sophos
2017-11-14 07:26 . 2017-11-14 07:29 167352 ----a-w- c:\windows\system32\drivers\MbamChameleon.sys
2017-11-14 07:26 . 2017-11-16 13:04 40376 ----a-w- c:\windows\system32\drivers\mbam.sys
2017-11-14 07:26 . 2017-11-16 13:04 221112 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2017-11-14 07:17 . 2017-11-14 07:17 -------- d-----w- c:\windows\system32\SPReview
2017-11-14 07:16 . 2017-11-14 07:16 -------- d-----w- c:\windows\system32\EventProviders
2017-11-14 07:12 . 2017-11-14 07:12 124059592 -c--a-w- c:\windows\system32\MRT-KB890830.exe
2017-11-14 07:08 . 2010-11-20 12:21 505856 ----a-w- c:\windows\system32\taskschd.dll
2017-11-14 07:07 . 2010-11-20 12:21 36352 ----a-w- c:\windows\system32\wshbth.dll
2017-11-13 08:54 . 2017-11-01 07:54 59896 ----a-w- c:\windows\system32\drivers\mbae.sys
2017-11-13 08:54 . 2017-11-13 08:54 -------- d-----w- c:\programdata\MB3CoreBackup
2017-11-04 05:22 . 2017-11-04 05:22 -------- d-----w- c:\program files\Common Files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-11-16 12:11 . 2014-08-16 20:28 388760 ----a-w- c:\windows\system32\drivers\aswSP.sys
2017-11-16 12:09 . 2014-08-16 20:28 150848 ----a-w- c:\windows\system32\drivers\aswStm.sys
2017-11-16 12:09 . 2014-08-16 20:28 298360 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2017-11-16 12:09 . 2014-08-16 20:28 70864 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2017-11-16 12:09 . 2014-08-16 20:28 124952 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2017-11-16 12:09 . 2014-08-16 20:28 42848 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2017-11-16 12:09 . 2014-08-16 20:28 99560 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2017-11-16 12:09 . 2014-08-16 20:28 783136 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2017-11-16 12:09 . 2017-04-04 18:15 50376 ----a-w- c:\windows\system32\drivers\aswbunivx.sys
2017-11-16 12:09 . 2017-04-04 18:15 276728 ----a-w- c:\windows\system32\drivers\aswblogx.sys
2017-11-16 12:09 . 2017-04-04 18:15 157408 ----a-w- c:\windows\system32\drivers\aswbidshx.sys
2017-11-16 12:09 . 2017-04-04 18:15 255616 ----a-w- c:\windows\system32\drivers\aswbidsdriverx.sys
2017-11-16 11:24 . 2014-09-30 21:57 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2017-11-14 07:33 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2017-11-04 05:21 . 2015-03-12 18:41 95808 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2017-10-27 13:47 . 2014-08-16 20:28 783648 ----a-w- c:\windows\system32\drivers\aswa9ef7482b9bbea3c.tmp
2017-10-13 16:42 . 2014-08-16 20:28 149824 ----a-w- c:\windows\system32\drivers\asw7054c62e7c7d88f0.tmp
2017-10-13 16:42 . 2014-08-16 20:28 297840 ----a-w- c:\windows\system32\drivers\asw1391955b27ac7971.tmp
2017-10-13 16:42 . 2014-08-16 20:28 499560 ----a-w- c:\windows\system32\drivers\aswd59e5355ea82cb64.tmp
2017-10-13 16:42 . 2014-08-16 20:28 70864 ----a-w- c:\windows\system32\drivers\asw286031b5533914cf.tmp
2017-10-13 16:42 . 2014-08-16 20:28 124952 ----a-w- c:\windows\system32\drivers\asw4eb934b8d63775c1.tmp
2017-10-13 16:42 . 2014-08-16 20:28 42856 ----a-w- c:\windows\system32\drivers\asw594fb44d1e8349c7.tmp
2017-10-13 16:42 . 2014-08-16 20:28 99560 ----a-w- c:\windows\system32\drivers\asw772077728f95195b.tmp
2017-10-13 16:42 . 2017-04-04 18:15 50384 ----a-w- c:\windows\system32\drivers\aswc8b64dcb78bc34ed.tmp
2017-10-13 16:42 . 2017-04-04 18:15 276736 ----a-w- c:\windows\system32\drivers\asw96ab70bb7fc94c1a.tmp
2017-10-13 16:42 . 2017-04-04 18:15 157416 ----a-w- c:\windows\system32\drivers\asw26ee442dce5c922e.tmp
2017-10-13 16:42 . 2017-04-04 18:15 255624 ----a-w- c:\windows\system32\drivers\aswc7bf84f77392719e.tmp
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveBlacklisted]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2017-10-09 08:33 576408 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSynced]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2017-10-09 08:33 576408 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSyncing]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2017-10-09 08:33 576408 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2017-11-16 12:09 1396816 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2017-10-09 25621648]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2016-08-26 6868696]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvLaunch.exe" [2017-11-16 253344]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2017-09-05 587288]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2017-11-14 280576]
.
c:\users\Ivča\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
R3 aswArPot;aswArPot;c:\windows\system32\drivers\aswArPot.sys [2017-11-16 157176]
R3 aswbIDSAgent;aswbIDSAgent;c:\program files\AVAST Software\Avast\aswidsagent.exe [2017-11-16 5904136]
R3 aswbidsdriver;aswbidsdriver;c:\windows\system32\drivers\aswbidsdriverx.sys [2017-11-16 255616]
R3 aswbidsh;aswbidsh;c:\windows\system32\drivers\aswbidshx.sys [2017-11-16 157408]
R3 aswblog;aswblog;c:\windows\system32\drivers\aswblogx.sys [2017-11-16 276728]
R3 aswbuniv;aswbuniv;c:\windows\system32\drivers\aswbunivx.sys [2017-11-16 50376]
R3 aswHwid;aswHwid;c:\windows\system32\drivers\aswHwid.sys [2017-11-16 42848]
R3 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2017-11-16 783136]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2017-11-16 150848]
R3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2017-11-16 298360]
R3 MBAMProtection;MBAMProtection;c:\windows\system32\DRIVERS\mbam.sys [2017-11-16 40376]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2017-11-16 70864]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2017-11-16 388760]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2017-11-16 124952]
S2 MBAMChameleon;MBAMChameleon;c:\windows\System32\Drivers\MbamChameleon.sys [2017-11-14 167352]
S2 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-11-01 4563920]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\Drivers\mbamswissarmy.sys [2017-11-16 221112]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2017-11-16 06:54 1509208 ----a-w- c:\program files\Google\Chrome\Application\62.0.3202.94\Installer\chrmstp.exe
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 172.16.10.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-{ce085a78-074e-4823-8dc1-8a721b94b76d} - c:\programdata\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Malwarebytes\Anti-Malware\mbamtray.exe
c:\windows\system32\conhost.exe
.
**************************************************************************
.
Celkový čas: 2017-11-16 14:31:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2017-11-16 13:31
.
Před spuštěním: 3 070 275 584
Po spuštění: 3 573 112 832
.
- - End Of File - - B4567962D1AC1D3A19AD1FA7BB8B6134
A36C5E4F47E84449FF07ED3517B43A31

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43054
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosím o kontrolu logu

Příspěvekod jaro3 » 16 lis 2017 16:35

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.

Vlož nový log z HJT + informuj o problémech
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 8 hostů