Prosím o kontrolu logu - policejní vir ? Vyřešeno

[zvoltejmeno]

Nový log z Combofixu po přetažení nového skriptu :
ComboFix 14-07-03.01 - MSI 03.07.2014 15:23:52.4.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.3070.1848 [GMT 2:00]
Spuštěný z: c:\users\MSI\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\MSI\Desktop\CFScript.txt
AV: COMODO Antivirus *Disabled/Updated* {B74CC7D2-B407-E1DC-1033-DD315BCDC8C8}
SP: COMODO Antivirus *Disabled/Updated* {0C2D2636-923D-EE52-2A83-E643204A8275}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\program files\Common Files\APNToolbarInstaller.exe"
"c:\users\MSI\AppData\Local\Temp\catchme.dll"
"c:\windows\_MSRSTRT.EXE"
"c:\windows\pss\McAfee Security Scan Plus.lnk"
"c:\windows\system32\drivers\aswrdr.sys.1402588146733"
"c:\windows\system32\drivers\aswsnx.sys.1402588146733"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\PFRO.log
D:\install.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-06-03 do 2014-07-03 )))))))))))))))))))))))))))))))
.
.
2014-07-03 13:34 . 2014-07-03 13:37 -------- d-----w- c:\users\MSI\AppData\Local\temp
2014-07-03 13:34 . 2014-07-03 13:34 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-07-03 13:34 . 2014-07-03 13:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-07-03 12:58 . 2014-07-03 12:58 -------- d-----w- c:\programdata\RegAce
2014-07-03 12:57 . 2014-07-03 12:58 -------- d-----w- c:\program files\RegAce System Suite
2014-07-03 12:46 . 2014-07-03 12:46 -------- d-----w- c:\users\MSI\AppData\Roaming\DriverCure
2014-07-03 12:46 . 2014-07-03 12:46 -------- d-----w- c:\users\MSI\AppData\Roaming\ParetoLogic
2014-07-03 12:45 . 2014-07-03 13:11 -------- d-----w- c:\programdata\ParetoLogic
2014-07-02 21:13 . 2014-07-02 21:13 -------- d-----w- c:\users\MSI\AppData\Local\WarThunder
2014-07-02 21:13 . 2014-07-02 21:13 -------- d-----w- c:\programdata\WarThunder
2014-07-02 11:42 . 2014-07-02 11:42 -------- d-----w- c:\program files\Common Files\COMODO
2014-06-28 20:38 . 2014-06-28 20:38 -------- d-----w- c:\program files\LogMeIn Hamachi
2014-06-28 20:34 . 2014-06-28 20:34 -------- d-----w- c:\users\MSI\AppData\Local\SKIDROW
2014-06-17 18:50 . 2014-07-03 12:29 -------- d-----w- c:\users\MSI\AppData\Local\CrashDumps
2014-06-16 17:35 . 2014-06-17 16:40 26624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-06-16 17:35 . 2014-06-16 17:35 -------- d-----w- c:\programdata\RogueKiller
2014-06-16 05:35 . 2014-06-16 05:35 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2014-06-15 17:53 . 2014-06-15 17:53 -------- d-----w- c:\windows\ERUNT
2014-06-15 17:51 . 2014-06-15 17:51 -------- d-----w- C:\VTRoot
2014-06-15 17:51 . 2014-06-15 17:55 46496 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-06-15 16:22 . 2014-04-05 02:42 905664 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-06-15 12:22 . 2014-06-17 17:29 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-15 12:20 . 2014-06-15 12:20 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-06-15 12:20 . 2014-06-15 12:20 -------- d-----w- c:\programdata\Malwarebytes
2014-06-15 12:20 . 2014-05-12 05:26 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-06-15 12:20 . 2014-05-12 05:25 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-15 12:20 . 2014-05-12 05:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-06-15 12:09 . 2014-06-17 16:19 -------- d-----w- C:\AdwCleaner
2014-06-14 23:27 . 2014-06-14 23:27 -------- d-----w- c:\users\MSI\AppData\Roaming\rightbackup
2014-06-14 17:55 . 2014-06-14 17:55 -------- d-----w- c:\users\MSI\AppData\Local\AdTrustMedia
2014-06-14 17:43 . 2014-06-14 17:43 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2014-06-14 17:43 . 2014-06-14 17:43 1060864 ----a-w- c:\windows\system32\mfc71.dll
2014-06-14 12:05 . 2014-07-03 13:08 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-06-14 11:54 . 2014-06-14 11:55 -------- d-s---w- c:\programdata\Shared Space
2014-06-14 11:48 . 2014-06-14 11:48 -------- d-----w- c:\users\MSI\AppData\Local\Comodo
2014-06-14 11:48 . 2014-06-14 17:43 48392 ----a-w- c:\windows\system32\certsentry.dll
2014-06-14 11:48 . 2014-06-14 17:43 -------- d-----w- c:\program files\Comodo
2014-06-14 11:48 . 2014-06-14 11:48 -------- d-----w- c:\programdata\Comodo Downloader
2014-06-14 11:47 . 2014-06-14 12:09 -------- d-----w- c:\programdata\Comodo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-30 16:39 . 2012-08-09 09:31 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-06-30 16:39 . 2011-05-14 13:53 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-12 15:40 . 2014-06-12 15:40 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1402588146733
2014-06-12 15:40 . 2014-06-12 15:40 54832 ----a-w- c:\windows\system32\drivers\aswrdr.sys.1402588146733
2014-05-28 16:32 . 2014-06-15 16:21 1129472 ----a-w- c:\windows\system32\wininet.dll
2014-05-28 16:30 . 2014-06-15 16:21 421376 ----a-w- c:\windows\system32\vbscript.dll
2014-05-28 16:29 . 2014-06-15 16:21 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-28 16:29 . 2014-06-15 16:21 11776 ----a-w- c:\windows\system32\mshta.exe
2014-05-17 14:19 . 2014-05-17 14:19 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2014-05-04 18:21 . 2014-05-04 18:21 71680 ----a-w- c:\windows\system32\drivers\nhcDriver.sys
2014-04-26 16:01 . 2014-06-15 16:22 502784 ----a-w- c:\windows\system32\usp10.dll
2014-04-16 21:12 . 2014-03-25 18:22 92656 ----a-w- c:\windows\system32\drivers\inspect.sys
2014-04-16 21:12 . 2014-03-25 18:22 43216 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2014-04-16 21:12 . 2014-03-25 18:22 607680 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2014-04-16 21:12 . 2014-03-25 18:22 20072 ----a-w- c:\windows\system32\drivers\cmderd.sys
2014-04-16 15:51 . 2014-04-16 15:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2014-04-14 18:13 . 2014-04-21 11:09 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2011-03-23 11:03 . 2011-07-07 15:42 108424 ----a-w- c:\program files\Common Files\APNStub.exe
2011-03-23 10:26 . 2011-07-07 15:42 3325832 ----a-w- c:\program files\Common Files\APNToolbarInstaller.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-07-12 226904]
"T-Mobile CManager"="c:\program files\T-Mobile\Web'n'walk Manager\Manager.exe" [2013-10-31 2166552]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"uTorrent"="c:\users\MSI\AppData\Roaming\uTorrent\uTorrent.exe" [2014-07-02 1322832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-05-21 794624]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2014-03-25 1225944]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-06-23 3816272]
"tvncontrol"="c:\program files\Common Files\COMODO\GeekBuddyRSP.exe" [2014-06-27 2327248]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe -s [2010-9-6 1556480]
Start GeekBuddy.lnk - c:\program files\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2014-6-27 49360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoHotStart"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^MSI^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\MSI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer]
2013-08-21 09:19 450560 ----a-w- c:\program files\DivX\DivX Media Server\DivXMediaServer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2013-08-29 00:23 1861968 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
2009-03-28 21:11 3325952 ----a-w- c:\program files\Electronic Arts\EADM\Core.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2007-07-12 11:43 226904 ----a-w- c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2014-06-23 09:43 3816272 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-05-28 08:06 6144000 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2013-03-15 16:29 1632680 ----a-w- c:\program files\Steam\steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\T-Mobile CManager]
2013-10-31 16:11 2166552 ----a-w- c:\program files\T-Mobile\Web'n'walk Manager\Manager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Unify3DWebPlayerUpdate]
2014-03-06 10:02 6041088 ----a-w- c:\users\MSI\AppData\Local\Unify3D\WebPlayer\Unify3DWebPlayerUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
MbnExt REG_MULTI_SZ MbnExt
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-06-14 10:53 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-07-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-09 16:39]
.
2014-07-03 c:\windows\Tasks\RegAce Scheduled Scan - MSI.job
- c:\program files\RegAce System Suite\RegAce.exe [2014-07-03 18:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
IE: {{2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - c:\program files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
FF - ProfilePath - c:\users\MSI\AppData\Roaming\Mozilla\Firefox\Profiles\wpf3fmif.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-07-03 15:39
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3456991112-1896531325-1040802734-1000\Software\SecuROM\License information*]
"datasecu"=hex:bc,83,f3,93,b4,7d,15,3c,b5,30,7f,14,b1,b0,7e,96,8e,16,bd,cc,65,
23,da,b6,41,d3,a8,d9,df,c1,56,44,6c,cd,22,77,7e,ca,28,31,b8,03,85,91,b0,91,\
"rkeysecu"=hex:c8,36,07,35,f9,34,a3,e3,ae,1c,16,4b,6f,28,41,1c
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmdAgent\Mode\Configurations]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmdAgent\Mode\Data]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmdAgent\Mode\Options]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Cam]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(828)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(2676)
c:\windows\system32\guard32.dll
c:\windows\system32\taskschd.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\COMODO\launcher_service.exe
c:\windows\system32\nvvsvc.exe
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Microsoft\BingBar\7.3.132.0\BBSvc.exe
c:\program files\Comodo\Dragon\dragon_updater.exe
c:\programdata\Readers Digest\Eng20s.exe
c:\program files\LogMeIn Hamachi\LMIGuardianSvc.exe
c:\program files\System Control Manager\MSIService.exe
c:\program files\Razer\Razer Game Booster\RzKLService.exe
c:\program files\SensorsViewPro43\svservice.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\LogMeIn Hamachi\hamachi-2.exe
c:\program files\COMODO\COMODO Internet Security\cavwp.exe
c:\windows\system32\conime.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\program files\Comodo\GeekBuddy\unit_manager.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Comodo\GeekBuddy\unit.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Microsoft\BingBar\7.3.132.0\SeaPort.exe
.
**************************************************************************
.
Celkový čas: 2014-07-03 15:47:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-07-03 13:46
ComboFix2.txt 2014-06-30 19:49
ComboFix3.txt 2014-06-27 08:25
ComboFix4.txt 2014-06-20 19:07
.
Před spuštěním: Volných bajtů: 15 052 292 096
Po spuštění: Volných bajtů: 15 278 710 784
.
- - End Of File - - 55507B7E25E77D17ABA042B9E1AA8360
5C616939100B85E558DA92B899A0FC36

[Reklama]

[zvoltejmeno]

Nový log z HJT:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:45:45, on 3.7.2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16555)

FIREFOX: 30.0 (cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Comodo\COMODO Internet Security\CisTray.exe
C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\T-Mobile\Web'n'walk Manager\Manager.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\MSI\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Comodo\COMODO Internet Security\cis.exe
C:\Windows\system32\conime.exe
D:\Počítač 2\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MI1933~1\Office14\URLREDIR.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.3.132.0\BingExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.3.132.0\BingExt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [tvncontrol] "C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [T-Mobile CManager] "C:\Program Files\T-Mobile\Web'n'walk Manager\Manager.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [uTorrent] "C:\Users\MSI\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: Start GeekBuddy.lnk = C:\Program Files\Comodo\GeekBuddy\launcher.exe
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PrivDog - {2F5C139F-79BD-4C84-A95A-E7140525BC55} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll (file missing)
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (file missing)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: COMODO LPS Launcher (CLPSLauncher) - Comodo Security Solutions, Inc. - C:\Program Files\Common Files\COMODO\launcher_service.exe
O23 - Service: COMODO Internet Security Helper Service (CmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: English20 - Unknown owner - C:\ProgramData\Readers Digest\Eng20s.exe
O23 - Service: GeekBuddyRSP Server (GeekBuddyRSP) - Comodo Security Solutions, Inc. - C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
O23 - Service: Micro Star SCM - Unknown owner - C:\Program Files\System Control Manager\MSIService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: RzKLService - Razer Inc. - C:\Program Files\Razer\Razer Game Booster\RzKLService.exe
O23 - Service: SensorsVService - Unknown owner - C:\Program Files\SensorsViewPro43\svservice.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 9020 bytes

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.

Stáhni si program OTM (by OldTimer)
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:

Kód: Vybrat vše

:Processes
explorer.exe

:Services

:Reg

:Files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\WINDOWS\system32\*.tmp.dll
C:\WINDOWS\System32\dllcache\*.tmp
C:\WINDOWS\system32\SET*.tmp
C:\WINDOWS\system32\DUMP*.tmp
c:\windows\Tasks\*.job /s
C:\*.tmp
C:\WINDOWS\System32\drivers\*.tmp
C:\Program Files\*.tmp
C:\Documents and Settings\All Users\Data aplikací\*.tmp
c:\windows\system32\drivers\aswsnx.sys.1402588146733
c:\windows\system32\drivers\aswrdr.sys.1402588146733
c:\windows\_MSRSTRT.EXE
c:\program files\Common Files\APNToolbarInstaller.exe
c:\windows\pss\McAfee Security Scan Plus.lnk
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\users\MSI\AppData\Local\Temp\catchme.dll
c:\programdata\AVAST Software
c:\program files\Google\Update

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.
C:\_OTMoveIt\MovedFiles\********_******.log

[zvoltejmeno]

Omlouvám se, že jsem tak dlouho neodepsal. Všechno z minulého příspěvku jsem udělal.
Log z Moveltu:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\System32\dllcache\*.tmp not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\system32\DUMP*.tmp not found.
c:\windows\Tasks\Adobe Flash Player Updater.job moved successfully.
c:\windows\Tasks\RegAce Scheduled Scan - MSI.job moved successfully.
File/Folder C:\*.tmp not found.
File/Folder C:\WINDOWS\System32\drivers\*.tmp not found.
C:\Program Files\GUMD4FF.tmp folder moved successfully.
File/Folder C:\Documents and Settings\All Users\Data aplikací\*.tmp not found.
c:\windows\system32\drivers\aswsnx.sys.1402588146733 moved successfully.
c:\windows\system32\drivers\aswrdr.sys.1402588146733 moved successfully.
c:\windows\_MSRSTRT.EXE moved successfully.
c:\program files\Common Files\APNToolbarInstaller.exe moved successfully.
File/Folder c:\windows\pss\McAfee Security Scan Plus.lnk not found.
File/Folder c:\windows\Tasks\GoogleUpdateTaskMachineCore.job not found.
File/Folder c:\windows\Tasks\GoogleUpdateTaskMachineUA.job not found.
File/Folder c:\users\MSI\AppData\Local\Temp\catchme.dll not found.
File/Folder c:\programdata\AVAST Software not found.
File/Folder c:\program files\Google\Update not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: MSI
->Temp folder emptied: 48832749 bytes
->Temporary Internet Files folder emptied: 19950016 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3586697 bytes
->Google Chrome cache emptied: 33261154 bytes
->Flash cache emptied: 5450 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 24386 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 82550 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 101,00 mb


OTM by OldTimer - Version 3.1.21.0 log created on 08092014_170649

Files moved on Reboot...

Registry entries deleted on Reboot...

[jaro3]

Spusť OTM a klikni na Clean Up!

Co problémy?

[zvoltejmeno]

Na Clean Up jsem kliknul a restartovalo mi to počítač. Všechno celkem v pořádku. Problémy jsou takový:
Přijde mi, že hry (Mafia, The Sims 3) mají zubatější hrany než před tím (přitom myslím, že jsem v panelu rozhraní grafiky Nvidia nic neměnil).
A taky mi připadá, že Windows je víc náchylný neodpovídat. Párkrát když jsem například hrál místy hrál hru a místy brouzdal na internetu a chtěl jsem zavřít Google Chrome s cca 10 záložkama neodpovídal a byly to fakt galeje to zavřít. Je jasný, že to byla možná zátěž, ale aby se prohlížeč zavíral 3 minuty... Jednou při takovéhle situaci spadnul (dá-li se to tak říct) Windows explorer, tedy vlastně všechno . Prostě zmizely všechny panely a jediná ,,přeživší" plocha zbělala. No vypnul a zapnul jsem manuálně počítač.
No a taky se asi dvakrát stalo, že Win přestal na chvíli odpovídat hned po zapnutí.

[jaro3]

Stáhni si Memtest:

Políčko , ve kterém je napsáno:
All unused RAM -ponech , jak je.
-dej Start , nech nejméně 2h běžet , pokud bude po 2h stále 0 errors , jsou v pořádku.


Ještě zkontrolovat HDD na chyby ,popř. zkusit jeho defragmentaci ..


Stáhni si CrystalDiskInfo
Spusť program a klikni na Úpravy-Kopírovat. Poté sem vlož pomocí Ctrl+V obsah logu.

[zvoltejmeno]

Tohle se ukáže když v memtestu udělám to, co jsi napsal :

[zvoltejmeno]

kdyby obrázek zmizel, tady je jinej odkaz

free upload pictures

[SoNyX]

Obrázky se vkládají do přílohy.

[zvoltejmeno]

Díky no nevěděl jsem jak na to.

[Orcus]

Spusť to tolikrát najednou, aby jsi zaplnil celou paměŤ. Tudíž pokud Ti to povolí 256 MB například a máš 1024, tak to pušt 4x... atd. atd. atd. Navíc Ti to píše aby jsi to spustil dvakrát pokaždé ná 826 MB ram. Tak to tak proveď.